| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Falsches AV bzw. Defender meldete sich, aktuelle Infizierung?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
21.12.2010, 11:39
| #1 | |
 |  Falsches AV bzw. Defender meldete sich, aktuelle Infizierung? Hallo, Kürzlich habe ich die Google-Bildersuche bemüht, weil ich nach einem Artwork für einen eventuellen Posterdruck gesucht habe. Plötzlich öffnete sich ein Fenster, dass vermeintlich nach dem Windows Defender aussah. Dieses meldete mit viel Geblinke, Farben und Panikmache diverse Infektionen. Ich klickte irgendetwas, was ich leider vergessen habe in dem Stress. Dann wollte der vermeintliche Defender etwas herunterladen (eine exe-Datei). Ich wurde etwas stutzig und fiel aus dem Panikmodus heraus. Was sich da geöffnet hatte sah zwar irgendwie "legitim" aus, es war aber ein Firefox Fenster! Ich cancelte das Downloadfenster. Nach einer Sekunde ploppte es wieder auf. Ich schloss es nochmal schnell und schloss in der kurzen Zeit dann auch den vermeintlichen Defender. Ich habe im Netz recherchiert, scheinbar grassieren ja diese "rogue AVs". Leider weiß ich nicht mehr, um welche rogue AV es sich handelte, es ging alles recht schnell. Teilweise gewann ich den Eindruck, wenn man diese Fenster bekommt, müsste schon ein Trojaner auf dem PC sein, der so nur "weiteres" auf den PC holen möchte. Ich möchte gerne absichern, ob mein PC noch sauber ist. OTL hat mir nur ein einziges Logfile ausgespuckt, was mich etwas wundert. Ich bin mir aber recht sicher, es korrekt ausgeführt zu haben. Ich wäre dankbar und fände es toll, wenn mir einer was zu meinem PC-Zustand sagen und mir da weiterhelfen kann.  Hier die zwei Logfiles die ich bislang habe: Zitat:
Code:
ATTFilter OTL logfile created on: 21.12.2010 11:24:43 - Run 4 OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Public\Desktop\MFtools 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 55,00% Memory free 8,00 Gb Paging File | 6,00 Gb Available in Paging File | 75,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,75 Gb Total Space | 62,60 Gb Free Space | 13,44% Space Free | Partition Type: NTFS Drive E: | 279,45 Gb Total Space | 22,47 Gb Free Space | 8,04% Space Free | Partition Type: NTFS Computer Name: X-PC | User Name: X | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Public\Desktop\MFtools\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Programme\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET) PRC - C:\Windows\SysWOW64\Ctxfihlp.exe (Creative Technology Ltd) PRC - C:\Windows\SysWOW64\CTxfispi.exe (Creative Technology Ltd) PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd) PRC - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe () PRC - C:\Program Files (x86)\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB) PRC - C:\Program Files (x86)\ROCCAT\Kone Mouse\KoneHID.EXE (ROCCAT) PRC - C:\Program Files (x86)\ASUS\AI Suite\AiNap\AiNap.exe () PRC - C:\Program Files (x86)\ASUS\AI Suite\QFan3\QFanHelp.exe () PRC - C:\Program Files (x86)\Ideazon\ZEngine\Zboard.exe (Ideazon, Inc.) PRC - C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe () PRC - C:\Program Files (x86)\Sony Ericsson PC Suite\SupServ.exe () PRC - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe () PRC - C:\Program Files (x86)\Dragon Age\tools\toolssql\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\ROCCAT\Kone Mouse\osd.exe (ROCCAT) ========== Modules (SafeList) ========== MOD - C:\Users\Public\Desktop\MFtools\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (EhttpSrv) -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET) SRV:64bit: - (ekrn) -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET) SRV:64bit: - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com) SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs) SRV - (Creative Media Toolbox 6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe (Creative Labs) SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd) SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe () SRV - (DAUpdaterSvc) -- C:\Program Files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe (BioWare) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (OMSI download service) -- C:\Program Files (x86)\Sony Ericsson PC Suite\SupServ.exe () SRV - (AsSysCtrlService) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe () SRV - (MSSQL$BWDATOOLSET) SQL Server (BWDATOOLSET) -- C:\Program Files (x86)\Dragon Age\tools\toolssql\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (SABKUTIL) -- C:\Program Files\SUPERAntiSpyware\SABKUTIL.sys File not found DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV:64bit: - (AnyDVD) -- C:\Windows\SysNative\drivers\AnyDVD.sys (SlySoft, Inc.) DRV:64bit: - (eamonm) -- C:\Windows\SysNative\drivers\eamonm.sys (ESET) DRV:64bit: - (ehdrv) -- C:\Windows\SysNative\drivers\ehdrv.sys (ESET) DRV:64bit: - (epfwwfpr) -- C:\Windows\SysNative\drivers\epfwwfpr.sys (ESET) DRV:64bit: - (ha20x22k) -- C:\Windows\SysNative\drivers\ha20x22k.sys (Creative Technology Ltd) DRV:64bit: - (ha20x2k) -- C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd) DRV:64bit: - (emupia) -- C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd) DRV:64bit: - (ctsfm2k) -- C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd) DRV:64bit: - (ctprxy2k) -- C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd) DRV:64bit: - (ossrv) -- C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.) DRV:64bit: - (ctaud2k) Creative Audio Driver (WDM) -- C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd) DRV:64bit: - (ctac32k) -- C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd) DRV:64bit: - (CTEXFIFX.SYS) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.) DRV:64bit: - (CTEXFIFX) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.) DRV:64bit: - (CTHWIUT.SYS) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.) DRV:64bit: - (CTHWIUT) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.) DRV:64bit: - (CT20XUT.SYS) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.) DRV:64bit: - (CT20XUT) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.) DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys () DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.) DRV:64bit: - (L1E) -- C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof () DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys () DRV:64bit: - (KoneFltr) -- C:\Windows\SysNative\drivers\Kone.sys (ROCCAT Ltd) DRV:64bit: - (Alpham1) -- C:\Windows\SysNative\drivers\Alpham164.sys (Ideazon Corporation) DRV:64bit: - (Alpham2) -- C:\Windows\SysNative\drivers\Alpham264.sys (Ideazon Corporation) DRV - (AnyDVD) -- C:\Windows\SysWOW64\drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.studivz.de/ IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig?hl=de" FF - prefs.js..extensions.enabledItems: artur.dubovoy@gmail.com:2.0.16 FF - prefs.js..extensions.enabledItems: fsonlinescanner@f-secure.com:1.01 FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.52 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.2 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198 FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:2.4.2 FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5 FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c9626}:1.6 FF - prefs.js..extensions.enabledItems: {241aae70-0022-11de-87af-0800200c9a66}:3.6.30.01.10 FF - prefs.js..extensions.enabledItems: {5476e6b0-3de0-11dd-ae16-0800200c9a66}:1.21 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.1&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.12 19:58:34 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.12.12 19:58:34 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010.12.12 20:57:44 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010.11.18 08:51:42 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010.12.19 22:47:10 | 000,000,000 | ---D | M] [2010.04.14 18:06:27 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\mozilla\Extensions [2010.04.14 18:06:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2010.12.20 22:05:27 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\dwifh68y.default\extensions [2010.09.22 14:11:23 | 000,000,000 | ---D | M] (ANTHEM) -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\dwifh68y.default\extensions\{07b2a769-ed19-4483-87ce-c643914c9626} [2010.09.22 14:11:54 | 000,000,000 | ---D | M] (Blue Fox) -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\dwifh68y.default\extensions\{241aae70-0022-11de-87af-0800200c9a66} [2010.09.22 14:16:05 | 000,000,000 | ---D | M] (Alienware Invader v1.2) -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\dwifh68y.default\extensions\{5476e6b0-3de0-11dd-ae16-0800200c9a66} [2010.12.12 16:25:27 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\dwifh68y.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.11.16 23:46:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\dwifh68y.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2010.12.07 11:14:36 | 000,000,000 | ---D | M] (Torbutton) -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\dwifh68y.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca} [2010.12.12 16:25:26 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\dwifh68y.default\extensions\artur.dubovoy@gmail.com [2010.12.12 16:25:27 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\dwifh68y.default\extensions\firefox@ghostery.com [2010.04.14 18:06:18 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\dwifh68y.default\extensions\fsonlinescanner@f-secure.com [2010.09.22 14:16:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\dwifh68y.default\extensions\{5476e6b0-3de0-11dd-ae16-0800200c9a66}\mozapps\extensions [2010.12.15 00:26:49 | 000,000,950 | ---- | M] () -- C:\Users\X\AppData\Roaming\Mozilla\FireFox\Profiles\dwifh68y.default\searchplugins\icqplugin-1.xml [2008.07.10 13:07:28 | 000,000,944 | ---- | M] () -- C:\Users\X\AppData\Roaming\Mozilla\FireFox\Profiles\dwifh68y.default\searchplugins\icqplugin.xml [2010.07.27 10:19:26 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions [2010.07.27 10:19:26 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files (x86)\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010.09.20 11:19:59 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.09.20 11:19:59 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.09.20 11:19:59 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.09.20 11:19:59 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.09.20 11:19:59 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.12.21 11:24:16 | 000,000,822 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [Ai Nap] C:\Program Files (x86)\ASUS\AI Suite\AiNap\AiNap.exe () O4 - HKLM..\Run: [Cpu Level Up help] C:\Program Files (x86)\ASUS\AI Suite\CpuLevelUpHelp.exe () O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [Kone] C:\Program Files (x86)\ROCCAT\Kone Mouse\KoneHID.EXE (ROCCAT) O4 - HKLM..\Run: [QFan Help] C:\Program Files (x86)\ASUS\AI Suite\QFan3\QFanHelp.exe () O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [Zboard] C:\Program Files (x86)\Ideazon\ZEngine\Zboard.exe (Ideazon, Inc.) O4 - HKCU..\Run: [EPSON Stylus DX4400 Series] C:\Windows\SysWow64\spool\DRIVERS\x64\3\E_IATICAE.EXE File not found O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.0\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [Sony Ericsson PC Suite] C:\Program Files (x86)\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB) O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files (x86)\ICQ7.0\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files (x86)\ICQ7.0\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15112/CTPID.cab (Creative Software AutoUpdate Support Package) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{311628bd-7fa4-11df-8329-00248c0c7468}\Shell - "" = AutoRun O33 - MountPoints2\{311628bd-7fa4-11df-8329-00248c0c7468}\Shell\AutoRun\command - "" = F:\AutoRunCD.exe -- File not found O33 - MountPoints2\{738b9051-dba1-11df-a196-00248c0c7468}\Shell - "" = AutoRun O33 - MountPoints2\{738b9051-dba1-11df-a196-00248c0c7468}\Shell\AutoRun\command - "" = G:\Launcher.exe -- File not found O33 - MountPoints2\{8c5968c6-9ed0-11df-91e6-00248c0c7468}\Shell - "" = AutoRun O33 - MountPoints2\{8c5968c6-9ed0-11df-91e6-00248c0c7468}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk - C:\PROGRA~2\MCAFEE~1\202B13~1.181\SSSCHE~1.EXE - File not found MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: PDFPrint - hkey= - key= - C:\Program Files (x86)\pdf24\pdf24.exe (Geek Software GmbH) MsConfig:64bit - StartUpReg: Vidalia - hkey= - key= - C:\Program Files (x86)\Vidalia Bundle\Vidalia\vidalia.exe () MsConfig:64bit - State: "startup" - Reg Error: Key error. Drivers32:64bit: aux - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: aux1 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi1 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi2 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midimapper - midimap.dll (Microsoft Corporation) Drivers32:64bit: mixer - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer1 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer2 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: msacm.imaadpcm - imaadp32.acm (Microsoft Corporation) Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32:64bit: msacm.msadpcm - msadp32.acm (Microsoft Corporation) Drivers32:64bit: msacm.msg711 - msg711.acm (Microsoft Corporation) Drivers32:64bit: msacm.msgsm610 - msgsm32.acm (Microsoft Corporation) Drivers32:64bit: vidc.i420 - iyuv_32.dll (Microsoft Corporation) Drivers32:64bit: vidc.iyuv - iyuv_32.dll (Microsoft Corporation) Drivers32:64bit: vidc.mrle - msrle32.dll (Microsoft Corporation) Drivers32:64bit: vidc.msvc - msvidc32.dll (Microsoft Corporation) Drivers32:64bit: vidc.uyvy - msyuv.dll (Microsoft Corporation) Drivers32:64bit: vidc.yuy2 - msyuv.dll (Microsoft Corporation) Drivers32:64bit: vidc.yvu9 - tsbyuv.dll (Microsoft Corporation) Drivers32:64bit: vidc.yvyu - msyuv.dll (Microsoft Corporation) Drivers32:64bit: wave - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave1 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave2 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wavemapper - msacm32.drv (Microsoft Corporation) Drivers32: aux - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: aux1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi2 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midimapper - C:\Windows\SysWow64\midimap.dll (Microsoft Corporation) Drivers32: mixer - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: mixer1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: mixer2 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: msacm.imaadpcm - C:\Windows\SysWow64\imaadp32.acm (Microsoft Corporation) Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.msadpcm - C:\Windows\SysWow64\msadp32.acm (Microsoft Corporation) Drivers32: msacm.msg711 - C:\Windows\SysWow64\msg711.acm (Microsoft Corporation) Drivers32: msacm.msgsm610 - C:\Windows\SysWow64\msgsm32.acm (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.) Drivers32: vidc.i420 - C:\Windows\SysWow64\iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.iyuv - C:\Windows\SysWow64\iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.mrle - C:\Windows\SysWow64\msrle32.dll (Microsoft Corporation) Drivers32: vidc.msvc - C:\Windows\SysWow64\msvidc32.dll (Microsoft Corporation) Drivers32: vidc.uyvy - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation) Drivers32: vidc.yuy2 - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation) Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.) Drivers32: vidc.yvu9 - C:\Windows\SysWow64\tsbyuv.dll (Microsoft Corporation) Drivers32: vidc.yvyu - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation) Drivers32: wave - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wave1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wave2 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wavemapper - C:\Windows\SysWow64\msacm32.drv (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2010.12.21 10:35:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT [2010.12.21 10:33:23 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT [2010.12.21 10:22:09 | 000,000,000 | ---D | C] -- C:\Users\Public\Desktop\MFtools [2010.12.19 23:44:59 | 000,000,000 | ---D | C] -- C:\Users\X\AppData\Local\ESET [2010.12.19 22:47:08 | 000,000,000 | ---D | C] -- C:\Programme\ESET [2010.12.19 22:47:08 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET [2010.12.19 22:44:30 | 000,000,000 | ---D | C] -- C:\computec [2010.12.16 00:15:29 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2010.12.16 00:15:12 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft SQL Server [2010.12.16 00:15:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server [2010.12.14 01:28:40 | 000,000,000 | ---D | C] -- C:\Users\X\AppData\Local\Sony Ericsson [2010.12.14 01:28:40 | 000,000,000 | ---D | C] -- C:\ProgramData\BVRP Software [2010.12.14 01:27:30 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpe1F79.dll [2010.12.14 01:27:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony Ericsson PC Suite [2010.12.14 01:27:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony Ericsson [2010.12.07 14:19:11 | 000,000,000 | ---D | C] -- C:\Windows\pss [2010.12.07 11:14:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Vidalia Bundle [2010.12.07 11:14:22 | 000,000,000 | ---D | C] -- C:\Users\X\AppData\Roaming\Vidalia [2010.12.07 11:12:49 | 000,000,000 | ---D | C] -- C:\Users\X\AppData\Roaming\Tor [2010.12.07 00:07:54 | 000,000,000 | ---D | C] -- C:\Users\X\Desktop\2154060-Dateien [2010.12.03 01:17:57 | 000,000,000 | ---D | C] -- C:\Users\X\Documents\FMOD SoundBank Generator [2010.12.03 01:17:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FMOD SoundSystem [2010.11.30 22:51:01 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt [2010.11.29 20:45:16 | 000,000,000 | ---D | C] -- C:\ProgramData\SlySoft [2010.11.29 20:41:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SlySoft [2010.11.28 23:23:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hex-Editor MX [2010.11.23 10:45:55 | 000,040,616 | ---- | C] (Elaborate Bytes AG) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys [2010.11.22 23:42:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx [2010.11.22 23:31:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Call of Duty - Black Ops [2010.11.22 17:16:57 | 000,089,256 | ---- | C] (Elaborate Bytes AG) -- C:\Windows\SysWow64\ElbyCDIO.dll [2010.11.22 13:45:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google [2010.11.22 13:45:22 | 000,000,000 | ---D | C] -- C:\Users\X\AppData\Local\Google [2010.07.27 10:27:38 | 000,061,440 | ---- | C] ( ) -- C:\Windows\SysWow64\csnpstd.dll [2010.07.27 10:27:37 | 000,098,304 | ---- | C] ( ) -- C:\Windows\SysWow64\rsnpstd.dll [2010.07.27 10:27:37 | 000,036,864 | ---- | C] ( ) -- C:\Windows\SysWow64\vsnpstd.dll [2010.07.07 19:36:44 | 000,014,336 | ---- | C] ( ) -- C:\Windows\SysWow64\a3d.dll ========== Files - Modified Within 30 Days ========== [2010.12.21 11:24:16 | 000,000,822 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2010.12.21 10:50:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.12.21 10:38:22 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.12.21 10:38:22 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.12.21 10:35:43 | 000,000,924 | ---- | M] () -- C:\Users\X\Desktop\NTREGOPT.lnk [2010.12.21 10:35:43 | 000,000,905 | ---- | M] () -- C:\Users\X\Desktop\ERUNT.lnk [2010.12.21 10:31:14 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.12.21 10:31:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.12.21 10:30:59 | 3220,475,904 | -HS- | M] () -- C:\hiberfil.sys [2010.12.21 10:30:25 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2010.12.21 10:30:25 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2010.12.21 10:30:25 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2010.12.21 10:21:36 | 000,471,560 | ---- | M] () -- C:\Users\X\Desktop\Load.exe [2010.12.20 23:31:04 | 000,802,206 | ---- | M] () -- C:\Users\X\Desktop\1292880961551.jpg [2010.12.20 09:58:41 | 000,030,458 | ---- | M] () -- C:\Users\X\Desktop\210178994.jpg [2010.12.19 23:37:10 | 000,235,772 | ---- | M] () -- C:\Users\X\Desktop\5023221390_310d1ac3a9_z.jpg [2010.12.19 23:37:10 | 000,227,187 | ---- | M] () -- C:\Users\X\Desktop\5022615281_4849c1fbb1_z.jpg [2010.12.19 23:19:38 | 000,380,058 | ---- | M] () -- C:\Users\X\Desktop\ultramarine_concept_by_digitalrich.jpg [2010.12.19 22:36:53 | 000,325,472 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2010.12.19 22:22:37 | 001,194,038 | ---- | M] () -- C:\Users\X\Desktop\40K Galaxy Map.jpg [2010.12.19 22:22:37 | 000,555,646 | ---- | M] () -- C:\Users\X\Desktop\20090219.jpg [2010.12.19 20:47:06 | 000,080,078 | ---- | M] () -- C:\Users\X\Desktop\1292787784937.jpg [2010.12.19 20:46:57 | 000,070,115 | ---- | M] () -- C:\Users\X\Desktop\1292787222186.jpg [2010.12.19 20:12:08 | 001,630,046 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.12.19 20:12:08 | 000,700,636 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.12.19 20:12:08 | 000,662,518 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.12.19 20:12:08 | 000,147,502 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.12.19 20:12:08 | 000,123,892 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.12.16 00:37:05 | 000,071,688 | ---- | M] () -- C:\Users\X\Desktop\1292452951754.jpg [2010.12.16 00:17:20 | 001,526,060 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.12.15 23:12:38 | 000,387,885 | ---- | M] () -- C:\Users\X\Desktop\1292438831602.jpg [2010.12.15 22:34:39 | 000,379,683 | ---- | M] () -- C:\Users\X\Desktop\1292445196900.jpg [2010.12.15 22:34:30 | 000,060,046 | ---- | M] () -- C:\Users\X\Desktop\1292442648575.jpg [2010.12.15 22:34:23 | 000,205,469 | ---- | M] () -- C:\Users\X\Desktop\1292444612361.jpg [2010.12.15 22:17:57 | 000,043,767 | ---- | M] () -- C:\Users\X\Desktop\1292445349077.jpg [2010.12.15 22:17:00 | 000,039,254 | ---- | M] () -- C:\Users\X\Desktop\1292447338947.jpg [2010.12.15 11:19:56 | 000,064,874 | ---- | M] () -- C:\Users\X\Desktop\1292396062229.jpg [2010.12.15 11:15:44 | 000,026,723 | ---- | M] () -- C:\Users\X\Desktop\1292391763968.jpg [2010.12.15 11:10:14 | 000,039,821 | ---- | M] () -- C:\Users\X\Desktop\1292407097682.jpg [2010.12.15 00:33:43 | 000,057,009 | ---- | M] () -- C:\Users\X\Desktop\pub160.pdf [2010.12.15 00:30:30 | 000,051,316 | ---- | M] () -- C:\Users\X\Desktop\pub145.pdf [2010.12.14 23:14:26 | 006,076,364 | ---- | M] () -- C:\Users\X\Desktop\pub143.pdf [2010.12.14 23:13:13 | 000,020,964 | ---- | M] () -- C:\Users\X\Desktop\pub088.pdf [2010.12.14 23:12:41 | 000,128,399 | ---- | M] () -- C:\Users\X\Desktop\pub048.pdf [2010.12.14 23:12:27 | 000,021,758 | ---- | M] () -- C:\Users\X\Desktop\pub007.pdf [2010.12.14 23:12:23 | 004,290,170 | ---- | M] () -- C:\Users\X\Desktop\pub049.pdf [2010.12.14 23:12:14 | 000,051,204 | ---- | M] () -- C:\Users\X\Desktop\pub008.pdf [2010.12.14 23:12:10 | 001,343,010 | ---- | M] () -- C:\Users\X\Desktop\pub109.pdf [2010.12.14 23:11:59 | 000,064,068 | ---- | M] () -- C:\Users\X\Desktop\pub035.pdf [2010.12.14 23:11:42 | 000,070,713 | ---- | M] () -- C:\Users\X\Desktop\pub026.pdf [2010.12.14 23:11:31 | 000,264,134 | ---- | M] () -- C:\Users\X\Desktop\pub056.pdf [2010.12.14 23:11:26 | 000,062,579 | ---- | M] () -- C:\Users\X\Desktop\pub031.pdf [2010.12.14 22:53:57 | 000,061,282 | ---- | M] () -- C:\Users\X\Desktop\1292356466394.jpg [2010.12.14 22:52:14 | 000,122,074 | ---- | M] () -- C:\Users\X\Desktop\1292361241046.jpg [2010.12.14 02:10:03 | 000,125,193 | ---- | M] () -- C:\Users\X\Desktop\1292279247430.jpg [2010.12.14 02:09:56 | 000,043,979 | ---- | M] () -- C:\Users\X\Desktop\1292279193868.jpg [2010.12.14 02:09:44 | 001,136,520 | ---- | M] () -- C:\Users\X\Desktop\1292279112370.jpg [2010.12.14 02:09:32 | 000,693,320 | ---- | M] () -- C:\Users\X\Desktop\1292261120801.jpg [2010.12.14 02:09:17 | 000,120,016 | ---- | M] () -- C:\Users\X\Desktop\1292260582908.jpg [2010.12.14 02:09:09 | 000,078,828 | ---- | M] () -- C:\Users\X\Desktop\1292259365166.jpg [2010.12.14 02:08:50 | 000,743,542 | ---- | M] () -- C:\Users\X\Desktop\1292255774259.jpg [2010.12.14 02:07:13 | 000,145,234 | ---- | M] () -- C:\Users\X\Desktop\1292254257068.jpg [2010.12.14 02:06:59 | 000,791,791 | ---- | M] () -- C:\Users\X\Desktop\1292253032204.jpg [2010.12.14 01:56:45 | 004,466,434 | ---- | M] () -- C:\Users\X\Desktop\a5i8-17.jpg [2010.12.14 01:46:36 | 000,063,881 | ---- | M] () -- C:\Users\X\Desktop\1292284490952.jpg [2010.12.14 01:45:16 | 000,121,522 | ---- | M] () -- C:\Users\X\Desktop\1292282028087.jpg [2010.12.14 01:34:40 | 000,055,704 | ---- | M] () -- C:\Users\X\Desktop\1292286651924.jpg [2010.12.14 01:27:30 | 000,148,736 | ---- | M] (Avanquest Software) -- C:\ProgramData\hpe1F79.dll [2010.12.13 23:35:06 | 000,090,275 | ---- | M] () -- C:\Users\X\Desktop\1292275804326.jpg [2010.12.13 23:30:49 | 000,083,381 | ---- | M] () -- C:\Users\X\Desktop\1292278097788.jpg [2010.12.13 18:54:10 | 000,493,029 | ---- | M] () -- C:\Users\X\Desktop\1292239387745.jpg [2010.12.13 10:42:57 | 000,044,720 | ---- | M] () -- C:\Users\X\Desktop\1292224259632.jpg [2010.12.13 10:36:20 | 000,055,408 | ---- | M] () -- C:\Users\X\Desktop\1292226496259.jpg [2010.12.13 00:24:25 | 000,181,161 | ---- | M] () -- C:\Users\X\Desktop\1292191920817.jpg [2010.12.13 00:23:24 | 000,094,977 | ---- | M] () -- C:\Users\X\Desktop\1292193181488.jpg [2010.12.12 23:11:10 | 000,125,989 | ---- | M] () -- C:\Users\X\Desktop\1292117063427.jpg [2010.12.12 22:58:25 | 000,127,190 | ---- | M] () -- C:\Users\X\Desktop\1292185405369.jpg [2010.12.12 22:57:10 | 000,416,021 | ---- | M] () -- C:\Users\X\Desktop\1292184359213.jpg [2010.12.12 22:57:06 | 000,118,431 | ---- | M] () -- C:\Users\X\Desktop\1292183364900.jpg [2010.12.12 18:15:03 | 000,038,980 | ---- | M] () -- C:\Users\X\Desktop\1292169849588.jpg [2010.12.12 18:14:23 | 000,242,988 | ---- | M] () -- C:\Users\X\Desktop\1292170635139.jpg [2010.12.12 18:13:58 | 000,118,955 | ---- | M] () -- C:\Users\X\Desktop\1292171368795.jpg [2010.12.12 18:13:53 | 000,029,555 | ---- | M] () -- C:\Users\X\Desktop\1292171169180.jpg [2010.12.12 18:13:33 | 000,054,984 | ---- | M] () -- C:\Users\X\Desktop\1292171032063.jpg [2010.12.12 18:13:21 | 000,172,797 | ---- | M] () -- C:\Users\X\Desktop\1292170794542.jpg [2010.12.12 18:13:08 | 000,106,362 | ---- | M] () -- C:\Users\X\Desktop\1292170737801.jpg [2010.12.12 18:12:01 | 000,036,272 | ---- | M] () -- C:\Users\X\Desktop\1292170683364.jpg [2010.12.12 18:11:48 | 000,138,523 | ---- | M] () -- C:\Users\X\Desktop\1292172650636.jpg [2010.12.12 18:07:03 | 000,062,466 | ---- | M] () -- C:\Users\X\Desktop\1292170393035.jpg [2010.12.10 12:13:07 | 000,067,927 | ---- | M] () -- C:\Users\X\Desktop\1291977987705.jpg [2010.12.10 09:14:56 | 001,940,947 | ---- | M] () -- C:\Users\X\Desktop\1291968192047.gif [2010.12.10 01:25:47 | 000,143,479 | ---- | M] () -- C:\Users\X\Desktop\1291863246571.jpg [2010.12.10 01:25:40 | 000,397,587 | ---- | M] () -- C:\Users\X\Desktop\1291863755573.gif [2010.12.07 00:24:58 | 000,375,208 | ---- | M] () -- C:\Users\X\Desktop\2154060.htm [2010.11.30 23:39:58 | 000,002,181 | ---- | M] () -- C:\Users\Public\Desktop\Mirror's Edge™.lnk [2010.11.30 09:27:41 | 000,000,040 | -HS- | M] () -- C:\ProgramData\.zreglib [2010.11.29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2010.11.29 17:42:06 | 000,024,152 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2010.11.23 10:45:55 | 000,040,616 | ---- | M] (Elaborate Bytes AG) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys [2010.11.22 23:38:38 | 000,002,029 | ---- | M] () -- C:\Users\Public\Desktop\Call of Duty - Black Ops.lnk [2010.11.22 17:16:57 | 000,089,256 | ---- | M] (Elaborate Bytes AG) -- C:\Windows\SysWow64\ElbyCDIO.dll ========== Files Created - No Company Name ========== [2010.12.21 10:35:43 | 000,000,924 | ---- | C] () -- C:\Users\X\Desktop\NTREGOPT.lnk [2010.12.21 10:35:43 | 000,000,905 | ---- | C] () -- C:\Users\X\Desktop\ERUNT.lnk [2010.12.21 10:21:34 | 000,471,560 | ---- | C] () -- C:\Users\X\Desktop\Load.exe [2010.12.20 23:31:02 | 000,802,206 | ---- | C] () -- C:\Users\X\Desktop\1292880961551.jpg [2010.12.20 09:58:39 | 000,030,458 | ---- | C] () -- C:\Users\X\Desktop\210178994.jpg [2010.12.19 23:37:06 | 000,235,772 | ---- | C] () -- C:\Users\X\Desktop\5023221390_310d1ac3a9_z.jpg [2010.12.19 23:37:01 | 000,227,187 | ---- | C] () -- C:\Users\X\Desktop\5022615281_4849c1fbb1_z.jpg [2010.12.19 23:19:29 | 000,380,058 | ---- | C] () -- C:\Users\X\Desktop\ultramarine_concept_by_digitalrich.jpg [2010.12.19 22:20:59 | 000,555,646 | ---- | C] () -- C:\Users\X\Desktop\20090219.jpg [2010.12.19 22:20:28 | 001,194,038 | ---- | C] () -- C:\Users\X\Desktop\40K Galaxy Map.jpg [2010.12.19 20:47:06 | 000,080,078 | ---- | C] () -- C:\Users\X\Desktop\1292787784937.jpg [2010.12.19 20:46:56 | 000,070,115 | ---- | C] () -- C:\Users\X\Desktop\1292787222186.jpg [2010.12.16 00:37:03 | 000,071,688 | ---- | C] () -- C:\Users\X\Desktop\1292452951754.jpg [2010.12.16 00:17:20 | 001,526,060 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.12.15 23:12:37 | 000,387,885 | ---- | C] () -- C:\Users\X\Desktop\1292438831602.jpg [2010.12.15 22:34:38 | 000,379,683 | ---- | C] () -- C:\Users\X\Desktop\1292445196900.jpg [2010.12.15 22:34:30 | 000,060,046 | ---- | C] () -- C:\Users\X\Desktop\1292442648575.jpg [2010.12.15 22:34:22 | 000,205,469 | ---- | C] () -- C:\Users\X\Desktop\1292444612361.jpg [2010.12.15 22:17:56 | 000,043,767 | ---- | C] () -- C:\Users\X\Desktop\1292445349077.jpg [2010.12.15 22:16:58 | 000,039,254 | ---- | C] () -- C:\Users\X\Desktop\1292447338947.jpg [2010.12.15 11:19:55 | 000,064,874 | ---- | C] () -- C:\Users\X\Desktop\1292396062229.jpg [2010.12.15 11:15:43 | 000,026,723 | ---- | C] () -- C:\Users\X\Desktop\1292391763968.jpg [2010.12.15 11:10:12 | 000,039,821 | ---- | C] () -- C:\Users\X\Desktop\1292407097682.jpg [2010.12.15 00:33:43 | 000,057,009 | ---- | C] () -- C:\Users\X\Desktop\pub160.pdf [2010.12.15 00:30:30 | 000,051,316 | ---- | C] () -- C:\Users\X\Desktop\pub145.pdf [2010.12.14 23:14:26 | 006,076,364 | ---- | C] () -- C:\Users\X\Desktop\pub143.pdf [2010.12.14 23:13:13 | 000,020,964 | ---- | C] () -- C:\Users\X\Desktop\pub088.pdf [2010.12.14 23:12:41 | 000,128,399 | ---- | C] () -- C:\Users\X\Desktop\pub048.pdf [2010.12.14 23:12:27 | 000,021,758 | ---- | C] () -- C:\Users\X\Desktop\pub007.pdf [2010.12.14 23:12:14 | 000,051,204 | ---- | C] () -- C:\Users\X\Desktop\pub008.pdf [2010.12.14 23:12:10 | 001,343,010 | ---- | C] () -- C:\Users\X\Desktop\pub109.pdf [2010.12.14 23:11:59 | 000,064,068 | ---- | C] () -- C:\Users\X\Desktop\pub035.pdf [2010.12.14 23:11:42 | 000,070,713 | ---- | C] () -- C:\Users\X\Desktop\pub026.pdf [2010.12.14 23:11:31 | 000,264,134 | ---- | C] () -- C:\Users\X\Desktop\pub056.pdf [2010.12.14 23:11:26 | 000,062,579 | ---- | C] () -- C:\Users\X\Desktop\pub031.pdf [2010.12.14 23:10:29 | 004,290,170 | ---- | C] () -- C:\Users\X\Desktop\pub049.pdf [2010.12.14 22:53:56 | 000,061,282 | ---- | C] () -- C:\Users\X\Desktop\1292356466394.jpg [2010.12.14 22:52:10 | 000,122,074 | ---- | C] () -- C:\Users\X\Desktop\1292361241046.jpg [2010.12.14 02:10:02 | 000,125,193 | ---- | C] () -- C:\Users\X\Desktop\1292279247430.jpg [2010.12.14 02:09:56 | 000,043,979 | ---- | C] () -- C:\Users\X\Desktop\1292279193868.jpg [2010.12.14 02:09:43 | 001,136,520 | ---- | C] () -- C:\Users\X\Desktop\1292279112370.jpg [2010.12.14 02:09:31 | 000,693,320 | ---- | C] () -- C:\Users\X\Desktop\1292261120801.jpg [2010.12.14 02:09:17 | 000,120,016 | ---- | C] () -- C:\Users\X\Desktop\1292260582908.jpg [2010.12.14 02:09:08 | 000,078,828 | ---- | C] () -- C:\Users\X\Desktop\1292259365166.jpg [2010.12.14 02:08:49 | 000,743,542 | ---- | C] () -- C:\Users\X\Desktop\1292255774259.jpg [2010.12.14 02:07:13 | 000,145,234 | ---- | C] () -- C:\Users\X\Desktop\1292254257068.jpg [2010.12.14 02:06:58 | 000,791,791 | ---- | C] () -- C:\Users\X\Desktop\1292253032204.jpg [2010.12.14 01:56:44 | 004,466,434 | ---- | C] () -- C:\Users\X\Desktop\a5i8-17.jpg [2010.12.14 01:46:35 | 000,063,881 | ---- | C] () -- C:\Users\X\Desktop\1292284490952.jpg [2010.12.14 01:45:14 | 000,121,522 | ---- | C] () -- C:\Users\X\Desktop\1292282028087.jpg [2010.12.14 01:34:39 | 000,055,704 | ---- | C] () -- C:\Users\X\Desktop\1292286651924.jpg [2010.12.13 23:35:05 | 000,090,275 | ---- | C] () -- C:\Users\X\Desktop\1292275804326.jpg [2010.12.13 23:30:48 | 000,083,381 | ---- | C] () -- C:\Users\X\Desktop\1292278097788.jpg [2010.12.13 18:54:10 | 000,493,029 | ---- | C] () -- C:\Users\X\Desktop\1292239387745.jpg [2010.12.13 10:42:56 | 000,044,720 | ---- | C] () -- C:\Users\X\Desktop\1292224259632.jpg [2010.12.13 10:36:19 | 000,055,408 | ---- | C] () -- C:\Users\X\Desktop\1292226496259.jpg [2010.12.13 00:24:24 | 000,181,161 | ---- | C] () -- C:\Users\X\Desktop\1292191920817.jpg [2010.12.13 00:23:22 | 000,094,977 | ---- | C] () -- C:\Users\X\Desktop\1292193181488.jpg [2010.12.12 23:11:09 | 000,125,989 | ---- | C] () -- C:\Users\X\Desktop\1292117063427.jpg [2010.12.12 22:58:24 | 000,127,190 | ---- | C] () -- C:\Users\X\Desktop\1292185405369.jpg [2010.12.12 22:57:09 | 000,416,021 | ---- | C] () -- C:\Users\X\Desktop\1292184359213.jpg [2010.12.12 22:57:05 | 000,118,431 | ---- | C] () -- C:\Users\X\Desktop\1292183364900.jpg [2010.12.12 18:15:03 | 000,038,980 | ---- | C] () -- C:\Users\X\Desktop\1292169849588.jpg [2010.12.12 18:14:22 | 000,242,988 | ---- | C] () -- C:\Users\X\Desktop\1292170635139.jpg [2010.12.12 18:13:57 | 000,118,955 | ---- | C] () -- C:\Users\X\Desktop\1292171368795.jpg [2010.12.12 18:13:53 | 000,029,555 | ---- | C] () -- C:\Users\X\Desktop\1292171169180.jpg [2010.12.12 18:13:32 | 000,054,984 | ---- | C] () -- C:\Users\X\Desktop\1292171032063.jpg [2010.12.12 18:13:21 | 000,172,797 | ---- | C] () -- C:\Users\X\Desktop\1292170794542.jpg [2010.12.12 18:13:07 | 000,106,362 | ---- | C] () -- C:\Users\X\Desktop\1292170737801.jpg [2010.12.12 18:12:01 | 000,036,272 | ---- | C] () -- C:\Users\X\Desktop\1292170683364.jpg [2010.12.12 18:11:47 | 000,138,523 | ---- | C] () -- C:\Users\X\Desktop\1292172650636.jpg [2010.12.12 18:07:02 | 000,062,466 | ---- | C] () -- C:\Users\X\Desktop\1292170393035.jpg [2010.12.12 16:25:05 | 000,013,541 | ---- | C] () -- C:\Users\X\Desktop\Fallersleben.odt [2010.12.10 12:13:06 | 000,067,927 | ---- | C] () -- C:\Users\X\Desktop\1291977987705.jpg [2010.12.10 09:14:54 | 001,940,947 | ---- | C] () -- C:\Users\X\Desktop\1291968192047.gif [2010.12.10 01:25:46 | 000,143,479 | ---- | C] () -- C:\Users\X\Desktop\1291863246571.jpg [2010.12.10 01:25:38 | 000,397,587 | ---- | C] () -- C:\Users\X\Desktop\1291863755573.gif [2010.12.07 00:07:53 | 000,375,208 | ---- | C] () -- C:\Users\X\Desktop\2154060.htm [2010.11.30 23:39:58 | 000,002,181 | ---- | C] () -- C:\Users\Public\Desktop\Mirror's Edge™.lnk [2010.11.29 20:44:46 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib [2010.11.22 23:38:38 | 000,002,029 | ---- | C] () -- C:\Users\Public\Desktop\Call of Duty - Black Ops.lnk [2010.11.22 13:45:27 | 000,001,098 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.11.22 13:45:26 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.11.02 11:42:15 | 000,000,320 | ---- | C] () -- C:\Windows\game.ini [2010.08.26 12:38:29 | 000,005,632 | ---- | C] () -- C:\Users\X\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.07.27 10:32:22 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.07.27 10:27:37 | 000,390,912 | ---- | C] () -- C:\Windows\SysWow64\drivers\snpstd.sys [2010.07.27 10:27:37 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\dsnpstd.dll [2010.07.27 10:27:37 | 000,015,541 | ---- | C] () -- C:\Windows\snpstd.ini [2010.07.07 20:23:10 | 000,017,868 | ---- | C] () -- C:\Windows\SysWow64\instwdm.ini [2010.07.07 19:33:04 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CtxfiRes.dll [2010.04.14 18:46:20 | 000,166,912 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2010.04.14 18:46:20 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2010.04.14 18:46:00 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL [2010.04.14 17:36:40 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\AsIO.dll [2010.04.14 17:36:40 | 000,013,368 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys [2010.04.14 17:36:38 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys [2010.04.14 17:36:38 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys [2010.04.14 17:35:42 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2010.04.02 16:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.14 00:14:16 | 000,000,054 | ---- | C] () -- C:\Windows\SysWow64\ctzapxx.ini [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.05.26 11:12:38 | 000,000,285 | ---- | C] () -- C:\Windows\SysWow64\kill.ini [2009.04.16 12:24:14 | 000,921,600 | ---- | C] () -- C:\Windows\SysWow64\vorbisenc.dll [2009.04.16 12:24:14 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\OggDS.dll [2009.04.16 12:24:14 | 000,188,416 | ---- | C] () -- C:\Windows\SysWow64\vorbis.dll [2009.04.16 12:24:14 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\Ogg.dll [2008.10.07 08:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll [2008.10.07 08:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll [2007.04.27 09:43:58 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll ========== LOP Check ========== [2010.06.19 12:38:52 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\com.adobe.ExMan [2010.12.21 10:37:26 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\ICQ [2010.09.22 10:53:53 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\Ideazon [2010.09.20 12:08:07 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\ImgBurn [2010.06.17 12:48:29 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\MAGIX [2010.11.07 22:40:11 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\Mp3tag [2010.04.14 21:57:28 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\OpenOffice.org [2010.12.20 00:54:01 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\QuickScan [2010.04.14 17:33:25 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\ROCCAT [2010.04.25 14:21:54 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\The Path [2010.04.14 18:06:27 | 000,000,000 | ---D | M] -- C:\Users\X\AppData\Roaming\Thunderbird [2010.11.02 09:51:53 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2010.12.21 10:30:59 | 3220,475,904 | -HS- | M] () -- C:\hiberfil.sys [2006.12.01 22:37:14 | 000,904,704 | ---- | M] (Microsoft Corporation) -- C:\msdia80.dll [2010.12.21 10:31:01 | 4293,967,872 | -HS- | M] () -- C:\pagefile.sys < %systemroot%\system32\*.wt > < %systemroot%\system32\*.ruy > < %systemroot%\Fonts\*.com > [2009.07.14 06:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont [2009.07.14 06:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont [2009.07.14 06:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont [2009.07.14 06:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > [2009.06.10 21:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini < %systemroot%\Fonts\*.ini2 > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.scr > < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > [2009.07.14 05:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\user32.dll /md5 > [2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll < %systemroot%\system32\ws2_32.dll /md5 > [2009.07.14 02:16:20 | 000,206,336 | ---- | M] (Microsoft Corporation) MD5=DAAE8A9B8C0ACC7F858454132553C30D -- C:\Windows\SysWOW64\ws2_32.dll < %systemroot%\system32\ws2help.dll /md5 > [2009.07.14 02:11:26 | 000,004,608 | ---- | M] (Microsoft Corporation) MD5=808AABDF9337312195CAFF76D1804786 -- C:\Windows\SysWOW64\ws2help.dll < MD5 for: EXPLORER.EXE > [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: WININIT.EXE > [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < End of report > |
|
21.12.2010, 11:49
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Falsches AV bzw. Defender meldete sich, aktuelle Infizierung?Zitat:
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!
__________________ |
|
21.12.2010, 11:54
| #3 |
| | Falsches AV bzw. Defender meldete sich, aktuelle Infizierung? Mache ich sofort. In der Anleitung fürs Posten stand der Quickscan als empfohlene Methode. Vollscan reiche ich gleich nach wenn er fertig ist.
__________________ |
|
21.12.2010, 12:48
| #4 | |
| | Falsches AV bzw. Defender meldete sich, aktuelle Infizierung? Also der vollständige Scan war auch sauber. Gibt es weitere Tools, die ich ausführen kann/soll? Ich weiß eben nicht, ob dieses fake-Defender-Ding von meinem PC aus startete oder von einer verseuchten Internetseite. Und ob das irgendwas auf meinen PC geladen hat. Weder möchte ich Probleme bekommen wegen banking oder wegen illegaler Aktivitäten, zu denen mein PC dann fremdgenutzt werden kann, noch möchte ich am Ende als Virenschleuder meine Freunde und Bekannte verseuchen. Zitat:
|
|
21.12.2010, 12:49
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Falsches AV bzw. Defender meldete sich, aktuelle Infizierung? Tauchte dieses Fenster nur beim Besuch dieser vermientlichen Website auf oder ist das ständig bei dir da?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
21.12.2010, 13:41
| #6 |
| | Falsches AV bzw. Defender meldete sich, aktuelle Infizierung? Ich hatte die Googlebildersuche benutzt. Ich glaube ich hatte wohl versucht eines der Ergebnisse zu öffnen und dann poppte dieses "böse Fenster" auf. Es war eine einmalige Sache (zumindest bislang). |
|
21.12.2010, 22:00
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Falsches AV bzw. Defender meldete sich, aktuelle Infizierung? Dann warst du nur auf einer "Schmuddelseite" ohne weitreichende Folgen. Achte darauf dass du am besten: - eingeschränkte Rechte hast (zumindest beim Surfen) - den Browser stets aktuell aktualisierst - nach Möglichkeit die Erweiterungen NoScript und AdblockPlus verwendest, falls du Firefox oder Seamonky benutzt
__________________ Logfiles bitte immer in CODE-Tags posten |
|
22.12.2010, 17:40
| #8 |
| | Falsches AV bzw. Defender meldete sich, aktuelle Infizierung? Hey, es waren keine "Schmuddel"-Bilder  Aber dann bin ich froh, dankeschön!  Hatte gedacht ich müsste vielleicht noch dieses HijackThis oder andere Tools ausführen. |
|
| Themen zu Falsches AV bzw. Defender meldete sich, aktuelle Infizierung? |
| .dll, adobe, alienware, antivirus, autorun, bho, black, call of duty, cpu, defender, desktop, egui.exe, ekrn.exe, error, eset nod32, exe-datei, explorer, farben, firefox, firefox.exe, format, galaxy, location, logfile, mozilla, mozilla thunderbird, mp3, object, oldtimer, otl.exe, plug-in, programdata, registry, searchplugins, security, security scan, server, software, sptd.sys, start menu, superantispyware, syswow64, trojaner, webcheck, windows, winlogon.exe |
Linear-Darstellung
