Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Antimalware Doctor

Antimalware Doctor


Plagegeister aller Art und deren Bekämpfung: Antimalware Doctor

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 26.07.2010, 17:29   #1
Alyx
 
Antimalware Doctor - Standard

Antimalware Doctor


Hallo,
habe mir gerad den Antimalware Doctor und Antivir Solutin eingefangen
habe nach anleitung alles durch geführt

ich hoffe ich habe alles erwischt


und danke an des board


cronologisch
----------------------------------------
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Jaqules on 26.07.2010 at 17:37:23.


Processes terminated by Rkill or while it was running:


C:\Users\Jaqules\AppData\Roaming\1387245BC3954482814208128543B31A\setupupdate70700.exe
C:\Users\Jaqules\AppData\Local\vupwaknnf\grrementssd.exe


Rkill completed on 26.07.2010 at 17:37:26.
----------------------------------------------
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4352

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

26.07.2010 17:48:00
mbam-log-2010-07-26 (17-48-00).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 134636
Laufzeit: 3 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 5
Infizierte Registrierungswerte: 4
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 11

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\TEMP\sshnas21.dll (Trojan.FraudPack) -> No action taken.

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XA5RJ9EADJ (Trojan.FakeAlert) -> No action taken.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\halo2 (Trojan.FraudPack) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setupupdate70700.exe (Trojan.Agent.Gen) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuyevqc (Trojan.Dropper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xa5rj9eadj (Trojan.FakeAlert) -> No action taken.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\TEMP\sshnas21.dll (Trojan.FraudPack) -> No action taken.
C:\Users\Jaqules\AppData\Roaming\1387245BC3954482814208128543B31A\setupupdate70700.exe (Trojan.Agent.Gen) -> No action taken.
C:\Users\Jaqules\AppData\Local\vupwaknnf\grrementssd.exe (Trojan.Dropper) -> No action taken.
C:\TEMP\Nsh.exe (Trojan.FakeAlert) -> No action taken.
C:\TEMP\nrjfgiq.exe (Trojan.Dropper) -> No action taken.
C:\TEMP\Nsf.exe (Trojan.FraudPack) -> No action taken.
C:\TEMP\Nsg.exe (Trojan.FraudPack) -> No action taken.
C:\TEMP\ogjpeed.exe (Adware.BHO) -> No action taken.
C:\TEMP\rtervrjv.exe (Trojan.Dropper) -> No action taken.
C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job (Trojan.FakeAlert) -> No action taken.
C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> No action taken.
--------------------------------------------------------------
RSIT Logfile:
Code:
ATTFilter
Logfile of random's system information tool 1.08 (written by random/random)
Run by Jaqules at 2010-07-26 17:59:12
Microsoft Windows 7 Professional  
System drive C: has 887 MB (4%) free of 20 GB
Total RAM: 4096 MB (72% free)

HijackThis download failed

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-03-05 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Multimedia office keyboard.lnk - C:\Program Files (x86)\Multimedia office keyboard\driver\OEMDriver.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install - 
.scr - config - 

======List of files/folders created in the last 1 months======

2010-07-26 17:59:12 ----D---- C:\rsit
2010-07-26 17:59:12 ----D---- C:\Program Files (x86)\trend micro
2010-07-26 17:56:19 ----D---- C:\Program Files (x86)\CCleaner
2010-07-26 17:42:25 ----D---- C:\Users\Jaqules\AppData\Roaming\Malwarebytes
2010-07-26 17:42:18 ----A---- C:\Windows\SysWOW64\drivers\mbamswissarmy.sys
2010-07-26 17:42:16 ----D---- C:\ProgramData\Malwarebytes
2010-07-26 17:42:16 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2010-07-26 16:57:41 ----D---- C:\Users\Jaqules\AppData\Roaming\1387245BC3954482814208128543B31A
2010-07-26 00:37:11 ----D---- C:\Users\Jaqules\AppData\Roaming\MobMapUpdater
2010-07-17 19:29:10 ----D---- C:\ProgramData\Google
2010-07-17 19:29:10 ----D---- C:\Program Files (x86)\Google
2010-07-12 19:12:45 ----D---- C:\Users\Jaqules\AppData\Roaming\TS3Client
2010-07-06 21:15:57 ----A---- C:\Windows\SysWOW64\XAudio2_7.dll
2010-07-06 21:15:57 ----A---- C:\Windows\SysWOW64\XAPOFX1_5.dll
2010-07-06 21:15:56 ----A---- C:\Windows\SysWOW64\xactengine3_7.dll
2010-07-06 21:15:56 ----A---- C:\Windows\SysWOW64\d3dx11_43.dll
2010-07-06 21:15:56 ----A---- C:\Windows\SysWOW64\d3dcsx_43.dll
2010-07-06 21:15:56 ----A---- C:\Windows\SysWOW64\D3DCompiler_43.dll
2010-07-06 21:15:55 ----A---- C:\Windows\SysWOW64\D3DX9_43.dll
2010-07-06 21:15:55 ----A---- C:\Windows\SysWOW64\d3dx10_43.dll
2010-07-03 09:40:02 ----D---- C:\Program Files (x86)\Multimedia office keyboard
2010-07-02 16:38:55 ----D---- C:\Users\Jaqules\AppData\Roaming\Media Player Classic

======List of files/folders modified in the last 1 months======

2010-07-26 17:59:12 ----RD---- C:\Program Files (x86)
2010-07-26 17:58:30 ----D---- C:\TEMP
2010-07-26 17:58:27 ----D---- C:\Windows\Temp
2010-07-26 17:57:23 ----D---- C:\Windows\debug
2010-07-26 17:57:23 ----AD---- C:\Windows
2010-07-26 17:49:56 ----D---- C:\Windows\Tasks
2010-07-26 17:42:18 ----D---- C:\Windows\SysWOW64\drivers
2010-07-26 17:42:16 ----HD---- C:\ProgramData
2010-07-26 17:29:03 ----D---- C:\Windows\Prefetch
2010-07-24 05:36:16 ----D---- C:\Windows\System32
2010-07-24 05:36:16 ----D---- C:\Windows\inf
2010-07-21 20:38:12 ----D---- C:\Program Files (x86)\Common Files\Steam
2010-07-19 04:02:40 ----D---- C:\Windows\Downloaded Program Files
2010-07-17 20:05:01 ----SHD---- C:\Windows\Installer
2010-07-17 19:29:16 ----RD---- C:\Program Files
2010-07-14 15:06:48 ----D---- C:\Windows\winsxs
2010-07-06 21:15:57 ----D---- C:\Windows\SysWOW64\directx
2010-07-06 21:15:57 ----D---- C:\Windows\SysWOW64
2010-07-06 21:14:56 ----D---- C:\Windows\Logs
2010-07-05 09:09:27 ----D---- C:\Users\Jaqules\AppData\Roaming\MAXON
2010-07-04 14:45:38 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2010-06-28 05:23:33 ----D---- C:\Program Files (x86)\Common Files\Akamai

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys []
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys []
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys []
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys []
R1 vpcnfltr;Virtual PC Network Filter Driver; C:\Windows\system32\DRIVERS\vpcnfltr.sys []
R1 vpcvmm;@%SystemRoot%\system32\drivers\vpcvmm.sys,-100; C:\Windows\system32\drivers\vpcvmm.sys []
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys []
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys []
R3 ATITool;ATITool Overclocking Utility; C:\Windows\system32\DRIVERS\ATITool64.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
R3 NVENETFD;NVIDIA nForce-Netzwerkcontrollertreiber; C:\Windows\system32\DRIVERS\nvm62x64.sys []
R3 nvoclk64;NVIDIA Enthusiasts Platform KDM; C:\Windows\system32\DRIVERS\nvoclk64.sys []
R3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys []
R3 vpcbus;Virtual PC-Hostbusdienst; C:\Windows\system32\DRIVERS\vpchbus.sys []
R3 vpcusb;USB-Virtualisierungsconnectordienst; C:\Windows\system32\DRIVERS\vpcusb.sys []
S3 ABIT-IO;ABIT-IO; \??\C:\Program Files (x86)\U-ABIT\abitEQ\ABIT-IO64.sys [2006-11-08 12600]
S3 KMWDFILTER;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys []
S3 netr7364;RT73 USB-Drahtlos-LAN-Kartentreiber für Vista; C:\Windows\system32\DRIVERS\netr7364.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys []
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys []
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys []
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2010-04-20 267432]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 mitsijm2011;Autodesk Moldflow Inventor Tool Suite Integration 2011 - Job-Manager; I:\Program Files\Autodesk\Inventor 2011\Moldflow\bin\mitsijm.exe [2010-01-23 673792]
R2 nTuneService;Performance Service; C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe [2009-11-06 276584]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe []
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2010-05-18 75064]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Autodesk Network Licensing Service;Autodesk Network Licensing Service; C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskNetSrv.exe [2008-06-13 1539224]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-06-23 1436424]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2010-07-21 407336]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe []
S4 Akamai;Akamai NetSession Interface; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 msvsmon90;Visual Studio 2008 Remote Debugger; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [2008-07-29 4737024]

-----------------EOF-----------------
--- --- ---
OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 26.07.2010 18:14:50 - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = \\Sidney\part2 wd80
64bit- An unknown product  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 72,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): d:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 19,43 Gb Total Space | 0,87 Gb Free Space | 4,48% Space Free | Partition Type: NTFS
Drive D: | 55,00 Gb Total Space | 5,61 Gb Free Space | 10,20% Space Free | Partition Type: NTFS
Drive E: | 100,00 Gb Total Space | 14,26 Gb Free Space | 14,26% Space Free | Partition Type: NTFS
Drive F: | 100,00 Gb Total Space | 7,18 Gb Free Space | 7,18% Space Free | Partition Type: NTFS
Drive G: | 60,00 Gb Total Space | 6,67 Gb Free Space | 11,11% Space Free | Partition Type: NTFS
Drive H: | 19,45 Gb Total Space | 10,18 Gb Free Space | 52,32% Space Free | Partition Type: FAT32
Drive I: | 149,05 Gb Total Space | 21,74 Gb Free Space | 14,59% Space Free | Partition Type: NTFS
Drive J: | 38,34 Gb Total Space | 6,04 Gb Free Space | 15,75% Space Free | Partition Type: NTFS
Drive K: | 38,35 Gb Total Space | 6,05 Gb Free Space | 15,77% Space Free | Partition Type: NTFS
 
Computer Name: SIDNEY2
Current User Name: Jaqules
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
 
========== Processes (SafeList) ==========
 
PRC - [2010.07.26 18:13:53 | 000,574,976 | ---- | M] (OldTimer Tools) -- \\Sidney\part2 wd80\OTL.exe
PRC - [2010.05.18 06:14:06 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2010.04.20 10:07:52 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.03.02 10:28:23 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2008.04.08 23:20:24 | 000,176,128 | ---- | M] () -- C:\Program Files (x86)\Multimedia office keyboard\driver\OEMDriver.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.07.26 18:13:53 | 000,574,976 | ---- | M] (OldTimer Tools) -- \\Sidney\part2 wd80\OTL.exe
MOD - [2009.07.14 03:16:19 | 000,156,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\winsta.dll
MOD - [2009.07.14 03:16:19 | 000,047,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wkscli.dll
MOD - [2009.07.14 03:16:15 | 000,090,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\srvcli.dll
MOD - [2009.07.14 03:16:11 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\ntlanman.dll
MOD - [2009.07.14 03:16:03 | 001,661,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\networkexplorer.dll
MOD - [2009.07.14 03:15:13 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\drprov.dll
MOD - [2009.07.14 03:15:11 | 000,043,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\dfscli.dll
MOD - [2009.07.14 03:15:08 | 000,077,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\davclnt.dll
MOD - [2009.07.14 03:15:08 | 000,019,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\davhlpr.dll
MOD - [2009.07.14 03:15:07 | 000,034,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\cscapi.dll
MOD - [2009.07.14 03:14:10 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msscript.ocx
MOD - [2009.07.14 03:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - File not found [Auto | Running] -- C:\Windows\SysNative\PnkBstrA.exe -- (PnkBstrA)
SRV:64bit: - [2010.06.23 23:57:12 | 001,436,424 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)
SRV:64bit: - [2009.07.14 03:41:56 | 000,195,072 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\umrdp.dll -- (UmRdpService)
SRV:64bit: - [2009.07.14 03:41:54 | 000,017,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\StorSvc.dll -- (StorSvc)
SRV:64bit: - [2009.07.14 03:41:53 | 001,361,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\PeerDistSvc.dll -- (PeerDistSvc)
SRV:64bit: - [2009.07.14 03:40:24 | 000,689,152 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\cscsvc.dll -- (CscService)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2008.07.29 14:20:28 | 004,737,024 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe -- (msvsmon90)
SRV - [2010.07.21 11:20:18 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010.06.24 19:20:11 | 002,561,624 | ---- | M] () [Disabled | Stopped] -- c:\program files (x86)\common files\akamai\rswin_3725.dll -- (Akamai)
SRV - [2010.05.18 06:14:06 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2010.04.20 10:07:52 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.01.23 08:12:18 | 000,673,792 | ---- | M] () [Auto | Running] -- I:\Program Files\Autodesk\Inventor 2011\Moldflow\bin\mitsijm.exe -- (mitsijm2011)
SRV - [2009.11.06 14:13:20 | 000,276,584 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe -- (nTuneService)
SRV - [2008.06.13 05:05:48 | 001,539,224 | ---- | M] (Autodesk, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskNetSrv.exe -- (Autodesk Network Licensing Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2010.03.02 12:35:01 | 000,116,568 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2010.02.16 13:24:00 | 000,081,072 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2009.12.31 12:04:57 | 000,360,712 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm)
DRV:64bit: - [2009.09.23 03:46:18 | 000,066,304 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV:64bit: - [2009.09.23 03:32:39 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb)
DRV:64bit: - [2009.09.23 03:32:33 | 000,187,904 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus)
DRV:64bit: - [2009.09.15 14:59:30 | 000,042,088 | ---- | M] (NVIDIA Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvoclk64.sys -- (nvoclk64)
DRV:64bit: - [2009.07.14 03:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009.07.14 03:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,200,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmbus.sys -- (vmbus)
DRV:64bit: - [2009.07.14 03:45:55 | 000,046,672 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmstorfl.sys -- (storflt)
DRV:64bit: - [2009.07.14 03:45:55 | 000,034,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\storvsc.sys -- (storvsc)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:42:58 | 000,006,656 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vms3cap.sys -- (s3cap)
DRV:64bit: - [2009.07.14 01:42:44 | 000,021,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VMBusHID.sys -- (VMBusHID)
DRV:64bit: - [2009.07.14 01:24:27 | 000,514,048 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\csc.sys -- (CSC)
DRV:64bit: - [2009.06.10 22:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009.06.10 22:35:38 | 000,707,072 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr7364.sys -- (netr7364)
DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.04.29 17:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV:64bit: - [2007.08.08 18:54:12 | 000,035,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATITool64.sys -- (ATITool)
DRV - [2006.11.08 14:49:54 | 000,012,600 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\U-ABIT\abitEQ\ABIT-IO64.sys -- (ABIT-IO)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 74 E0 D5 58 DB 27 CB 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5643
 
 
[2010.05.04 07:09:51 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\mozilla\Extensions
[2010.05.04 07:09:51 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: samsung.com ([*.sec] * in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: samsungportal.com ([]* in Vertrauenswürdige Sites)
O16 - DPF: {03F49E0E-C43A-4037-BBD6-D681E998A08E} hxxp://www.etops.co.kr/pages/common/cab/CM_CodeAx.cab (CodeAx Class)
O16 - DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} hxxp://europe.samsungportal.com/EP/web/common/cabfiles/CM_ClientEXE.cab (ClientEXE Class)
O16 - DPF: {2CFB52FD-7CF2-479C-BF65-B27F8A834F31} hxxp://www.ssa.net/include/pki/SecuiTechIE.cab (SecureSession Class)
O16 - DPF: {714E667D-360C-4BFB-8C1A-E4812B608CC1} hxxp://europe.samsungportal.com/EP/web/common/cabfiles/ACUBETrustChecker.cab (ACUBETrustChecker Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} hxxp://europe.samsungportal.com/EP/web/common/cabfiles/ActiveXSetup.cab (Setup Class)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F2B7C894-49BD-4582-A142-0AE1C99460C2} hxxp://europe.samsungportal.com/EP/web/common/cabfiles/CM_CodeAxNew.cab (CodeAxNew Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.6.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.06.25 03:40:56 | 000,000,000 | ---D | M] - I:\Autodesk -- [ NTFS ]
O33 - MountPoints2\{fff61e71-4d56-11df-b928-00508d936800}\Shell - "" = AutoRun
O33 - MountPoints2\{fff61e71-4d56-11df-b928-00508d936800}\Shell\AutoRun\command - "" = N:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.07.26 17:59:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\trend micro
[2010.07.26 17:59:12 | 000,000,000 | ---D | C] -- C:\rsit
[2010.07.26 17:56:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CCleaner
[2010.07.26 17:42:25 | 000,000,000 | ---D | C] -- C:\Users\Jaqules\AppData\Roaming\Malwarebytes
[2010.07.26 17:42:18 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.07.26 17:42:16 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010.07.26 17:42:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.07.26 17:42:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.07.26 16:57:57 | 000,000,000 | ---D | C] -- C:\Users\Jaqules\AppData\Local\vupwaknnf
[2010.07.26 16:57:41 | 000,000,000 | ---D | C] -- C:\Users\Jaqules\AppData\Roaming\1387245BC3954482814208128543B31A
[2010.07.26 00:37:11 | 000,000,000 | ---D | C] -- C:\Users\Jaqules\AppData\Roaming\MobMapUpdater
[2010.07.17 19:48:04 | 000,000,000 | ---D | C] -- C:\Users\Jaqules\AppData\Local\Google
[2010.07.17 19:29:16 | 000,000,000 | ---D | C] -- C:\Programme\Google
[2010.07.17 19:29:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2010.07.17 19:29:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2010.07.14 15:03:37 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2010.07.12 19:12:45 | 000,000,000 | ---D | C] -- C:\Users\Jaqules\AppData\Roaming\TS3Client
[2010.07.12 19:12:33 | 000,000,000 | ---D | C] -- C:\Programme\TeamSpeak 3 Client
[2010.07.06 21:15:57 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll
[2010.07.06 21:15:57 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll
[2010.07.06 21:15:57 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll
[2010.07.06 21:15:57 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll
[2010.07.06 21:15:56 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll
[2010.07.06 21:15:56 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll
[2010.07.06 21:15:56 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll
[2010.07.06 21:15:56 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll
[2010.07.06 21:15:56 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll
[2010.07.06 21:15:56 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll
[2010.07.06 21:15:56 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll
[2010.07.06 21:15:56 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll
[2010.07.06 21:15:55 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll
[2010.07.06 21:15:55 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll
[2010.07.06 21:15:55 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll
[2010.07.06 21:15:55 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll
[2010.07.06 15:17:43 | 002,288,616 | ---- | C] (CPUID) -- C:\Users\Jaqules\Desktop\cpuz64.exe
[2010.07.03 09:40:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Multimedia office keyboard
[2010.07.02 16:38:55 | 000,000,000 | ---D | C] -- C:\Users\Jaqules\AppData\Roaming\Media Player Classic
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.07.26 18:16:22 | 004,980,736 | -HS- | M] () -- C:\Users\Jaqules\NTUSER.DAT
[2010.07.26 18:01:45 | 000,021,504 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.07.26 18:01:45 | 000,021,504 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.07.26 17:56:21 | 000,001,024 | ---- | M] () -- C:\Users\Jaqules\Desktop\CCleaner.lnk
[2010.07.26 17:54:27 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.07.26 17:54:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.07.26 17:54:17 | 3220,869,120 | -HS- | M] () -- C:\hiberfil.sys
[2010.07.26 17:53:37 | 002,024,837 | -H-- | M] () -- C:\Users\Jaqules\AppData\Local\IconCache.db
[2010.07.26 17:42:20 | 000,001,026 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.24 06:05:54 | 000,029,502 | ---- | M] () -- C:\Users\Jaqules\Documents\ttfaq.odt
[2010.07.24 05:36:16 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.07.24 05:36:16 | 000,645,502 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.07.24 05:36:16 | 000,607,530 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.07.24 05:36:16 | 000,126,822 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.07.24 05:36:16 | 000,103,908 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.07.22 15:47:43 | 002,818,262 | ---- | M] () -- C:\Users\Jaqules\Desktop\011900Installation.pdf
[2010.07.22 14:54:53 | 001,054,373 | ---- | M] () -- C:\Users\Jaqules\Desktop\011900Bedienung.pdf
[2010.07.21 09:11:41 | 000,000,600 | ---- | M] () -- C:\Users\Jaqules\PUTTY.RND
[2010.07.17 20:13:54 | 000,002,004 | -H-- | M] () -- C:\Users\Jaqules\Documents\Default.rdp
[2010.07.12 19:12:36 | 000,000,980 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2010.07.07 08:11:51 | 000,000,667 | ---- | M] () -- C:\Users\Public\Desktop\StarCraft II Beta.lnk
[2010.07.03 09:40:02 | 000,001,290 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Multimedia office keyboard.lnk
[2010.07.02 11:02:24 | 001,615,489 | ---- | M] () -- C:\Users\Jaqules\Desktop\cpu-z-154.zip
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.07.26 17:56:21 | 000,001,024 | ---- | C] () -- C:\Users\Jaqules\Desktop\CCleaner.lnk
[2010.07.26 17:42:20 | 000,001,026 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.24 03:59:45 | 000,029,502 | ---- | C] () -- C:\Users\Jaqules\Documents\ttfaq.odt
[2010.07.22 15:47:43 | 002,818,262 | ---- | C] () -- C:\Users\Jaqules\Desktop\011900Installation.pdf
[2010.07.22 14:54:53 | 001,054,373 | ---- | C] () -- C:\Users\Jaqules\Desktop\011900Bedienung.pdf
[2010.07.12 19:12:36 | 000,000,980 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2010.07.03 09:40:02 | 000,001,290 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Multimedia office keyboard.lnk
[2010.07.02 11:02:18 | 001,615,489 | ---- | C] () -- C:\Users\Jaqules\Desktop\cpu-z-154.zip
[2010.06.30 09:10:29 | 000,071,462 | ---- | C] () -- C:\Users\Jaqules\Desktop\Broker_RecZone.lua
[2010.06.28 04:50:54 | 002,467,623 | ---- | C] () -- C:\Users\Jaqules\Desktop\Motor_komplett.exe
[2010.05.28 11:06:26 | 000,094,777 | ---- | C] () -- C:\Windows\SysWow64\EDCodeCom.dll
[2010.05.28 11:06:23 | 000,118,784 | ---- | C] () -- C:\Windows\SysWow64\EDCode.dll
[2010.05.28 11:06:23 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CryptoSeed.dll
[2010.05.28 11:06:23 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\SftpApi.dll
[2010.05.28 11:06:23 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\ShttpApi.dll
[2010.05.28 10:27:31 | 000,000,414 | ---- | C] () -- C:\Windows\ESTA.ini
[2009.10.05 12:10:18 | 000,007,756 | ---- | C] () -- C:\Windows\cadx2.ini
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2002.10.16 00:54:04 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2002.10.06 20:42:57 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\OggDS.dll
[2002.10.05 01:04:25 | 000,921,600 | ---- | C] () -- C:\Windows\SysWow64\vorbisenc.dll
[2002.10.05 01:04:24 | 000,188,416 | ---- | C] () -- C:\Windows\SysWow64\vorbis.dll
[2002.10.05 01:04:17 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\ogg.dll
[2002.07.19 16:05:32 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\SecuiTechIE.dll
 
========== LOP Check ==========
 
[2010.07.26 16:57:44 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\1387245BC3954482814208128543B31A
[2010.06.25 04:33:43 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\Autodesk
[2010.05.19 15:30:44 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\Canon
[2010.07.05 09:09:27 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\MAXON
[2010.01.25 07:27:08 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\MilkShape 3D 1.x.x
[2010.07.26 00:37:11 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\MobMapUpdater
[2010.01.17 11:39:49 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\OpenOffice.org
[2010.05.04 07:09:50 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\TomTom
[2010.07.12 19:13:54 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\TS3Client
[2010.03.24 17:37:52 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\TTView
[2010.03.27 19:44:37 | 000,000,000 | ---D | M] -- C:\Users\Jaqules\AppData\Roaming\Uniblue
[2010.04.29 05:13:47 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 24 bytes -> C:\Windows:999A153D8E15F77C
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:6DFF1A8A
< End of report >
--- --- ---
Alt 27.07.2010, 13:58   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Antimalware Doctor - Standard

Antimalware Doctor


Hallo und

bitte nen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!
__________________

__________________
Antwort

Themen zu Antimalware Doctor
.dll, adware.bho, alternate, antivir, antivir guard, autorun, avg, avgnt, avgntflt.sys, avira, browser, desktop, error, explorer, helper, home, installation, langs, location, log file, mozilla, notepad.exe, oldtimer, performance, plug-in, programdata, realtek, registry, rogue.antimalwaredoctor, sched.exe, server, software, start menu, studio, svchost.exe, system, syswow64, teamspeak, temp, trojan.agent.ge, vista, visual studio, wscript.exe


« Verändertes Design, keine Netzwerkerkennung, keine Systemwiederherstellung | Unbekannter, ausländischer Eintrag im Systemstart »


Ähnliche Themen: Antimalware Doctor


  1. Antimalware Doctor
    Plagegeister aller Art und deren Bekämpfung - 21.09.2010 (22)
  2. antimalware doctor
    Plagegeister aller Art und deren Bekämpfung - 18.09.2010 (1)
  3. Antimalware Doctor
    Plagegeister aller Art und deren Bekämpfung - 14.09.2010 (19)
  4. Antimalware Doctor
    Plagegeister aller Art und deren Bekämpfung - 09.09.2010 (11)
  5. Antimalware Doctor...
    Plagegeister aller Art und deren Bekämpfung - 09.09.2010 (6)
  6. Antimalware Doctor
    Plagegeister aller Art und deren Bekämpfung - 08.09.2010 (1)
  7. Antimalware Doctor
    Plagegeister aller Art und deren Bekämpfung - 06.09.2010 (14)
  8. Antimalware Doctor
    Diskussionsforum - 30.08.2010 (8)
  9. Antimalware Doctor auf PC
    Plagegeister aller Art und deren Bekämpfung - 30.08.2010 (2)
  10. Entfernung von Antimalware Doctor
    Plagegeister aller Art und deren Bekämpfung - 25.08.2010 (3)
  11. antimalware Doctor
    Plagegeister aller Art und deren Bekämpfung - 07.07.2010 (2)
  12. Antimalware Doctor
    Plagegeister aller Art und deren Bekämpfung - 11.06.2010 (15)
  13. Antimalware Doctor entfernen
    Plagegeister aller Art und deren Bekämpfung - 07.06.2010 (21)
  14. Antimalware Doctor löschen
    Plagegeister aller Art und deren Bekämpfung - 04.06.2010 (1)
  15. Antimalware Doctor
    Plagegeister aller Art und deren Bekämpfung - 03.06.2010 (12)
  16. Antimalware Doctor
    Plagegeister aller Art und deren Bekämpfung - 23.05.2010 (1)
  17. Antimalware Doctor beseitigt?
    Plagegeister aller Art und deren Bekämpfung - 16.05.2010 (9)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Antimalware Doctor - Hallo, habe mir gerad den Antimalware Doctor und Antivir Solutin eingefangen habe nach anleitung alles durch geführt ich hoffe ich habe alles erwischt und danke an des board cronologisch ---------------------------------------- - Antimalware Doctor...
Archiv
Du betrachtest: Antimalware Doctor auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19