| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Malware loswerden, wie?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
23.07.2013, 13:13
| #1 |
| |  Malware loswerden, wie? Hallo liebes Trojaner-Board, Ich habe seit ein paar Minuten das Problem das sich manchmal Seiten wie "Blackmath.net", "Ads.glispa.com" oder "datasrvrs.com" öffnen ohne das ich es möchte. Ich habe keine große Ahnung von solchen Dingen, aber ich möchte nicht dass das so weiter geht. Mir wurde geraten hier nach Hilfe zu suchen und mein Problem zu beschreiben. Ich hoffe es kann mir jemand helfen. |
|
23.07.2013, 13:21
| #2 |
| /// the machine /// TB-Ausbilder    | Malware loswerden, wie? hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
23.07.2013, 13:35
| #3 |
| | Malware loswerden, wie? Vielen dank für diese erstmal schnelle und kompetente Antwort.
__________________(Es tut mir leid falls ich etwas unbeholfen wirke, ich habe mich nie wirklich mit meinem PC befasst) Ich habe nun wie mir jemand geraten hat OTL laufen lassen und die Logdateien sehen wie folgt aus: OTL Logfile: Code:
ATTFilter OTL logfile created on: 23.07.2013 14:21:17 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = D:\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16635) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,98 Gb Total Physical Memory | 3,34 Gb Available Physical Memory | 55,87% Memory free 11,96 Gb Paging File | 9,10 Gb Available in Paging File | 76,08% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 457,89 Gb Total Space | 353,20 Gb Free Space | 77,14% Space Free | Partition Type: NTFS Drive D: | 457,89 Gb Total Space | 181,39 Gb Free Space | 39,61% Space Free | Partition Type: NTFS Drive E: | 3,15 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: PETER-PC | User Name: peter | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - D:\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Users\peter\AppData\Roaming\WebCake\WebCakeDesktop.exe (WebCake LLC) PRC - C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe (WebCake LLC) PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe (Adobe Systems, Inc.) PRC - C:\Users\peter\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe () PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.) PRC - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group) PRC - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated) PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) PRC - C:\Program Files (x86)\TC UP\TOTALCMD.EXE (C. Ghisler & Co.) ========== Modules (No Company Name) ========== MOD - C:\Users\peter\AppData\Roaming\WebCake\dat\sqlite3.DLL () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\e937e3331234e8da935e71172e46ba17\IAStorUtil.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\34002b75cd0faab68bf8079299c1aa46\IAStorCommon.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\c8ea295fd4dce110b32c3c4f0e3807b2\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\178644ab40108f3becd8b91049a254c3\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\bfa7a95284aec941f4b03bae0debe07c\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\c25666b99761bc42322bae2e59968df8\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\32066405eb9ab14056b2af3115d2a6de\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\9e24b9ffd816c0c90efc4d3fc9fd745f\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\187c13e8967097d2ed1e5f123e7d890a\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll () MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll () MOD - C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll () MOD - C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll () MOD - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe () MOD - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll () ========== Services (SafeList) ========== SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV:64bit: - (Updater Service) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group) SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll () SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (TuneUp.Defrag) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software) SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (MWLService) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe (Egis Technology Inc.) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG) SRV - (GREGService) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe (TuneUp Software) SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software) SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®) ========== Driver Services (SafeList) ========== DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (aswKbd) -- C:\Windows\SysNative\drivers\aswKbd.sys (AVAST Software) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (e1cexpress) -- C:\Windows\SysNative\drivers\e1c62x64.sys (Intel Corporation) DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (1394hub) -- C:\Windows\SysNative\svchost.exe (Microsoft Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (mwlPSDVDisk) -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.) DRV:64bit: - (mwlPSDFilter) -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.) DRV:64bit: - (mwlPSDNServ) -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.) DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys (TuneUp Software) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (VD_FileDisk) -- C:\Windows\SysWow64\drivers\vd_filedisk.sys (Flint Incorporation) DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-21-113889186-958389736-2327801283-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKU\S-1-5-21-113889186-958389736-2327801283-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.nexon.com IE - HKU\S-1-5-21-113889186-958389736-2327801283-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-113889186-958389736-2327801283-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-113889186-958389736-2327801283-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: %7B64161300-e22b-11db-8314-0800200c9a66%7D:0.9.6.15 FF - prefs.js..extensions.enabledAddons: plugin%40getwebcake.com:1.00.01 FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.17 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nexon.com/NexonPlugWebExtension: C:\ProgramData\Nexon\NexonPlug\npPlugWire_1.0.0.0.dll (Nexon) FF - HKLM\Software\MozillaPlugins\@nexon.com/NxGame: C:\ProgramData\Nexon\NGM\npnxgame.dll File not found FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll File not found FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@ogplanet.com/npOGPPlugin: C:\Windows\system32\npOGPPlugin.dll (OGPlanet) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Program Files (x86)\Object\facetheme [2011.07.18 00:34:06 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Program Files (x86)\Object\facetheme [2011.07.18 00:34:06 | 000,000,000 | ---D | M] [2013.07.14 19:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Extensions [2013.07.22 15:56:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\bjyo7zt0.default\extensions [2011.12.27 15:46:19 | 000,000,000 | ---D | M] (Hyperionics DB Toolbar) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\bjyo7zt0.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC} [2013.07.19 23:26:37 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\bjyo7zt0.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013.07.11 17:10:48 | 000,000,000 | ---D | M] (WebCake) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\bjyo7zt0.default\extensions\plugin@getwebcake.com [2013.06.05 18:20:49 | 000,281,668 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\bjyo7zt0.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi [2013.07.22 15:56:00 | 000,818,491 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\bjyo7zt0.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.07.03 06:16:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions [2013.07.03 06:16:29 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (WebCake) - {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} - C:\Program Files (x86)\WebCake\WebCakeIEClient.dll (WebCake LLC) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (SMTTB2009 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll () O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Hyperionics DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll () O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-113889186-958389736-2327801283-1000\..\Toolbar\WebBrowser: (Hyperionics DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll () O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe () O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-113889186-958389736-2327801283-1000..\Run: [Akamai NetSession Interface] C:\Users\peter\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) O4 - HKU\S-1-5-21-113889186-958389736-2327801283-1000..\Run: [WebCake Desktop] C:\Users\peter\AppData\Roaming\WebCake\WebCakeDesktop.exe (WebCake LLC) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0 O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{50013DB5-E9CF-4C4A-8250-CC107C688551}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.07.23 14:20:01 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\Malwarebytes [2013.07.23 14:19:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.07.23 14:19:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.07.23 14:19:03 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2013.07.23 14:19:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2013.07.23 00:12:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\koramgame [2013.07.23 00:10:34 | 000,000,000 | ---D | C] -- C:\koramgame [2013.07.22 11:53:50 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B} [2013.07.21 23:53:24 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64} [2013.07.20 09:09:16 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\{F59909EA-0794-4496-A61C-F223F3430CEF} [2013.07.17 04:30:57 | 000,000,000 | ---D | C] -- C:\Windows\Sun [2013.07.16 11:54:38 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1} [2013.07.15 18:03:57 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C} [2013.07.15 04:44:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Grand Chase [2013.07.15 04:38:13 | 000,000,000 | ---D | C] -- C:\SG Interactive [2013.07.15 04:38:07 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\Programs [2013.07.15 03:13:37 | 000,383,864 | ---- | C] (SG Interactive ) -- C:\GrandChase_Install_070213.exe [2013.07.14 21:26:28 | 000,000,000 | ---D | C] -- C:\Users\peter\Documents\The KMPlayer [2013.07.14 19:57:17 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\Avira [2013.07.14 13:23:55 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\Macromedia [2013.07.12 21:02:28 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\PMB Files [2013.07.12 21:02:27 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files [2013.07.12 02:29:31 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.07.12 02:29:31 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.07.12 02:29:30 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013.07.12 02:29:30 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.07.12 02:29:30 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe [2013.07.12 02:29:30 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013.07.12 02:29:30 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2013.07.12 02:29:30 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.07.12 02:29:30 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2013.07.12 02:29:30 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2013.07.12 02:29:30 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.07.12 02:29:29 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.07.12 02:29:29 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.07.12 02:29:29 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.07.12 02:29:28 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.07.11 20:26:05 | 001,887,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL [2013.07.11 20:26:05 | 001,620,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMVDECOD.DLL [2013.07.11 20:26:05 | 000,624,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll [2013.07.11 20:26:05 | 000,509,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qedit.dll [2013.07.11 20:25:02 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll [2013.07.11 17:10:47 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\WebCake [2013.07.11 17:10:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WebCake [2013.07.11 17:10:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer [2013.07.10 19:36:29 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\FreeVideoConverter [2013.07.10 18:06:23 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\DVDVideoSoft [2013.07.09 14:17:02 | 671,261,856 | ---- | C] (InstallShield Software Corporation) -- C:\S4_League.exe [2013.07.05 22:02:21 | 000,000,000 | ---D | C] -- C:\lang [2013.07.05 22:02:21 | 000,000,000 | ---D | C] -- C:\flash0 [2013.07.05 22:02:21 | 000,000,000 | ---D | C] -- C:\assets [2013.07.05 06:06:59 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\Keldon_Corps [2013.07.04 19:19:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elsword_DE [2013.07.04 19:18:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Gameforge4D [2013.07.03 15:38:09 | 000,000,000 | ---D | C] -- C:\dolphin-3.0-win32 [2013.07.03 06:16:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013.07.03 05:53:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2013.07.03 05:53:07 | 000,263,592 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2013.07.03 05:53:02 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2013.07.03 05:53:02 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2013.07.03 05:53:02 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll [2013.07.01 23:10:17 | 000,000,000 | ---D | C] -- C:\Users\peter\Documents\JoWooD [2013.06.26 22:42:57 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\SEGA [2011.09.27 19:18:56 | 000,079,392 | ---- | C] (Martin Pesch) -- C:\Program Files\mp3DirectCut.exe [2011.07.14 00:55:45 | 001,220,608 | ---- | C] (Perfect world) -- C:\Program Files (x86)\install.exe [2011.07.14 00:55:45 | 000,372,736 | ---- | C] (Intel Corporation) -- C:\Program Files (x86)\ijl15.dll [2011.07.14 00:55:45 | 000,258,352 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\unicows.dll [2011.06.01 16:52:24 | 000,925,080 | ---- | C] (Hyperionics) -- C:\Program Files (x86)\HyCam2.exe [2011.06.01 16:52:24 | 000,137,216 | ---- | C] (Hyperionics) -- C:\Program Files (x86)\CamRes2.dll [2011.06.01 16:52:24 | 000,078,248 | ---- | C] (Hyperionics) -- C:\Program Files (x86)\UnHyCam2.exe [2011.06.01 16:52:24 | 000,044,032 | ---- | C] (Hyperionics) -- C:\Program Files (x86)\MClick2.dll [2011.06.01 16:39:27 | 711,189,938 | ---- | C] (InstallShield Software Corporation) -- C:\Program Files (x86)\S4League.exe [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.07.23 14:19:07 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.07.23 07:16:31 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.07.23 07:16:31 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.07.23 07:13:31 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.07.23 07:13:31 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.07.23 07:13:31 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.07.23 07:13:31 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.07.23 07:13:31 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.07.23 07:09:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.07.23 07:09:00 | 523,124,735 | -HS- | M] () -- C:\hiberfil.sys [2013.07.23 00:12:34 | 000,001,606 | ---- | M] () -- C:\Users\Public\Desktop\Spirit Tales.lnk [2013.07.15 04:44:04 | 000,001,692 | ---- | M] () -- C:\Users\Public\Desktop\Grand Chase.lnk [2013.07.15 04:35:41 | 2099,622,144 | ---- | M] () -- C:\GrandChase_Install_070213-1.bin [2013.07.15 04:35:37 | 1030,227,746 | ---- | M] () -- C:\GrandChase_Install_070213-2.bin [2013.07.15 04:07:17 | 000,383,864 | ---- | M] (SG Interactive ) -- C:\GrandChase_Install_070213.exe [2013.07.12 05:48:38 | 000,437,512 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.07.09 14:34:39 | 671,261,856 | ---- | M] (InstallShield Software Corporation) -- C:\S4_League.exe [2013.07.03 05:52:57 | 000,867,240 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll [2013.07.03 05:52:57 | 000,789,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll [2013.07.03 05:52:57 | 000,263,592 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2013.07.03 05:52:57 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2013.07.03 05:52:57 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2013.07.03 05:52:57 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll [2013.06.26 22:08:55 | 929,925,841 | ---- | M] (www.gamerkraft.com ) -- C:\FreeJack_v40142.exe [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.07.23 14:19:07 | 000,001,073 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.07.23 00:12:33 | 000,001,606 | ---- | C] () -- C:\Users\Public\Desktop\Spirit Tales.lnk [2013.07.15 04:44:04 | 000,001,692 | ---- | C] () -- C:\Users\Public\Desktop\Grand Chase.lnk [2013.07.15 03:13:37 | 2099,622,144 | ---- | C] () -- C:\GrandChase_Install_070213-1.bin [2013.07.15 03:13:37 | 1030,227,746 | ---- | C] () -- C:\GrandChase_Install_070213-2.bin [2013.07.03 05:59:55 | 000,000,032 | R--- | C] () -- C:\Windows\hash.dat [2013.05.16 21:37:42 | 000,012,288 | -H-- | C] () -- C:\Users\peter\photothumb.db [2013.04.27 13:53:18 | 003,217,371 | ---- | C] () -- C:\Users\peter\20130426_164633.jpg [2013.04.27 13:53:18 | 001,997,978 | ---- | C] () -- C:\Users\peter\20130426_190151.jpg [2013.02.08 16:37:59 | 000,000,012 | ---- | C] () -- C:\Windows\SysWow64\ssnac.dat [2012.11.19 09:33:32 | 000,065,656 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll [2012.11.19 09:33:30 | 000,022,640 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll [2012.11.18 22:58:43 | 000,230,752 | ---- | C] () -- C:\Windows\patchw32.dll [2012.11.18 22:58:43 | 000,118,176 | ---- | C] () -- C:\Windows\patchw.dll [2012.10.20 15:02:49 | 000,000,020 | ---- | C] () -- C:\Windows\GKLauncherInfo.ini [2011.10.08 14:44:31 | 000,000,000 | ---- | C] () -- C:\Users\peter\AppData\Local\{DD5251E8-FB5D-42C1-81FB-50ADE6FBDD6F} [2011.09.27 19:18:56 | 000,026,314 | ---- | C] () -- C:\Program Files\Manual.htm [2011.09.27 19:18:56 | 000,014,512 | ---- | C] () -- C:\Program Files\FAQ.htm [2011.07.29 13:21:24 | 000,000,242 | ---- | C] () -- C:\Windows\wininit.ini [2011.07.14 00:55:45 | 2097,176,247 | ---- | C] () -- C:\Program Files (x86)\data1.pck [2011.07.14 00:55:45 | 2038,771,408 | ---- | C] () -- C:\Program Files (x86)\data2.pck [2011.07.14 00:55:45 | 001,723,866 | ---- | C] () -- C:\Program Files (x86)\setup2.jpg [2011.07.14 00:55:45 | 001,676,376 | ---- | C] () -- C:\Program Files (x86)\check.md [2011.07.14 00:55:45 | 001,478,399 | ---- | C] () -- C:\Program Files (x86)\setup1.jpg [2011.07.14 00:55:45 | 001,387,571 | ---- | C] () -- C:\Program Files (x86)\setup4.jpg [2011.07.14 00:55:45 | 001,279,527 | ---- | C] () -- C:\Program Files (x86)\setup3.jpg [2011.07.14 00:55:45 | 001,178,830 | ---- | C] () -- C:\Program Files (x86)\setup0.jpg [2011.07.14 00:55:45 | 000,086,350 | ---- | C] () -- C:\Program Files (x86)\Logo.jpg [2011.07.14 00:55:45 | 000,028,672 | ---- | C] () -- C:\Program Files (x86)\JPGI.dll [2011.07.14 00:55:45 | 000,005,650 | ---- | C] () -- C:\Program Files (x86)\install.ini [2011.06.10 18:21:37 | 000,010,752 | ---- | C] () -- C:\Users\peter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.06.01 16:52:24 | 000,199,268 | ---- | C] () -- C:\Program Files (x86)\HyCam2.chm [2011.06.01 16:52:24 | 000,005,784 | ---- | C] () -- C:\Program Files (x86)\HyCam2.tlb [2011.06.01 16:52:24 | 000,001,186 | ---- | C] () -- C:\Program Files (x86)\16-44100d.wav [2011.06.01 16:52:24 | 000,000,956 | ---- | C] () -- C:\Program Files (x86)\16-44100u.wav [2011.06.01 16:52:24 | 000,000,652 | ---- | C] () -- C:\Program Files (x86)\16-22050d.wav [2011.06.01 16:52:24 | 000,000,587 | ---- | C] () -- C:\Program Files (x86)\8-44100d.wav [2011.06.01 16:52:24 | 000,000,442 | ---- | C] () -- C:\Program Files (x86)\16-22050u.wav [2011.06.01 16:52:24 | 000,000,421 | ---- | C] () -- C:\Program Files (x86)\8-44100u.wav [2011.06.01 16:52:24 | 000,000,340 | ---- | C] () -- C:\Program Files (x86)\16-11025d.wav [2011.06.01 16:52:24 | 000,000,326 | ---- | C] () -- C:\Program Files (x86)\16-11025u.wav [2011.06.01 16:52:24 | 000,000,317 | ---- | C] () -- C:\Program Files (x86)\8-22050d.wav [2011.06.01 16:52:24 | 000,000,260 | ---- | C] () -- C:\Program Files (x86)\16-8000d.wav [2011.06.01 16:52:24 | 000,000,225 | ---- | C] () -- C:\Program Files (x86)\8-22050u.wav [2011.06.01 16:52:24 | 000,000,220 | ---- | C] () -- C:\Program Files (x86)\16-8000u.wav [2011.06.01 16:52:24 | 000,000,183 | ---- | C] () -- C:\Program Files (x86)\8-11025d.wav [2011.06.01 16:52:24 | 000,000,151 | ---- | C] () -- C:\Program Files (x86)\8-8000d.wav [2011.06.01 16:52:24 | 000,000,135 | ---- | C] () -- C:\Program Files (x86)\8-11025u.wav [2011.06.01 16:52:24 | 000,000,127 | ---- | C] () -- C:\Program Files (x86)\8-8000u.wav [2011.06.01 16:52:24 | 000,000,055 | ---- | C] () -- C:\Program Files (x86)\HomePage.url [2011.05.30 15:08:27 | 3580,254,830 | ---- | C] () -- C:\Program Files\argo20110511.zip [2010.10.27 13:08:21 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.07.21 23:48:59 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Aeria Games & Entertainment [2012.06.30 20:24:47 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\BANDISOFT [2012.06.21 16:18:53 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\DragonicaECB [2011.12.18 00:27:39 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\DragonicaSCB [2013.07.12 21:22:32 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\DVDVideoSoft [2013.07.12 21:22:32 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\FreeVideoConverter [2011.05.28 14:57:27 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\HEXelon [2012.09.25 17:49:43 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\KlLauncherST [2011.09.07 21:26:34 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\MAGIX [2012.06.30 20:24:47 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\mp3DirectCut [2011.05.28 14:24:00 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\OEM [2013.07.15 10:31:11 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\PhotoScape [2013.06.26 22:42:57 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\SEGA [2013.07.12 21:22:40 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Sony [2013.04.13 20:51:54 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\TechSmith [2013.05.21 18:41:41 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\TERA [2012.01.07 00:14:18 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\TS3Client [2011.05.28 15:27:29 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\TuneUp Software [2013.07.23 13:39:40 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\WebCake [2012.02.04 17:07:08 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\XnView ========== Purity Check ========== < End of report > Hier nun auch der FRST Log: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-07-2013 01 Ran by peter (administrator) on 23-07-2013 14:49:50 Running from D:\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe (Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (WebCake LLC) C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (WebCake LLC) C:\Users\peter\AppData\Roaming\WebCake\WebCakeDesktop.exe (Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe () C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (C. Ghisler & Co.) C:\Program Files (x86)\TC UP\totalcmd.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11464296 2010-09-03] (Realtek Semiconductor) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-20] (Microsoft Corporation) HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\peter\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.) HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.) HKCU\...\Run: [WebCake Desktop] - C:\Users\peter\AppData\Roaming\WebCake\WebCakeDesktop.exe [47896 2013-06-21] (WebCake LLC) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation) HKLM-x32\...\Run: [SuiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [337264 2010-05-27] (Egis Technology Inc.) HKLM-x32\...\Run: [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" [407920 2010-03-11] (Egis Technology Inc.) HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [618600 2010-12-03] () HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-08] (Avira Operations GmbH & Co. KG) HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] () HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] () HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.nexon.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: WebCake - {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} - C:\Program Files (x86)\WebCake\WebCakeIEClient.dll (WebCake LLC) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SMTTB2009 Class - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll () Toolbar: HKLM-x32 - Hyperionics DB Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll () Toolbar: HKCU - No Name - {338B4DFE-2E2C-4338-9E41-E176D497299E} - No File Handler: msdaipp - No CLSID Value - Handler-x32: msdaipp - No CLSID Value - Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default FF user.js: detected! => C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\user.js FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nexon.com/NexonPlugWebExtension - C:\ProgramData\Nexon\NexonPlug\npPlugWire_1.0.0.0.dll (Nexon) FF Plugin-x32: @nexon.com/NxGame - C:\ProgramData\Nexon\NGM\npnxgame.dll No File FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll No File FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @ogplanet.com/npOGPPlugin - C:\Windows\system32\npOGPPlugin.dll No File FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Extension: WebCake - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\plugin@getwebcake.com FF Extension: Hyperionics DB Toolbar - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC} FF Extension: DownloadHelper - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF HKLM-x32\...\Firefox\Extensions: [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}] C:\Program Files (x86)\Object\facetheme FF Extension: FaceTheme - Change your Facebook layout! - C:\Program Files (x86)\Object\facetheme FF HKCU\...\Firefox\Extensions: [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}] C:\Program Files (x86)\Object\facetheme FF Extension: FaceTheme - Change your Facebook layout! - C:\Program Files (x86)\Object\facetheme ==================== Services (Whitelisted) ================= R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-02] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-02] (Avira Operations GmbH & Co. KG) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.) S3 npggsvc; C:\Windows\SysWow64\GameMon.des [3963248 2011-01-12] (INCA Internet Co., Ltd.) S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607048 2011-05-28] (TuneUp Software) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1394504 2009-12-09] (TuneUp Software) R2 WebCake Desktop Updater; C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe [23552 2013-06-21] (WebCake LLC) ==================== Drivers (Whitelisted) ==================== S3 1394hub; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 1394hub; C:\Windows\SysWow64\svchost.exe [20992 2009-07-14] (Microsoft Corporation) R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [19600 2012-06-28] (AVAST Software) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-04-25] (Avira GmbH) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-04-27] (Avira GmbH) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-05-02] (Avira GmbH) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S3 NPPTNT2; C:\Windows\SysWow64\npptNT2.sys [4682 2005-01-02] (INCA Internet Co., Ltd.) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2009-10-14] (TuneUp Software) S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x] S3 NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [x] S3 uqk; \??\C:\koramgame\STOnline\avital\wyqku64.sys [x] S1 VD_FileDisk; No ImagePath S3 X6va003; \??\C:\Users\peter\AppData\Local\Temp\003472D.tmp [x] S3 X6va005; \??\C:\Users\peter\AppData\Local\Temp\0055E46.tmp [x] S3 X6va006; \??\C:\Users\peter\AppData\Local\Temp\006F27A.tmp [x] S3 X6va008; \??\C:\Users\peter\AppData\Local\Temp\0083CC3.tmp [x] S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [x] S3 X6va010; \??\C:\Windows\SysWOW64\Drivers\X6va010 [x] S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x] S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST 2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes 2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-07-23 14:19 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk 2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame 2013-07-22 11:53 - 2013-07-22 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B} 2013-07-21 23:53 - 2013-07-21 23:53 - 00000000 ____D C:\Users\peter\AppData\Local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64} 2013-07-20 09:09 - 2013-07-20 09:09 - 00000000 ____D C:\Users\peter\AppData\Local\{F59909EA-0794-4496-A61C-F223F3430CEF} 2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun 2013-07-16 11:54 - 2013-07-16 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1} 2013-07-15 18:03 - 2013-07-15 18:04 - 00000000 ____D C:\Users\peter\AppData\Local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C} 2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk 2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive 2013-07-15 03:13 - 2013-07-15 04:35 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin 2013-07-15 03:13 - 2013-07-15 04:35 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin 2013-07-15 03:13 - 2013-07-15 04:07 - 00383864 _____ (SG Interactive ) C:\GrandChase_Install_070213.exe 2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer 2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira 2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia 2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler 2013-07-12 21:02 - 2013-07-16 03:24 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files 2013-07-12 02:29 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-07-12 02:29 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-07-12 02:29 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-07-12 02:29 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-07-12 02:29 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-07-12 02:29 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-07-12 02:29 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-07-12 02:29 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-07-12 02:29 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-07-12 02:29 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-07-12 02:29 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-07-12 02:29 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-07-12 02:29 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-07-12 02:29 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-07-12 02:29 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-07-12 02:29 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-07-12 02:29 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-07-12 02:29 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-07-12 02:29 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-07-12 02:29 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-07-12 02:29 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-07-12 02:29 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-07-12 02:29 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-07-12 02:29 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-07-12 02:29 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-07-12 02:29 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-07-12 02:29 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-07-12 02:29 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-07-12 02:29 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-07-12 02:29 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-07-12 02:29 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-07-11 20:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2013-07-11 20:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2013-07-11 20:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-07-11 20:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-07-11 20:25 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-07-11 20:25 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2013-07-11 20:25 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2013-07-11 17:10 - 2013-07-23 13:39 - 00000000 ____D C:\Users\peter\AppData\Roaming\WebCake 2013-07-11 17:10 - 2013-07-11 17:10 - 00000000 ____D C:\Program Files (x86)\WebCake 2013-07-10 19:36 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter 2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe 2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd. ) C:\Users\peter\Downloads\FreeAudioDub.exe 2013-07-10 18:06 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft 2013-07-09 14:17 - 2013-07-09 14:34 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe 2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\lang 2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\assets 2013-07-05 22:02 - 2013-03-22 23:38 - 00000000 ____D C:\flash0 2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps 2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D 2013-07-03 15:38 - 2013-07-15 17:09 - 00000000 ____D C:\dolphin-3.0-win32 2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-07-03 05:59 - 2013-05-04 05:59 - 00000032 ____R C:\Windows\hash.dat 2013-07-03 05:53 - 2013-07-03 05:52 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-07-03 05:53 - 2013-07-03 05:52 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD 2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA ==================== One Month Modified Files and Folders ======= 2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST 2013-07-23 14:38 - 2011-05-28 15:08 - 00000000 ____D C:\Users\peter\AppData\Roaming\Skype 2013-07-23 14:35 - 2010-10-10 08:16 - 01079437 _____ C:\Windows\WindowsUpdate.log 2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes 2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-07-23 13:39 - 2013-07-11 17:10 - 00000000 ____D C:\Users\peter\AppData\Roaming\WebCake 2013-07-23 07:16 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-07-23 07:16 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-07-23 07:13 - 2010-10-10 18:07 - 00654150 _____ C:\Windows\system32\perfh007.dat 2013-07-23 07:13 - 2010-10-10 18:07 - 00130022 _____ C:\Windows\system32\perfc007.dat 2013-07-23 07:13 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI 2013-07-23 07:09 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-07-23 07:09 - 2009-07-14 06:51 - 00207563 _____ C:\Windows\setupact.log 2013-07-23 07:08 - 2010-10-10 08:11 - 02126124 _____ C:\Windows\PFRO.log 2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk 2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame 2013-07-23 00:10 - 2010-10-27 13:00 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-07-22 11:54 - 2013-07-22 11:53 - 00000000 ____D C:\Users\peter\AppData\Local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B} 2013-07-21 23:53 - 2013-07-21 23:53 - 00000000 ____D C:\Users\peter\AppData\Local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64} 2013-07-20 09:09 - 2013-07-20 09:09 - 00000000 ____D C:\Users\peter\AppData\Local\{F59909EA-0794-4496-A61C-F223F3430CEF} 2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun 2013-07-16 11:54 - 2013-07-16 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1} 2013-07-16 03:24 - 2013-07-12 21:02 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files 2013-07-15 18:04 - 2013-07-15 18:03 - 00000000 ____D C:\Users\peter\AppData\Local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C} 2013-07-15 17:09 - 2013-07-03 15:38 - 00000000 ____D C:\dolphin-3.0-win32 2013-07-15 10:31 - 2011-05-28 19:23 - 00000000 ____D C:\Users\peter\AppData\Roaming\PhotoScape 2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk 2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive 2013-07-15 04:35 - 2013-07-15 03:13 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin 2013-07-15 04:35 - 2013-07-15 03:13 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin 2013-07-15 04:07 - 2013-07-15 03:13 - 00383864 _____ (SG Interactive ) C:\GrandChase_Install_070213.exe 2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer 2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira 2013-07-14 19:52 - 2011-11-09 21:29 - 00000000 ____D C:\Users\peter\AppData\Local\Akamai 2013-07-14 19:52 - 2011-05-28 15:12 - 00000000 ____D C:\Users\peter\AppData\Roaming\Mozilla 2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia 2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler 2013-07-12 23:35 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-07-12 21:22 - 2013-07-10 19:36 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter 2013-07-12 21:22 - 2013-07-10 18:06 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft 2013-07-12 21:22 - 2011-11-14 21:54 - 00000000 ____D C:\Users\peter\AppData\Roaming\Sony 2013-07-12 21:21 - 2012-05-03 21:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-07-12 21:02 - 2011-05-28 15:43 - 00000000 ____D C:\Program Files (x86)\Pando Networks 2013-07-12 05:48 - 2009-07-14 06:45 - 00437512 _____ C:\Windows\system32\FNTCACHE.DAT 2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-07-12 05:47 - 2009-07-14 09:45 - 00000000 ____D C:\Program Files\Windows Journal 2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-07-12 02:30 - 2011-05-29 08:34 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-07-11 17:10 - 2013-07-11 17:10 - 00000000 ____D C:\Program Files (x86)\WebCake 2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe 2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd. ) C:\Users\peter\Downloads\FreeAudioDub.exe 2013-07-09 14:34 - 2013-07-09 14:17 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe 2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps 2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D 2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-07-03 05:52 - 2013-07-03 05:53 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-07-03 05:52 - 2013-07-03 05:53 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-07-03 05:52 - 2012-12-26 16:51 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll 2013-07-03 05:52 - 2012-12-26 16:51 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll 2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD 2013-06-26 22:44 - 2011-05-28 14:22 - 00000000 ____D C:\Users\peter 2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA 2013-06-26 22:08 - 2013-06-09 19:26 - 929925841 _____ (www.gamerkraft.com ) C:\FreeJack_v40142.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-07-13 20:59 ==================== End Of Log ============================ und die Addition.txtFRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-07-2013 01 Ran by peter at 2013-07-23 14:50:28 Running from D:\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Acer eRecovery Management (x32 Version: 4.05.3015) Acer Registration (x32 Version: 1.03.3003) Acer ScreenSaver (x32 Version: 1.1.0825.2010) Acer Updater (x32 Version: 1.02.3001) Acrobat.com (x32 Version: 1.6.65) Adobe AIR (x32 Version: 1.5.0.7220) Adobe Flash Player 10 ActiveX (x32 Version: 10.1.82.76) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.202) Adobe Reader XI (11.0.02) - Deutsch (x32 Version: 11.0.02) Advertising Center (x32 Version: 0.0.0.2) AIMP2 (x32) Akamai NetSession Interface (HKCU) Akamai NetSession Interface (x32) Avira Free Antivirus (x32 Version: 12.1.9.2400) Bandicam (x32 Version: 1.8.6.321) Bandisoft MPEG-1 Decoder (x32) D3DX10 (x32 Version: 15.4.2368.0902) Elsword_DE (x32) eSobi v2 (x32 Version: 2.0.4.000274) Facetheme (x32 Version: 1.0) Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.27.0) Grand Chase version 070213 (x32 Version: 070213) Hotkey Utility (x32 Version: 2.05.3013) Hyperionics DB Toolbar (x32) Identity Card (x32 Version: 1.00.3003) ImagXpress (x32 Version: 7.0.74.0) Intel(R) Management Engine Components (x32 Version: 7.0.0.1118) Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046) Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) Junk Mail filter update (x32 Version: 15.4.3502.0922) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0) Mozilla Maintenance Service (x32 Version: 22.0) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT Redists (Version: 1.0) MSVCRT Redists (x32 Version: 1.0) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) MyWinLocker (x32 Version: 3.1.212.0) MyWinLocker Suite (x32 Version: 3.1.212.0) NC Launcher (GameForge) (x32) Nero 9 Essentials (x32) Nero ControlCenter (x32 Version: 9.0.0.1) Nero DiscSpeed (x32 Version: 5.4.13.100) Nero DiscSpeed Help (x32 Version: 5.4.4.100) Nero DriveSpeed (x32 Version: 4.4.12.100) Nero DriveSpeed Help (x32 Version: 4.4.4.100) Nero Express Help (x32 Version: 9.4.37.100) Nero InfoTool (x32 Version: 6.4.12.100) Nero InfoTool Help (x32 Version: 6.4.4.100) Nero Installer (x32 Version: 4.4.9.0) Nero Online Upgrade (x32 Version: 1.3.0.0) Nero StartSmart (x32 Version: 9.4.37.100) Nero StartSmart Help (x32 Version: 9.4.27.100) Nero StartSmart OEM (x32 Version: 9.16.0.100) NeroExpress (x32 Version: 9.4.37.100) neroxml (x32 Version: 1.0.0) NVIDIA 3D Vision Treiber 311.06 (Version: 311.06) NVIDIA Display Control Panel (Version: 6.14.12.5933) NVIDIA Drivers (Version: 1.10.62.40) NVIDIA Grafiktreiber 311.06 (Version: 311.06) NVIDIA Install Application (Version: 2.1002.108.688) NVIDIA PhysX (x32 Version: 9.10.0224) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106) NVIDIA Systemsteuerung 311.06 (Version: 311.06) NVIDIA Update 1.11.3 (Version: 1.11.3) NVIDIA Update Components (Version: 1.11.3) Pando Media Booster (x32 Version: 2.6.0.9) PhotoScape (x32) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6194) rosoft .NET Framework 4 Client Profile (Version: 4.0.30319) Shredder (Version: 2.0.8.3) Shredder (x32 Version: 2.0.8.3) Skype™ 6.3 (x32 Version: 6.3.107) STOnline (x32 Version: 1.0000) Text-To-Speech-Runtime (x32 Version: 1.0.0.0) Total Commander Ultima Prime 4.6.0.0 (x32 Version: 4.6.0.0) TuneUp Utilities (x32 Version: 9.0.3000.52) TuneUp Utilities Language Pack (de-DE) (x32 Version: 9.0.3000.52) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) WebCake 3.00 (Version: 3.00) Welcome Center (x32 Version: 1.02.3005) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3555.0308) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3555.0308) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3538.0513) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Windows Movie Maker 2.6 (x32 Version: 2.6.4037.0) WinRAR 4.01 (32-Bit) (x32 Version: 4.01.0) ==================== Restore Points ========================= 19-07-2013 15:30:23 Geplanter Prüfpunkt 22-07-2013 22:10:18 Installed STOnline ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {31AA3C03-74FF-46BE-BF91-64AC35BFB331} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-18] (Adobe Systems Incorporated) Task: {7FEAD0FE-E8BC-4157-9EAC-C28F3F811018} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {827879F4-4439-4E14-9490-CFF37F8D3F3B} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-03-12] (Oracle Corporation) Task: {98F9C1C0-8825-4020-96C5-C54A4BE9D521} - System32\Tasks\Automatische Problemsuche => C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-12-09] (TuneUp Software) Task: {A164B16A-75C9-439F-A1BF-91CCFDE82ACB} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exe [2009-12-09] (TuneUp Software) ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/23/2013 08:50:48 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: _Launcher.exe, Version: 1.1.1.1, Zeitstempel: 0x51dd0542 Name des fehlerhaften Moduls: _Launcher.exe, Version: 1.1.1.1, Zeitstempel: 0x51dd0542 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00131ef9 ID des fehlerhaften Prozesses: 0x13c4 Startzeit der fehlerhaften Anwendung: 0x_Launcher.exe0 Pfad der fehlerhaften Anwendung: _Launcher.exe1 Pfad des fehlerhaften Moduls: _Launcher.exe2 Berichtskennung: _Launcher.exe3 Error: (07/22/2013 07:35:31 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error: (07/22/2013 07:35:14 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. Error: (07/22/2013 01:00:14 PM) (Source: Application Hang) (User: ) Description: Programm Skype.exe, Version 6.3.0.107 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1854 Startzeit: 01ce86c9ee587635 Endzeit: 10 Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe Berichts-ID: Error: (07/22/2013 00:48:55 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: Skype.exe, Version: 6.3.0.107, Zeitstempel: 0x51715160 Name des fehlerhaften Moduls: bdcam.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x5119d76e Ausnahmecode: 0xc0000005 Fehleroffset: 0x67d78570 ID des fehlerhaften Prozesses: 0xb6c Startzeit der fehlerhaften Anwendung: 0xSkype.exe0 Pfad der fehlerhaften Anwendung: Skype.exe1 Pfad des fehlerhaften Moduls: Skype.exe2 Berichtskennung: Skype.exe3 Error: (07/19/2013 05:24:29 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error: (07/19/2013 05:24:14 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. Error: (07/18/2013 04:12:29 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. Error: (07/17/2013 04:43:41 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: MovieMaker.exe, Version: 15.4.3555.308, Zeitstempel: 0x4f596bb7 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0xe1c2f3b7 ID des fehlerhaften Prozesses: 0xcbc Startzeit der fehlerhaften Anwendung: 0xMovieMaker.exe0 Pfad der fehlerhaften Anwendung: MovieMaker.exe1 Pfad des fehlerhaften Moduls: MovieMaker.exe2 Berichtskennung: MovieMaker.exe3 Error: (07/17/2013 02:00:18 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00173668 ID des fehlerhaften Prozesses: 0xb48 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 System errors: ============= Error: (07/23/2013 07:11:27 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (07/23/2013 07:11:27 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (07/23/2013 07:09:23 AM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: VD_FileDisk Error: (07/23/2013 07:08:58 AM) (Source: Application Popup) (User: ) Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\VD_FileDisk.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten. Error: (07/22/2013 06:31:08 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (07/22/2013 06:31:08 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (07/22/2013 06:29:05 AM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: VD_FileDisk Error: (07/22/2013 06:28:38 AM) (Source: Application Popup) (User: ) Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\VD_FileDisk.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten. Error: (07/21/2013 03:02:51 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (07/21/2013 03:02:51 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Microsoft Office Sessions: ========================= Error: (07/23/2013 08:50:48 AM) (Source: Application Error)(User: ) Description: _Launcher.exe1.1.1.151dd0542_Launcher.exe1.1.1.151dd0542c000000500131ef913c401ce8768d9bc264eC:\koramgame\STOnline\_Launcher.exeC:\koramgame\STOnline\_Launcher.exe3412f3c5-f364-11e2-bcf1-f80f4115d201 Error: (07/22/2013 07:35:31 PM) (Source: SideBySide)(User: ) Description: assemblyIdentitylanguage*c:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dllc:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dll8 Error: (07/22/2013 07:35:14 PM) (Source: SideBySide)(User: ) Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3 Error: (07/22/2013 01:00:14 PM) (Source: Application Hang)(User: ) Description: Skype.exe6.3.0.107185401ce86c9ee58763510C:\Program Files (x86)\Skype\Phone\Skype.exe Error: (07/22/2013 00:48:55 PM) (Source: Application Error)(User: ) Description: Skype.exe6.3.0.10751715160bdcam.dll_unloaded0.0.0.05119d76ec000000567d78570b6c01ce8693f9dec749C:\Program Files (x86)\Skype\Phone\Skype.exebdcam.dll4da3471b-f2bc-11e2-bb55-f80f4115d201 Error: (07/19/2013 05:24:29 PM) (Source: SideBySide)(User: ) Description: assemblyIdentitylanguage*c:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dllc:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dll8 Error: (07/19/2013 05:24:14 PM) (Source: SideBySide)(User: ) Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3 Error: (07/18/2013 04:12:29 PM) (Source: SideBySide)(User: ) Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3 Error: (07/17/2013 04:43:41 PM) (Source: Application Error)(User: ) Description: MovieMaker.exe15.4.3555.3084f596bb7unknown0.0.0.000000000c0000005e1c2f3b7cbc01ce82fc05efc506C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.exeunknown45bc6156-eeef-11e2-b121-f80f4115d201 Error: (07/17/2013 02:00:18 AM) (Source: Application Error)(User: ) Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc000000500173668b4801ce827c9f967d74C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dlldd2b093c-ee73-11e2-85bc-f80f4115d201 ==================== Memory info =========================== Percentage of memory in use: 50% Total physical RAM: 6126.52 MB Available physical RAM: 3044.33 MB Total Pagefile: 12251.23 MB Available Pagefile: 8976.59 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:457.89 GB) (Free:353.42 GB) NTFS (Disk=0 Partition=3) Drive d: (Data) (Fixed) (Total:457.89 GB) (Free:181.39 GB) NTFS (Disk=0 Partition=4) Drive e: (Vampire Knights) (CDROM) (Total:3.15 GB) (Free:0 GB) CDFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 0DDF3744) Partition 1: (Not Active) - (Size=16 GB) - (Type=27) Partition 2: (Active) - (Size=102 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=458 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=458 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Geändert von Haterix (23.07.2013 um 13:52 Uhr) |
|
23.07.2013, 14:26
| #4 | |
| /// the machine /// TB-Ausbilder | Malware loswerden, wie?Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.07.2013, 18:50
| #5 |
| | Malware loswerden, wie? Hallo schrauber, Ich habe ComboFix nun 2x laufen lassen und es scheint als wenn es nach der 49 Datei stehenbleibt. (Ich habe es 2 Stunden nachdem es aufgehört hat offensichtlich zu arbeiten, offen gelassen, doch hat sich auch dann nichts geändert.) Ich habe in einem anderen Thread gelesen das man, während es läuft, nichts anderes machen sollte. Ist das korrekt? Falls ja, werde ich es nochmals probieren. Durch MalwareBytes, welches mir ein Bekannter empfohlen hat, konnte ich, sofern das Programm nicht lügt, bereits alles vom Programm erkannten schädlichen Dateien entfernen, jedoch bekomme ich in einem meiner Foren immernoch unten ein kleines Fenster von WebCake mit einer %-Zahl angezeigt. Danke für deine bisherige Hilfe. |
|
23.07.2013, 19:14
| #6 |
| /// the machine /// TB-Ausbilder | Malware loswerden, wie? Ja, nichts machen wenn CF läuft. Wenn es wieder slange stehen bleibt abbrechen und ein frisches FRST log posten. Denk dran dein AV Programm abzustellen wenn CF läuft.
__________________ --> Malware loswerden, wie? |
|
23.07.2013, 20:27
| #7 |
| | Malware loswerden, wie? Es hing wieder bei der 49. Datei, wobei ich die Maus für 50 Minuten kein einziges Mal bewegt habe. Hier ist der Log: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013
Ran by peter (administrator) on 23-07-2013 21:25:33
Running from D:\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11464296 2010-09-03] (Realtek Semiconductor)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\peter\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation)
HKLM-x32\...\Run: [SuiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [337264 2010-05-27] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" [407920 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [618600 2010-12-03] ()
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.nexon.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: msdaipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default
FF user.js: detected! => C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nexon.com/NexonPlugWebExtension - C:\ProgramData\Nexon\NexonPlug\npPlugWire_1.0.0.0.dll (Nexon)
FF Plugin-x32: @nexon.com/NxGame - C:\ProgramData\Nexon\NGM\npnxgame.dll No File
FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @ogplanet.com/npOGPPlugin - C:\Windows\system32\npOGPPlugin.dll No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WebCake - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\plugin@getwebcake.com
FF Extension: DownloadHelper - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}] C:\Program Files (x86)\Object\facetheme
FF HKCU\...\Firefox\Extensions: [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}] C:\Program Files (x86)\Object\facetheme
==================== Services (Whitelisted) =================
R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [3963248 2011-01-12] (INCA Internet Co., Ltd.)
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607048 2011-05-28] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1394504 2009-12-09] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
S3 1394hub; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 1394hub; C:\Windows\SysWow64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [19600 2012-06-28] (AVAST Software)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-04-25] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-04-27] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-05-02] (Avira GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NPPTNT2; C:\Windows\SysWow64\npptNT2.sys [4682 2005-01-02] (INCA Internet Co., Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2009-10-14] (TuneUp Software)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [x]
S3 uqk; \??\C:\koramgame\STOnline\avital\wyqku64.sys [x]
S1 VD_FileDisk; No ImagePath
S3 X6va003; \??\C:\Users\peter\AppData\Local\Temp\003472D.tmp [x]
S3 X6va005; \??\C:\Users\peter\AppData\Local\Temp\0055E46.tmp [x]
S3 X6va006; \??\C:\Users\peter\AppData\Local\Temp\006F27A.tmp [x]
S3 X6va008; \??\C:\Users\peter\AppData\Local\Temp\0083CC3.tmp [x]
S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [x]
S3 X6va010; \??\C:\Windows\SysWOW64\Drivers\X6va010 [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-23 20:55 - 2013-07-23 21:00 - 00000000 ___SD C:\ComboFix
2013-07-23 19:43 - 2013-07-23 19:43 - 00000872 _____ C:\Users\peter\Desktop\ComboFix.lnk
2013-07-23 15:46 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-07-23 15:46 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-07-23 15:46 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-07-23 15:44 - 2013-07-23 15:45 - 00000000 ____D C:\Qoobox
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Windows\erdnt
2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST
2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes
2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-23 14:19 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk
2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame
2013-07-22 11:53 - 2013-07-22 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B}
2013-07-21 23:53 - 2013-07-21 23:53 - 00000000 ____D C:\Users\peter\AppData\Local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64}
2013-07-20 09:09 - 2013-07-20 09:09 - 00000000 ____D C:\Users\peter\AppData\Local\{F59909EA-0794-4496-A61C-F223F3430CEF}
2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun
2013-07-16 11:54 - 2013-07-16 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1}
2013-07-15 18:03 - 2013-07-15 18:04 - 00000000 ____D C:\Users\peter\AppData\Local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C}
2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk
2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive
2013-07-15 03:13 - 2013-07-15 04:35 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin
2013-07-15 03:13 - 2013-07-15 04:35 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin
2013-07-15 03:13 - 2013-07-15 04:07 - 00383864 _____ (SG Interactive ) C:\GrandChase_Install_070213.exe
2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer
2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira
2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia
2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2013-07-12 21:02 - 2013-07-16 03:24 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files
2013-07-12 02:29 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-12 02:29 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-12 02:29 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 02:29 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-12 02:29 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-12 02:29 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 20:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 20:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 20:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 20:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 20:25 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 20:25 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 20:25 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 19:36 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter
2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe
2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd. ) C:\Users\peter\Downloads\FreeAudioDub.exe
2013-07-10 18:06 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft
2013-07-09 14:17 - 2013-07-09 14:34 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe
2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\lang
2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\assets
2013-07-05 22:02 - 2013-03-22 23:38 - 00000000 ____D C:\flash0
2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps
2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D
2013-07-03 15:38 - 2013-07-15 17:09 - 00000000 ____D C:\dolphin-3.0-win32
2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 05:59 - 2013-05-04 05:59 - 00000032 ____R C:\Windows\hash.dat
2013-07-03 05:53 - 2013-07-03 05:52 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD
2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA
==================== One Month Modified Files and Folders =======
2013-07-23 21:24 - 2011-05-28 15:08 - 00000000 ____D C:\Users\peter\AppData\Roaming\Skype
2013-07-23 21:23 - 2010-10-10 08:11 - 02154094 _____ C:\Windows\PFRO.log
2013-07-23 21:23 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-23 21:23 - 2009-07-14 06:51 - 00207787 _____ C:\Windows\setupact.log
2013-07-23 21:22 - 2010-10-10 08:16 - 01135239 _____ C:\Windows\WindowsUpdate.log
2013-07-23 21:00 - 2013-07-23 20:55 - 00000000 ___SD C:\ComboFix
2013-07-23 19:43 - 2013-07-23 19:43 - 00000872 _____ C:\Users\peter\Desktop\ComboFix.lnk
2013-07-23 18:14 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-23 18:14 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-23 18:11 - 2010-10-10 18:07 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-07-23 18:11 - 2010-10-10 18:07 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-07-23 18:11 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-23 15:45 - 2013-07-23 15:44 - 00000000 ____D C:\Qoobox
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Windows\erdnt
2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST
2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes
2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk
2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame
2013-07-23 00:10 - 2010-10-27 13:00 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-22 11:54 - 2013-07-22 11:53 - 00000000 ____D C:\Users\peter\AppData\Local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B}
2013-07-21 23:53 - 2013-07-21 23:53 - 00000000 ____D C:\Users\peter\AppData\Local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64}
2013-07-20 09:09 - 2013-07-20 09:09 - 00000000 ____D C:\Users\peter\AppData\Local\{F59909EA-0794-4496-A61C-F223F3430CEF}
2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun
2013-07-16 11:54 - 2013-07-16 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1}
2013-07-16 03:24 - 2013-07-12 21:02 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files
2013-07-15 18:04 - 2013-07-15 18:03 - 00000000 ____D C:\Users\peter\AppData\Local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C}
2013-07-15 17:09 - 2013-07-03 15:38 - 00000000 ____D C:\dolphin-3.0-win32
2013-07-15 10:31 - 2011-05-28 19:23 - 00000000 ____D C:\Users\peter\AppData\Roaming\PhotoScape
2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk
2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive
2013-07-15 04:35 - 2013-07-15 03:13 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin
2013-07-15 04:35 - 2013-07-15 03:13 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin
2013-07-15 04:07 - 2013-07-15 03:13 - 00383864 _____ (SG Interactive ) C:\GrandChase_Install_070213.exe
2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer
2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira
2013-07-14 19:52 - 2011-11-09 21:29 - 00000000 ____D C:\Users\peter\AppData\Local\Akamai
2013-07-14 19:52 - 2011-05-28 15:12 - 00000000 ____D C:\Users\peter\AppData\Roaming\Mozilla
2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia
2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2013-07-12 23:35 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-12 21:22 - 2013-07-10 19:36 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter
2013-07-12 21:22 - 2013-07-10 18:06 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft
2013-07-12 21:22 - 2011-11-14 21:54 - 00000000 ____D C:\Users\peter\AppData\Roaming\Sony
2013-07-12 21:21 - 2012-05-03 21:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-12 21:02 - 2011-05-28 15:43 - 00000000 ____D C:\Program Files (x86)\Pando Networks
2013-07-12 05:48 - 2009-07-14 06:45 - 00437512 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 05:47 - 2009-07-14 09:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-12 02:30 - 2011-05-29 08:34 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe
2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd. ) C:\Users\peter\Downloads\FreeAudioDub.exe
2013-07-09 14:34 - 2013-07-09 14:17 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe
2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps
2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D
2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 05:52 - 2013-07-03 05:53 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-03 05:52 - 2012-12-26 16:51 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-03 05:52 - 2012-12-26 16:51 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD
2013-06-26 22:44 - 2011-05-28 14:22 - 00000000 ____D C:\Users\peter
2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA
2013-06-26 22:08 - 2013-06-09 19:26 - 929925841 _____ (www.gamerkraft.com ) C:\FreeJack_v40142.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-23 19:20
==================== End Of Log ============================
|
|
23.07.2013, 21:09
| #8 |
| /// the machine /// TB-Ausbilder | Malware loswerden, wie? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.07.2013, 09:38
| #9 |
| | Malware loswerden, wie? AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.306 - Datei am 24/07/2013 um 10:17:35 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : peter - PETER-PC
# Bootmodus : Normal
# Ausgeführt unter : D:\Downloads\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Users\peter\AppData\LocalLow\Toolbar4
Ordner Gelöscht : C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\extensions\plugin@getwebcake.com
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{338B4DFE-2E2C-4338-9E41-E176D497299E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{338B4DFE-2E2C-4338-9E41-E176D497299E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AF6B0594-6008-4327-93E5-608AD710A6FA}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7169BBB3-3289-4696-B35D-4A88BCF6FB12}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AF6B0594-6008-4327-93E5-608AD710A6FA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AF6B0594-6008-4327-93E5-608AD710A6FA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899}
Schlüssel Gelöscht : HKLM\SOFTWARE\Tarma Installer
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16635
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v22.0 (de)
Datei : C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\prefs.js
C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\user.js ... Gelöscht !
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [2949 octets] - [24/07/2013 10:17:35]
########## EOF - C:\AdwCleaner[S1].txt - [3009 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.2.2 (07.22.2013:2)
OS: Windows 7 Home Premium x64
Ran by peter on 24.07.2013 at 10:22:24,53
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{a0b10ebe-4e51-4cae-949b-e6b9e7d68cea}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{bb975e58-e769-4e5a-ba12-b765bc559ff3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{f511afdb-726e-4458-90e7-1ecb97406544}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\clsid\{fb684d26-01f4-4d9d-87cb-f486beba56dc}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\clsid\{fb684d26-01f4-4d9d-87cb-f486beba56dc}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasmancs
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\peter\appdata\local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64}
Successfully deleted: [Empty Folder] C:\Users\peter\appdata\local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1}
Successfully deleted: [Empty Folder] C:\Users\peter\appdata\local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B}
Successfully deleted: [Empty Folder] C:\Users\peter\appdata\local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C}
Successfully deleted: [Empty Folder] C:\Users\peter\appdata\local\{F59909EA-0794-4496-A61C-F223F3430CEF}
~~~ FireFox
Emptied folder: C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\bjyo7zt0.default\minidumps [95 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.07.2013 at 10:26:13,08
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013
Ran by peter (administrator) on 24-07-2013 10:37:24
Running from D:\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(C. Ghisler & Co.) C:\Program Files (x86)\TC UP\totalcmd.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11464296 2010-09-03] (Realtek Semiconductor)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\peter\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation)
HKLM-x32\...\Run: [SuiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [337264 2010-05-27] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" [407920 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [618600 2010-12-03] ()
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.nexon.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: msdaipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nexon.com/NexonPlugWebExtension - C:\ProgramData\Nexon\NexonPlug\npPlugWire_1.0.0.0.dll (Nexon)
FF Plugin-x32: @nexon.com/NxGame - C:\ProgramData\Nexon\NGM\npnxgame.dll No File
FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @ogplanet.com/npOGPPlugin - C:\Windows\system32\npOGPPlugin.dll No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: DownloadHelper - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
==================== Services (Whitelisted) =================
R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [3963248 2011-01-12] (INCA Internet Co., Ltd.)
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607048 2011-05-28] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1394504 2009-12-09] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
S3 1394hub; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 1394hub; C:\Windows\SysWow64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [19600 2012-06-28] (AVAST Software)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-04-25] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-04-27] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-05-02] (Avira GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NPPTNT2; C:\Windows\SysWow64\npptNT2.sys [4682 2005-01-02] (INCA Internet Co., Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2009-10-14] (TuneUp Software)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [x]
S3 uqk; \??\C:\koramgame\STOnline\avital\wyqku64.sys [x]
S1 VD_FileDisk; No ImagePath
S3 X6va003; \??\C:\Users\peter\AppData\Local\Temp\003472D.tmp [x]
S3 X6va005; \??\C:\Users\peter\AppData\Local\Temp\0055E46.tmp [x]
S3 X6va006; \??\C:\Users\peter\AppData\Local\Temp\006F27A.tmp [x]
S3 X6va008; \??\C:\Users\peter\AppData\Local\Temp\0083CC3.tmp [x]
S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [x]
S3 X6va010; \??\C:\Windows\SysWOW64\Drivers\X6va010 [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-24 10:26 - 2013-07-24 10:26 - 00002006 _____ C:\Users\peter\Desktop\JRT.txt
2013-07-24 10:22 - 2013-07-24 10:22 - 00000000 ____D C:\Windows\ERUNT
2013-07-24 10:17 - 2013-07-24 10:17 - 00003072 _____ C:\AdwCleaner[S1].txt
2013-07-23 20:55 - 2013-07-23 21:00 - 00000000 ___SD C:\ComboFix
2013-07-23 15:46 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-07-23 15:46 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-07-23 15:46 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-07-23 15:44 - 2013-07-23 15:45 - 00000000 ____D C:\Qoobox
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Windows\erdnt
2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST
2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes
2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-23 14:19 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk
2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame
2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun
2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk
2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive
2013-07-15 03:13 - 2013-07-15 04:35 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin
2013-07-15 03:13 - 2013-07-15 04:35 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin
2013-07-15 03:13 - 2013-07-15 04:07 - 00383864 _____ (SG Interactive ) C:\GrandChase_Install_070213.exe
2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer
2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira
2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia
2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2013-07-12 21:02 - 2013-07-16 03:24 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files
2013-07-12 02:29 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-12 02:29 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-12 02:29 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 02:29 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-12 02:29 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-12 02:29 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 20:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 20:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 20:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 20:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 20:25 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 20:25 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 20:25 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 19:36 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter
2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe
2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd. ) C:\Users\peter\Downloads\FreeAudioDub.exe
2013-07-10 18:06 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft
2013-07-09 14:17 - 2013-07-09 14:34 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe
2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\lang
2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\assets
2013-07-05 22:02 - 2013-03-22 23:38 - 00000000 ____D C:\flash0
2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps
2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D
2013-07-03 15:38 - 2013-07-15 17:09 - 00000000 ____D C:\dolphin-3.0-win32
2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 05:59 - 2013-05-04 05:59 - 00000032 ____R C:\Windows\hash.dat
2013-07-03 05:53 - 2013-07-03 05:52 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD
2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA
==================== One Month Modified Files and Folders =======
2013-07-24 10:37 - 2011-05-28 15:08 - 00000000 ____D C:\Users\peter\AppData\Roaming\Skype
2013-07-24 10:26 - 2013-07-24 10:26 - 00002006 _____ C:\Users\peter\Desktop\JRT.txt
2013-07-24 10:26 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-24 10:26 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-24 10:25 - 2010-10-10 18:07 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-07-24 10:25 - 2010-10-10 18:07 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-07-24 10:25 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-24 10:22 - 2013-07-24 10:22 - 00000000 ____D C:\Windows\ERUNT
2013-07-24 10:19 - 2010-10-10 08:11 - 02157678 _____ C:\Windows\PFRO.log
2013-07-24 10:19 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-24 10:19 - 2009-07-14 06:51 - 00208011 _____ C:\Windows\setupact.log
2013-07-24 10:18 - 2010-10-10 08:16 - 01214019 _____ C:\Windows\WindowsUpdate.log
2013-07-24 10:17 - 2013-07-24 10:17 - 00003072 _____ C:\AdwCleaner[S1].txt
2013-07-23 21:00 - 2013-07-23 20:55 - 00000000 ___SD C:\ComboFix
2013-07-23 15:45 - 2013-07-23 15:44 - 00000000 ____D C:\Qoobox
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Windows\erdnt
2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST
2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes
2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk
2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame
2013-07-23 00:10 - 2010-10-27 13:00 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun
2013-07-16 03:24 - 2013-07-12 21:02 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files
2013-07-15 17:09 - 2013-07-03 15:38 - 00000000 ____D C:\dolphin-3.0-win32
2013-07-15 10:31 - 2011-05-28 19:23 - 00000000 ____D C:\Users\peter\AppData\Roaming\PhotoScape
2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk
2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive
2013-07-15 04:35 - 2013-07-15 03:13 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin
2013-07-15 04:35 - 2013-07-15 03:13 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin
2013-07-15 04:07 - 2013-07-15 03:13 - 00383864 _____ (SG Interactive ) C:\GrandChase_Install_070213.exe
2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer
2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira
2013-07-14 19:52 - 2011-11-09 21:29 - 00000000 ____D C:\Users\peter\AppData\Local\Akamai
2013-07-14 19:52 - 2011-05-28 15:12 - 00000000 ____D C:\Users\peter\AppData\Roaming\Mozilla
2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia
2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2013-07-12 23:35 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-12 21:22 - 2013-07-10 19:36 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter
2013-07-12 21:22 - 2013-07-10 18:06 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft
2013-07-12 21:22 - 2011-11-14 21:54 - 00000000 ____D C:\Users\peter\AppData\Roaming\Sony
2013-07-12 21:21 - 2012-05-03 21:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-12 21:02 - 2011-05-28 15:43 - 00000000 ____D C:\Program Files (x86)\Pando Networks
2013-07-12 05:48 - 2009-07-14 06:45 - 00437512 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 05:47 - 2009-07-14 09:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-12 02:30 - 2011-05-29 08:34 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe
2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd. ) C:\Users\peter\Downloads\FreeAudioDub.exe
2013-07-09 14:34 - 2013-07-09 14:17 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe
2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps
2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D
2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 05:52 - 2013-07-03 05:53 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-03 05:52 - 2012-12-26 16:51 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-03 05:52 - 2012-12-26 16:51 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD
2013-06-26 22:44 - 2011-05-28 14:22 - 00000000 ____D C:\Users\peter
2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA
2013-06-26 22:08 - 2013-06-09 19:26 - 929925841 _____ (www.gamerkraft.com ) C:\FreeJack_v40142.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-23 19:20
==================== End Of Log ============================
--- --- --- |
|
24.07.2013, 11:43
| #10 |
| /// the machine /// TB-Ausbilder | Malware loswerden, wie?ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.07.2013, 14:14
| #11 |
| | Malware loswerden, wie? Seit ich den vorletzten Schritt fertig hatte, hab ich bisher keine Probleme mehr, Ich werde aber schauen das ich die Dinge die du nun gepostet hast, abarbeiten werde um ganz sicher zu sein. Danke. |
|
24.07.2013, 14:52
| #12 |
| /// the machine /// TB-Ausbilder | Malware loswerden, wie? alles klar
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Malware loswerden, wie? |
| ahnung, dinge, gen, große, hilfe, hoffe, loswerden, malware, minute, minuten, problem, seite, seiten, suche, troja, öffnen |
Linear-Darstellung
