Das Programm hat sich leider aufgehängt :/
War bei 10 Funde bei 200.000 Dateien.
Leider kann ich nicht sagen, was für Dateien :(
War bei 10 Funde bei 200.000 Dateien.
Leider kann ich nicht sagen, was für Dateien :(
Virus?
06/19/2011 21:49
Hiesan#16
06/19/2011 21:52
Diablo_#17
Wenn wirklich garnichts mehr geth, führe den Scan im abgesichertem Modus aus.Quote:
Das Programm hat sich leider aufgehängt :/
War bei 10 Funde bei 200.000 Dateien.
Leider kann ich nicht sagen, was für Dateien :(
Grüße
06/19/2011 22:12
Hiesan#18
Liegt vielleicht daran, weil ich nebenher Minecraft gespielt habe.
Ich gehe jetzt sowieso gleich offline (PC aus) & ab ins Bett ;)
Morgen scanne ich neu und editiere das Ergebnis rein (Wenn keiner davor gepostet hat)
Also dann bis morgen
Ich gehe jetzt sowieso gleich offline (PC aus) & ab ins Bett ;)
Morgen scanne ich neu und editiere das Ergebnis rein (Wenn keiner davor gepostet hat)
Also dann bis morgen
06/20/2011 13:40
Hiesan#19
@Mod Doppelpost, da es WICHTIG ist, bitte nicht Verwarnen/Warnen
Malwarebytes' Anti-Malware 1.51.0.1200
[Only registered and activated users can see links. Click Here To Register...]
Datenbank Version: 6897
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
20.06.2011 13:37:37
mbam-log-2011-06-20 (13-37-30).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 189629
Laufzeit: 18 Minute(n), 33 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 2
Infizierte Dateien: 8
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\Run\Policies (Backdoor.HMCPol.Gen) -> Value: Policies -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run\Audio Device (Trojan.Agent.I) -> Value: Audio Device -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Policies\Explorer\Run\Policies (Backdoor.HMCPol.Gen) -> Value: Policies -> No action taken.
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
c:\directory\cybergate (Trojan.PWS) -> No action taken.
c:\directory\cybergate\install (Trojan.PWS) -> No action taken.
Infizierte Dateien:
c:\Users\Sven\AppData\Local\Temp\21199771_antivir. exe (Spyware.PWS) -> No action taken.
c:\Users\Sven\AppData\Local\Temp\2727225_google chrome.exe (Spyware.PWS) -> No action taken.
c:\Users\Sven\AppData\Local\Temp\yontoosetup-dropdowndeals-silentinstaller.exe (Adware.Agent) -> No action taken.
c:\Users\Sven\downloads\downloader_1184391.exe (Spyware.PWS) -> No action taken.
c:\Users\Sven\AppData\Roaming\install\server.exe (Backdoor.Bot.M) -> No action taken.
c:\Users\Sven\AppData\Roaming\system32\svchost.exe (Trojan.Agent) -> No action taken.
c:\Users\Sven\AppData\Local\Temp\xxxyyyzzz.dat (Malware.Trace) -> No action taken.
c:\Users\Sven\AppData\Roaming\owcpvfslqjzw.exe (Trojan.Agent.I) -> No action taken.
Das ist das Ergebnis vom Scan!
Malwarebytes' Anti-Malware 1.51.0.1200
[Only registered and activated users can see links. Click Here To Register...]
Datenbank Version: 6897
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
20.06.2011 13:37:37
mbam-log-2011-06-20 (13-37-30).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 189629
Laufzeit: 18 Minute(n), 33 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 2
Infizierte Dateien: 8
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\Run\Policies (Backdoor.HMCPol.Gen) -> Value: Policies -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run\Audio Device (Trojan.Agent.I) -> Value: Audio Device -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Policies\Explorer\Run\Policies (Backdoor.HMCPol.Gen) -> Value: Policies -> No action taken.
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
c:\directory\cybergate (Trojan.PWS) -> No action taken.
c:\directory\cybergate\install (Trojan.PWS) -> No action taken.
Infizierte Dateien:
c:\Users\Sven\AppData\Local\Temp\21199771_antivir. exe (Spyware.PWS) -> No action taken.
c:\Users\Sven\AppData\Local\Temp\2727225_google chrome.exe (Spyware.PWS) -> No action taken.
c:\Users\Sven\AppData\Local\Temp\yontoosetup-dropdowndeals-silentinstaller.exe (Adware.Agent) -> No action taken.
c:\Users\Sven\downloads\downloader_1184391.exe (Spyware.PWS) -> No action taken.
c:\Users\Sven\AppData\Roaming\install\server.exe (Backdoor.Bot.M) -> No action taken.
c:\Users\Sven\AppData\Roaming\system32\svchost.exe (Trojan.Agent) -> No action taken.
c:\Users\Sven\AppData\Local\Temp\xxxyyyzzz.dat (Malware.Trace) -> No action taken.
c:\Users\Sven\AppData\Roaming\owcpvfslqjzw.exe (Trojan.Agent.I) -> No action taken.
Das ist das Ergebnis vom Scan!
06/20/2011 13:56
Es19#20
Sein Webhoster hat die Abuse-Meldung erhalten, die Seite, die der "Hacker" für die Verbreitung und das Datensammeln benutzt hat, wird umgehend vom Netz genommen.
Behalte das Ergebnis zunächst. Nun führst du einen Quickscan mit [Only registered and activated users can see links. Click Here To Register...] durch. Poste die OTL.txt ebenfalls im Spoiler.
Weitere Anweisungen folgen danach.
Behalte das Ergebnis zunächst. Nun führst du einen Quickscan mit [Only registered and activated users can see links. Click Here To Register...] durch. Poste die OTL.txt ebenfalls im Spoiler.
Weitere Anweisungen folgen danach.
06/20/2011 14:06
Hiesan#21
OTL logfile created on: 20.06.2011 13:59:24 - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Users\Sven\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 55,00% Memory free
7,00 Gb Paging File | 6,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,51 Gb Total Space | 668,18 Gb Free Space | 71,73% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: SVEN-PC
Current User Name: Sven
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan
========== Processes (SafeList) ==========
PRC - [2011.06.20 13:59:13 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Sven\Downloads\OTL.exe
PRC - [2011.06.14 01:52:23 | 001,011,768 | ---- | M] (Google Inc.) -- C:\Users\Sven\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
PRC - [2011.06.01 20:12:43 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.05.25 17:29:54 | 001,951,112 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2011.04.01 05:11:52 | 000,428,640 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
PRC - [2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\explorer.exe
PRC - [2011.02.25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.01.26 17:08:14 | 004,177,272 | ---- | M] (Sysinternals - [Only registered and activated users can see links. Click Here To Register...]) -- C:\Users\Sven\Desktop\procexp.exe
PRC - [2010.12.15 21:04:10 | 005,536,152 | ---- | M] (Salfeld Computer) -- C:\Windows\tray\wintmr.exe
PRC - [2010.12.15 21:04:08 | 005,527,448 | ---- | M] (Salfeld Computer) -- C:\Windows\SysWOW64\cc32\webtmr.exe
PRC - [2010.12.15 21:03:30 | 002,361,856 | ---- | M] (Salfeld Computer) -- C:\Windows\SysWOW64\ccsync.exe
PRC - [2010.12.07 12:32:02 | 002,228,008 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2010.11.22 22:52:46 | 000,718,072 | ---- | M] (Tunngle.net GmbH) -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe
PRC - [2010.04.24 02:10:34 | 000,209,768 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2010.04.24 02:10:28 | 000,483,688 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010.02.28 03:33:14 | 000,821,664 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
========== Modules (SafeList) ==========
MOD - [2011.06.20 13:59:13 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Sven\Downloads\OTL.exe
MOD - [2010.08.21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420f e3fa2b8113bd\comctl32.dll
MOD - [2009.07.14 03:14:10 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msscript.ocx
========== Win32 Services (SafeList) ==========
SRV:64bit: - File not found [Auto | Running] -- C:\Windows\SysNative\PnkBstrA.exe -- (PnkBstrA)
SRV:64bit: - [2011.02.19 15:48:32 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010.11.11 15:36:38 | 000,282,616 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2010.11.11 15:36:38 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010.09.21 15:49:00 | 002,286,976 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011.06.19 19:39:59 | 000,403,240 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.06.01 20:12:43 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.05.25 17:29:52 | 002,275,720 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2011.04.01 05:11:52 | 000,428,640 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2011.02.28 18:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.02.25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010.12.07 12:32:02 | 002,228,008 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2010.11.22 22:52:46 | 000,718,072 | ---- | M] (Tunngle.net GmbH) [Auto | Running] -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe -- (TunngleService)
SRV - [2010.09.23 01:21:24 | 001,493,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010.04.24 02:10:34 | 000,209,768 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2010.04.24 02:10:28 | 000,483,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010.03.18 17:23:04 | 000,044,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\as pnet_state.exe -- (aspnet_state)
SRV - [2010.03.18 15:27:14 | 000,138,576 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ms corsvw.exe -- (clr_optimization_v4.0.30319_64)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msco rsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.28 03:33:14 | 000,821,664 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE -- (cvhsvc)
========== Driver Services (SafeList) ==========
DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\LVPr2M64.sys -- (LVPr2M64)
DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\EagleX64.sys -- (EagleX64)
DRV:64bit: - [2011.04.01 05:07:54 | 004,184,672 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64) Logitech Webcam 200(UVC)
DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.19 15:48:53 | 000,299,520 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.02.19 15:48:40 | 009,085,952 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.02.19 15:47:56 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2010.10.24 22:25:38 | 000,072,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2010.09.23 01:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2010.07.28 09:13:50 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2010.04.24 02:10:32 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2010.04.24 02:10:28 | 000,269,672 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2010.04.24 02:10:28 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2010.04.24 02:10:20 | 000,721,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2010.03.22 12:57:20 | 000,347,680 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.12.01 15:49:52 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2009.10.07 10:47:44 | 000,327,704 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2009.10.07 10:45:37 | 000,271,640 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvpopf64.sys -- (lvpopf64)
DRV:64bit: - [2009.09.16 07:02:42 | 000,031,232 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle)
DRV:64bit: - [2009.08.09 23:25:45 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.06.10 22:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009.06.10 22:35:38 | 000,707,072 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr7364.sys -- (netr7364)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2009.01.19 20:32:22 | 000,334,344 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)
DRV:64bit: - [2008.12.26 11:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer) Avnex Virtual Audio Device (WDM)
DRV:64bit: - [2008.09.04 07:36:16 | 000,027,136 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag)
DRV:64bit: - [2008.09.04 07:35:40 | 000,033,792 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem)
DRV:64bit: - [2008.09.04 07:35:06 | 000,017,920 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus)
DRV:64bit: - [2007.02.18 00:22:48 | 000,296,816 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Treiber\VMM.sys -- (vmm)
DRV:64bit: - [2007.01.29 06:20:34 | 000,079,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMNetSrv.sys -- (VPCNetS2)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Only registered and activated users can see links. Click Here To Register...] [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [Only registered and activated users can see links. Click Here To Register...]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = [Only registered and activated users can see links. Click Here To Register...]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 08 BC B0 39 96 AE CB 01 [binary data]
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Productivity 2.2 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2903601&SearchSource=3&q={s earchTerms}"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "http://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.88
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [Only registered and activated users can see links. Click Here To Register...]:1.2.1
FF - prefs.js..extensions.enabledItems: [Only registered and activated users can see links. Click Here To Register...]:1.0.53.2
FF - prefs.js..extensions.enabledItems: [Only registered and activated users can see links. Click Here To Register...]:1.1.4.0024
FF - prefs.js..extensions.enabledItems: [Only registered and activated users can see links. Click Here To Register...]:3.3.3.2
FF - prefs.js..extensions.enabledItems: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4}:3.3.3.2
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q="
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.07 21:27:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.05.07 21:27:55 | 000,000,000 | ---D | M]
[2011.01.07 20:16:10 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\mozilla\Extensions
[2011.06.19 19:41:09 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions
[2011.05.27 15:44:29 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2011.04.30 15:00:48 | 000,000,000 | ---D | M] (BittorrentBar_DE Community Toolbar) -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}
[2011.04.29 12:15:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.01.08 12:57:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.03.28 17:53:37 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\battlefieldplay4f [Only registered and activated users can see links. Click Here To Register...]
[2011.04.30 15:00:48 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\[Only registered and activated users can see links. Click Here To Register...] m
[2011.03.26 14:53:32 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\ffxtlbr@Facemoods .com
[2011.06.19 19:41:09 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\[Only registered and activated users can see links. Click Here To Register...]
[2011.01.10 13:55:34 | 000,000,935 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\conduit.xml
[2011.04.01 18:09:07 | 000,002,059 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\daemon-search.xml
[2011.06.14 21:53:45 | 000,000,950 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin-1.xml
[2011.03.24 19:33:41 | 000,000,950 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin-2.xml
[2011.04.01 18:20:27 | 000,000,950 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin-3.xml
[2011.04.29 15:42:10 | 000,000,950 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin-4.xml
[2011.05.07 21:28:23 | 000,000,950 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin-5.xml
[2011.04.29 12:15:25 | 000,000,168 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin.gif
[2011.04.29 12:15:25 | 000,000,618 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin.src
[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin.xml
[2011.06.14 14:15:25 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.02.05 12:23:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.02.22 20:32:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.06.14 14:15:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011.05.07 21:27:47 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.05.07 21:27:51 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.05.07 21:27:51 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.05.07 21:27:51 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.03.26 14:53:33 | 000,002,046 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchddr.xml
[2011.05.07 21:27:51 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.05.07 21:27:51 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.05.07 21:27:51 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\bh\facemood s.dll (facemoods.com BHO)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodsTl br.dll (facemoods.com)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ChicoSys] C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (CyberLink)
O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe (CyberLink Corp.)
O4 - HKCU..\Run: [Audio Device] C:\Users\Sven\AppData\Roaming\oWcpVFSLqJZw.exe ()
O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [Logitech Vid] C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe (Logitech Inc.)
O4 - HKCU..\Run: [RGSC] C:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer\Run: Policies = c:\directory\CyberGate\install\server.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: HideFastUserSwitching = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoSaveSettings = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoFind = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoControlPanel = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer\Run: Policies = c:\directory\CyberGate\install\server.exe File not found
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: DisableClock = 1
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sven\AppData\Roaming\DVDVideoSoftIEHelper s\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sven\AppData\Roaming\DVDVideoSoftIEHelper s\freeyoutubetomp3converter.htm ()
O9 - Extra Button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [Only registered and activated users can see links. Click Here To Register...] (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [Only registered and activated users can see links. Click Here To Register...] (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Only registered and activated users can see links. Click Here To Register...] (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.e xe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.ex e (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30:64bit: - LSA: Security Packages - (livessp) - C:\Windows\SysNative\livessp.dll (Microsoft Corp.)
O30 - LSA: Security Packages - (livessp) - C:\Windows\SysWow64\livessp.dll (Microsoft Corp.)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 90 Days ==========
[2011.06.20 10:46:34 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\TeamSpeak 3 Client
[2011.06.19 20:00:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VocoderGUI
[2011.06.19 19:52:51 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\Reallusion
[2011.06.19 19:52:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Reallusion
[2011.06.19 19:51:37 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Reallusion
[2011.06.19 19:51:32 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\Malwarebytes
[2011.06.19 19:51:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Reallusion
[2011.06.19 19:51:16 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.06.19 19:51:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.06.19 19:51:10 | 000,025,912 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.06.19 19:51:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Reallusion
[2011.06.19 19:51:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.06.19 19:42:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Fake Voice
[2011.06.19 19:41:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Yontoo Layers
[2011.06.19 19:41:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2011.06.18 09:56:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Activision
[2011.06.17 14:11:09 | 001,047,880 | ---- | C] (Sysinternals - [Only registered and activated users can see links. Click Here To Register...]) -- C:\Users\Sven\Desktop\procexp64.exe
[2011.06.16 20:55:58 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\My Games
[2011.06.16 20:53:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft XNA
[2011.06.16 20:49:15 | 000,000,000 | ---D | C] -- C:\Users\Sven\Desktop\Terraria 1.04
[2011.06.14 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2011.06.13 22:18:21 | 000,000,000 | ---D | C] -- C:\Users\Sven\Desktop\Worldback ups
[2011.06.13 12:15:39 | 000,679,936 | ---- | C] (Generated by JEDI) -- C:\Windows\SysWow64\D3DX81ab.dll
[2011.06.13 12:15:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cheat Engine
[2011.06.12 20:31:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AV Vcs 7.0 DIAMOND
[2011.06.12 10:01:40 | 000,000,000 | ---D | C] -- C:\Users\Sven\Desktop\Nostale DE
[2011.06.11 18:00:51 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\Tunngle
[2011.06.11 18:00:51 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\Tunngle
[2011.06.11 18:00:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Tunngle
[2011.06.11 18:00:44 | 000,031,232 | ---- | C] (Tunngle.net) -- C:\Windows\SysNative\drivers\tap0901t.sys
[2011.06.11 18:00:41 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Tunngle
[2011.06.11 18:00:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tunngle
[2011.06.11 14:58:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\99nos
[2011.06.11 14:19:16 | 000,000,000 | -H-D | C] -- C:\Windows\msdownld.tmp
[2011.06.11 14:19:12 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx
[2011.06.11 09:53:23 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\LolClient
[2011.06.11 09:38:12 | 000,000,000 | ---D | C] -- C:\Riot Games
[2011.06.10 22:34:46 | 000,000,000 | ---D | C] -- C:\Users\Sven\Desktop\LeagueOfLegends
[2011.06.02 20:29:32 | 000,000,000 | ---D | C] -- C:\Programme\GIMP-2.0
[2011.06.01 20:11:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2011.06.01 18:49:05 | 077,683,512 | ---- | C] (K2 Network, Inc.) -- C:\APB_Reloaded_Installer.exe
[2011.06.01 18:47:52 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\GamersFirst LIVE!
[2011.06.01 18:47:32 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\PMB Files
[2011.06.01 18:47:31 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2011.06.01 18:47:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GamersFirst
[2011.06.01 16:39:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA Sports
[2011.06.01 14:11:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ProtectDisc Driver Installer
[2011.06.01 13:45:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cobra 11 - Highway Nights
[2011.05.31 14:58:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi
[2011.05.30 16:55:09 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\.minecraft
[2011.05.28 20:25:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NosTale(DE)
[2011.05.28 18:57:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BitTorrent
[2011.05.28 18:56:03 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\BitTorrent
[2011.05.28 17:07:00 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\go
[2011.05.28 17:06:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Easybits GO
[2011.05.27 19:22:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\alaplaya
[2011.05.27 15:43:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype Extras
[2011.05.27 15:31:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2011.05.22 10:09:23 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\InstallShield
[2011.05.20 18:39:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
[2011.05.20 18:27:49 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\Avatar
[2011.05.20 18:25:58 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\CyberLink
[2011.05.20 18:05:13 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\Youcam
[2011.05.20 13:27:20 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\LogiShrd
[2011.05.20 13:27:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Logitech
[2011.05.20 13:23:26 | 000,000,000 | ---D | C] -- C:\ProgramData\LogiShrd
[2011.05.20 13:23:23 | 000,000,000 | ---D | C] -- C:\Programme\Logitech
[2011.05.13 13:51:41 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\Mount&Blade With Fire and Sword
[2011.05.13 13:51:41 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\Mount&Blade With Fire and Sword
[2011.05.12 19:09:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mount&Blade With Fire and Sword
[2011.05.12 16:06:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2011.05.12 16:00:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Jack Claw
[2011.05.08 16:18:06 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\Toribash
[2011.05.08 16:17:35 | 000,000,000 | ---D | C] -- C:\Games
[2011.05.05 19:09:48 | 000,000,000 | ---D | C] -- C:\Users\Sven\Desktop\minecraft
[2011.05.05 18:49:18 | 000,000,000 | ---D | C] -- C:\Users\Sven\Desktop\MinecraftAlpha
[2011.05.05 18:21:25 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\FileZilla
[2011.05.05 18:21:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FileZilla FTP Client
[2011.04.29 12:13:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ7.5
[2011.04.20 17:08:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Minecraft PC Gamer Demo
[2011.04.19 18:02:17 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\Rockstar Games
[2011.04.19 17:51:20 | 000,000,000 | -HSD | C] -- C:\ProgramData\SecuROM
[2011.04.19 17:09:44 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\Rockstar Games
[2011.04.19 15:42:22 | 000,178,800 | ---- | C] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt_x64.dll
[2011.04.19 15:39:04 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\xlive
[2011.04.19 15:39:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
[2011.04.18 17:51:01 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\Vitalwerks
[2011.04.18 17:50:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\No-IP
[2011.04.16 17:53:33 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\Sony
[2011.04.16 17:50:44 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\Sony
[2011.04.16 17:25:40 | 000,000,000 | ---D | C] -- C:\Users\Sven\Desktop\Musik
[2011.04.15 17:18:54 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\CSO
[2011.04.15 17:16:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nexon
[2011.04.12 16:45:38 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\Navicat
[2011.04.12 13:08:39 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Treiber
[2011.04.12 13:08:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Virtual PC
[2011.04.09 19:30:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam
[2011.04.01 18:09:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DAEMON Tools Toolbar
[2011.04.01 16:34:37 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\FIFA 10
[2011.04.01 16:30:44 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\Leadertech
[2011.04.01 14:11:58 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\Avnex
[2011.04.01 14:06:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Screaming Bee
[2011.04.01 14:01:04 | 000,021,504 | ---- | C] (Avnex) -- C:\Windows\SysNative\drivers\vcsvad.sys
[2011.03.30 13:49:15 | 000,033,856 | -H-- | C] (LogMeIn, Inc.) -- C:\Windows\SysNative\hamachi.sys
[2011.03.29 16:51:47 | 000,000,000 | ---D | C] -- C:\Programme\WinRAR
[2011.03.29 14:58:53 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\CyberLink
[2011.03.29 14:57:28 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\CyberLink
[2011.03.29 14:57:28 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2011.03.29 14:56:01 | 000,000,000 | ---D | C] -- C:\ProgramData\SmartSound Software Inc
[2011.03.29 14:55:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SmartSound Software
[2011.03.29 14:55:57 | 000,000,000 | ---D | C] -- C:\ProgramData\eSellerate
[2011.03.29 14:54:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2011.03.29 14:54:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2011.03.29 14:53:56 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\Apple
[2011.03.29 14:53:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2011.03.29 14:53:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2011.03.29 14:53:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cyberlink
[2011.03.29 14:50:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp
[2011.03.27 19:29:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft
[2011.03.27 18:44:21 | 000,000,000 | ---D | C] -- C:\ProgramData\{7441053F-2C71-467A-B52E-1B58CDF085B2}
[2011.03.27 18:44:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LiveZilla
[2011.03.27 18:28:20 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\LiveZilla
[2011.03.26 23:06:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Media Center Programs
[2011.03.26 23:01:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tomb Raider - Anniversary
[2011.03.26 22:56:02 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Installations
[2011.03.26 13:12:03 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\{001FB394-1A79-433D-824E-C0A9A79860E3}
[2011.03.26 13:11:47 | 000,000,000 | ---D | C] -- C:\Users\Sven\Tracing
[2011.03.26 13:08:39 | 000,000,000 | ---D | C] -- C:\Windows\de
[2011.03.26 12:42:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audacity
[2011.03.25 19:58:20 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\PunkBuster
[2011.03.25 19:57:32 | 000,000,000 | ---D | C] -- C:\Users\Sven\Documents\Battlefield Play4Free
[2011.03.25 19:45:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA Games
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 90 Days ==========
[2011.06.20 14:01:51 | 002,621,440 | -HS- | M] () -- C:\Users\Sven\ntuser.dat
[2011.06.20 13:50:04 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1871683680-2125603932-3787906597-1001UA.job
[2011.06.20 13:00:01 | 000,014,624 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.06.20 13:00:01 | 000,014,624 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.06.20 12:53:19 | 001,047,880 | ---- | M] (Sysinternals - [Only registered and activated users can see links. Click Here To Register...]) -- C:\Users\Sven\Desktop\procexp64.exe
[2011.06.20 12:52:03 | 000,000,145 | ---- | M] () -- C:\Windows\SysWow64\swctl.dll
[2011.06.20 12:51:17 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2011.06.20 12:51:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.06.20 12:51:10 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\lvuvc.hs
[2011.06.20 12:51:01 | 3019,350,016 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.20 12:50:19 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\Access.dat
[2011.06.20 12:49:55 | 009,197,365 | -H-- | M] () -- C:\Users\Sven\AppData\Local\IconCache.db
[2011.06.20 10:50:05 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1871683680-2125603932-3787906597-1001Core.job
[2011.06.20 10:46:42 | 000,001,215 | ---- | M] () -- C:\Users\Sven\Desktop\TeamSpeak 3 Client.lnk
[2011.06.19 19:51:16 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.19 19:19:03 | 000,102,400 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\chrtmp
[2011.06.19 10:33:52 | 000,035,853 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\Anonymous2.jpg
[2011.06.19 10:29:45 | 000,009,216 | ---- | M] () -- C:\Users\Sven\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.06.18 09:57:29 | 000,001,069 | ---- | M] () -- C:\Users\Sven\Desktop\CoDSP - Verknüpfung.lnk
[2011.06.17 22:36:48 | 001,600,928 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.06.17 22:36:48 | 000,700,830 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.06.17 22:36:48 | 000,655,146 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.06.17 22:36:48 | 000,149,808 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.06.17 22:36:48 | 000,122,720 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.06.17 22:36:29 | 001,600,928 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.06.16 12:01:16 | 000,276,976 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.06.15 15:11:45 | 000,006,625 | ---- | M] () -- C:\Users\Sven\AppData\Roaming\antivir.png
[2011.06.14 11:45:06 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\00001199.LCS
[2011.06.13 14:59:06 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\000017B4.LCS
[2011.06.12 19:23:06 | 000,136,364 | ---- | M] () -- C:\Users\Sven\Desktop\GM#.wav
[2011.06.12 16:13:01 | 000,001,203 | ---- | M] () -- C:\Users\Sven\Desktop\LolEditor - Verknüpfung.lnk
[2011.06.12 15:09:03 | 000,544,768 | RHS- | M] () -- C:\Users\Sven\AppData\Roaming\oWcpVFSLqJZw.exe
[2011.06.12 08:45:58 | 000,001,855 | ---- | M] () -- C:\Users\Sven\Desktop\99nos.lnk
[2011.06.11 19:02:48 | 000,063,032 | ---- | M] () -- C:\Users\Sven\AppData\Local\GDIPFONTCACHEV1.DAT
[2011.06.11 18:30:08 | 000,317,355 | ---- | M] () -- C:\Users\Sven\Desktop\TheEvil's Sägewerk Punktehack (PS)-V1.2.exe
[2011.06.11 18:00:47 | 000,000,939 | ---- | M] () -- C:\Users\Public\Desktop\Tunngle beta.lnk
[2011.06.11 13:26:51 | 003,235,840 | ---- | M] () -- C:\Users\Sven\Desktop\PersoBuilder_v1.01.exe
[2011.06.11 09:41:50 | 000,001,728 | ---- | M] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk
[2011.06.08 16:20:27 | 000,094,878 | ---- | M] () -- C:\Users\Sven\Desktop\modpack-v4.17_MC.beta.1.5_01.zip
[2011.06.02 20:33:19 | 000,001,480 | ---- | M] () -- C:\Users\Sven\.recently-used.xbel
[2011.06.02 20:30:16 | 000,000,916 | ---- | M] () -- C:\Users\Public\Desktop\GIMP 2.lnk
[2011.06.02 15:05:59 | 000,281,656 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2011.06.02 12:14:44 | 000,281,656 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.06.02 10:32:04 | 000,281,200 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2011.06.02 09:57:37 | 000,957,367 | ---- | M] () -- C:\Users\Sven\Desktop\mcpatcher-2.1.0_01.exe
[2011.06.01 20:12:43 | 000,075,136 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.06.01 19:49:08 | 3805,508,496 | ---- | M] () -- C:\Client1.5.0.562750.7z
[2011.06.01 19:48:31 | 077,683,512 | ---- | M] (K2 Network, Inc.) -- C:\APB_Reloaded_Installer.exe
[2011.06.01 18:48:41 | 000,001,170 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
[2011.06.01 15:07:29 | 000,001,161 | ---- | M] () -- C:\Users\Public\Desktop\Cobra 11 - Highway Nights spielen.lnk
[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.05.29 09:11:20 | 000,025,912 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.05.28 20:29:45 | 000,001,690 | ---- | M] () -- C:\Users\Public\Desktop\NosTale.lnk
[2011.05.28 18:58:57 | 000,000,973 | ---- | M] () -- C:\Users\Public\Desktop\BitTorrent.lnk
[2011.05.27 19:30:10 | 000,001,822 | ---- | M] () -- C:\Users\Public\Desktop\S4League.lnk
[2011.05.27 15:31:10 | 000,002,515 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.05.22 15:55:12 | 476,357,996 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.05.20 18:39:30 | 000,524,288 | -HS- | M] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TMContainer00000000000000000002.regt rans-ms
[2011.05.20 18:39:30 | 000,524,288 | -HS- | M] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TMContainer00000000000000000001.regt rans-ms
[2011.05.20 18:39:30 | 000,065,536 | -HS- | M] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TM.blf
[2011.05.12 19:19:28 | 000,000,127 | ---- | M] () -- C:\Windows\SysNative\MRT.INI
[2011.04.19 15:42:22 | 000,178,800 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt_x64.dll
[2011.04.15 16:53:33 | 000,001,408 | ---- | M] () -- C:\Users\Sven\Desktop\Free YouTube to MP3 Converter.lnk
[2011.04.09 19:30:19 | 000,002,539 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk
[2011.04.09 18:55:28 | 000,179,261 | ---- | M] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.04.03 09:13:47 | 000,000,024 | ---- | M] () -- C:\Windows\AM_D8.PRF
[2011.04.02 15:43:27 | 000,270,142 | ---- | M] () -- C:\Users\Sven\Desktop\Minecraft.exe
[2011.04.01 05:07:02 | 010,877,272 | ---- | M] () -- C:\Windows\SysWow64\LogiDPP.dll
[2011.04.01 05:07:02 | 010,877,272 | ---- | M] () -- C:\Windows\SysNative\LogiDPP.dll
[2011.04.01 05:07:02 | 000,102,744 | ---- | M] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011.04.01 05:07:02 | 000,102,744 | ---- | M] () -- C:\Windows\SysNative\LogiDPPApp.exe
[2011.04.01 05:06:56 | 000,331,608 | ---- | M] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2011.04.01 05:06:56 | 000,331,608 | ---- | M] () -- C:\Windows\SysNative\DevManagerCore.dll
[2011.04.01 04:56:00 | 000,027,872 | ---- | M] () -- C:\Windows\SysNative\lvcoin64.ini
[2011.03.26 12:42:50 | 000,000,953 | ---- | M] () -- C:\Users\Sven\Desktop\Audacity.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011.06.20 10:46:42 | 000,001,215 | ---- | C] () -- C:\Users\Sven\Desktop\TeamSpeak 3 Client.lnk
[2011.06.19 19:51:16 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.19 10:33:52 | 000,035,853 | ---- | C] () -- C:\Users\Sven\AppData\Roaming\Anonymous2.jpg
[2011.06.18 09:57:29 | 000,001,069 | ---- | C] () -- C:\Users\Sven\Desktop\CoDSP - Verknüpfung.lnk
[2011.06.15 15:11:45 | 000,006,625 | ---- | C] () -- C:\Users\Sven\AppData\Roaming\antivir.png
[2011.06.13 12:15:39 | 001,970,176 | ---- | C] () -- C:\Windows\SysWow64\d3dx9.dll
[2011.06.12 19:23:04 | 000,136,364 | ---- | C] () -- C:\Users\Sven\Desktop\GM#.wav
[2011.06.12 18:37:30 | 000,839,009 | ---- | C] () -- C:\Users\Sven\Desktop\Bot2000 V2.1.exe
[2011.06.12 17:27:56 | 000,317,355 | ---- | C] () -- C:\Users\Sven\Desktop\TheEvil's Sägewerk Punktehack (PS)-V1.2.exe
[2011.06.12 15:09:04 | 000,544,768 | RHS- | C] () -- C:\Users\Sven\AppData\Roaming\oWcpVFSLqJZw.exe
[2011.06.11 22:28:00 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2011.06.11 18:00:47 | 000,000,939 | ---- | C] () -- C:\Users\Public\Desktop\Tunngle beta.lnk
[2011.06.11 15:07:39 | 000,001,855 | ---- | C] () -- C:\Users\Sven\Desktop\99nos.lnk
[2011.06.11 14:42:28 | 000,004,096 | ---- | C] () -- C:\Users\Public\Documents\000017B4.LCS
[2011.06.11 13:25:40 | 003,235,840 | ---- | C] () -- C:\Users\Sven\Desktop\PersoBuilder_v1.01.exe
[2011.06.11 09:41:50 | 000,001,728 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk
[2011.06.06 17:28:26 | 000,094,878 | ---- | C] () -- C:\Users\Sven\Desktop\modpack-v4.17_MC.beta.1.5_01.zip
[2011.06.02 20:33:19 | 000,001,480 | ---- | C] () -- C:\Users\Sven\.recently-used.xbel
[2011.06.02 20:30:16 | 000,000,916 | ---- | C] () -- C:\Users\Public\Desktop\GIMP 2.lnk
[2011.06.02 09:57:35 | 000,957,367 | ---- | C] () -- C:\Users\Sven\Desktop\mcpatcher-2.1.0_01.exe
[2011.06.01 20:12:46 | 000,281,656 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.06.01 20:12:46 | 000,281,200 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2011.06.01 20:12:43 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.06.01 18:49:05 | 3805,508,496 | ---- | C] () -- C:\Client1.5.0.562750.7z
[2011.06.01 18:47:20 | 000,001,170 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
[2011.06.01 15:07:29 | 000,001,161 | ---- | C] () -- C:\Users\Public\Desktop\Cobra 11 - Highway Nights spielen.lnk
[2011.05.28 20:29:45 | 000,001,690 | ---- | C] () -- C:\Users\Public\Desktop\NosTale.lnk
[2011.05.28 18:58:57 | 000,000,973 | ---- | C] () -- C:\Users\Public\Desktop\BitTorrent.lnk
[2011.05.27 19:30:10 | 000,001,822 | ---- | C] () -- C:\Users\Public\Desktop\S4League.lnk
[2011.05.27 15:31:10 | 000,002,515 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.05.20 18:11:05 | 000,524,288 | -HS- | C] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TMContainer00000000000000000002.regt rans-ms
[2011.05.20 18:11:04 | 000,524,288 | -HS- | C] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TMContainer00000000000000000001.regt rans-ms
[2011.05.20 18:11:03 | 000,065,536 | -HS- | C] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TM.blf
[2011.05.20 13:25:45 | 000,034,068 | ---- | C] () -- C:\Windows\SysNative\Repository.reg
[2011.05.12 19:19:28 | 000,000,127 | ---- | C] () -- C:\Windows\SysNative\MRT.INI
[2011.05.10 13:09:16 | 476,357,996 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011.04.15 20:53:08 | 000,001,203 | ---- | C] () -- C:\Users\Sven\Desktop\LolEditor - Verknüpfung.lnk
[2011.04.15 16:53:33 | 000,001,408 | ---- | C] () -- C:\Users\Sven\Desktop\Free YouTube to MP3 Converter.lnk
[2011.04.12 13:36:25 | 001,589,248 | ---- | C] () -- C:\Windows\SysWow64\libmysql_d.dll
[2011.04.09 19:30:19 | 000,002,539 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.04.03 09:13:47 | 000,000,024 | ---- | C] () -- C:\Windows\AM_D8.PRF
[2011.04.02 15:43:26 | 000,270,142 | ---- | C] () -- C:\Users\Sven\Desktop\Minecraft.exe
[2011.04.01 05:07:02 | 010,877,272 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2011.04.01 05:07:02 | 010,877,272 | ---- | C] () -- C:\Windows\SysNative\LogiDPP.dll
[2011.04.01 05:07:02 | 000,102,744 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011.04.01 05:07:02 | 000,102,744 | ---- | C] () -- C:\Windows\SysNative\LogiDPPApp.exe
[2011.04.01 05:06:56 | 000,331,608 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2011.04.01 05:06:56 | 000,331,608 | ---- | C] () -- C:\Windows\SysNative\DevManagerCore.dll
[2011.04.01 04:56:00 | 000,027,872 | ---- | C] () -- C:\Windows\SysNative\lvcoin64.ini
[2011.03.26 12:42:50 | 000,000,953 | ---- | C] () -- C:\Users\Sven\Desktop\Audacity.lnk
[2011.03.25 20:04:30 | 000,281,656 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2011.01.07 21:17:19 | 001,600,928 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.01.07 19:55:43 | 000,000,145 | -H-- | C] () -- C:\Windows\SysWow64\ctlsw.ini
[2011.01.07 19:55:43 | 000,000,145 | ---- | C] () -- C:\Windows\SysWow64\swctl.dll
[2011.01.07 19:55:28 | 000,009,368 | ---- | C] () -- C:\Windows\SysWow64\drivers\mchccinj.sys
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
========== LOP Check ==========
[2011.06.20 13:43:14 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\.minecraft
[2011.03.10 17:42:21 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\.Nitrous
[2011.04.01 14:11:58 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Avnex
[2011.05.28 20:08:41 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\BitTorrent
[2011.03.11 18:30:37 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\DAEMON Tools Lite
[2011.02.25 18:00:22 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\DMCache
[2011.01.08 12:57:50 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\DVDVideoSoftIEHelper s
[2011.02.20 10:50:03 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Fighters
[2011.05.06 21:52:59 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\FileZilla
[2011.01.16 12:22:14 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\FireShot
[2011.03.06 12:03:22 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\FTSoftware_FlorianTh urnwald_ERSBerlinUpdater
[2011.05.28 17:07:00 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\go
[2011.02.14 17:32:18 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\GrabPro
[2011.03.06 12:13:24 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\gtk-2.0
[2011.03.04 18:24:21 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\IcoFX
[2011.06.20 12:53:29 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\ICQ
[2011.02.21 17:06:23 | 000,000,000 | RHSD | M] -- C:\Users\Sven\AppData\Roaming\install
[2011.04.01 16:30:44 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Leadertech
[2011.02.22 13:47:10 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\LG Electronics
[2011.06.11 09:53:23 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\LolClient
[2011.05.13 13:52:20 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Mount&Blade With Fire and Sword
[2011.03.15 14:29:27 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Opera
[2011.03.16 14:48:00 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Orbit
[2011.02.14 17:39:56 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\ProgSense
[2011.06.11 14:42:16 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\ProtectDisc
[2011.04.01 14:10:56 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Screaming Bee
[2011.06.14 22:07:26 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\SoftGrid Client
[2011.04.16 17:53:33 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Sony
[2011.03.06 12:25:53 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Subversion
[2006.07.28 22:11:27 | 000,000,000 | RHSD | M] -- C:\Users\Sven\AppData\Roaming\system32
[2011.01.08 22:03:08 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\TeamViewer
[2011.01.11 13:59:05 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\TP
[2011.06.20 10:08:17 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\TS3Client
[2011.06.11 19:26:16 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Tunngle
[2011.02.17 17:01:59 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\WhiteSmoke
[2011.05.27 15:42:22 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report >
Mal sehen was ihr dazu sagt :/
06/20/2011 15:21
Es19#22
Gehe genauestens wie folgt vor:
1. OTL-Fix
Achtung: Ein Neustart wird ausgeführt.
Kopiere folgendes bei OTL in "Custom Scans/Fixes" herein:
2. Erneuter MBAM-Scan
Scanne erneut mit MBAM, wieder keine Löschungen.
1. OTL-Fix
Achtung: Ein Neustart wird ausgeführt.
Kopiere folgendes bei OTL in "Custom Scans/Fixes" herein:
Code:
:OTL O4 - HKCU..\Run: [Audio Device] C:\Users\Sven\AppData\Roaming\oWcpVFSLqJZw.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer\Run: Policies = c:\directory\CyberGate\install\server.exe File not found O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer\Run: Policies = c:\directory\CyberGate\install\server.exe File not found :Commands [EMPTYTEMP] [RESETHOSTS] [CLEARALLRESTOREPOINTS] [REBOOT]
Scanne erneut mit MBAM, wieder keine Löschungen.
06/20/2011 15:28
Hiesan#23
Du ich verstehe davon nicht viel :<
Adde mich bitte in Skype: hotgamerstv
Adde mich bitte in Skype: hotgamerstv
06/20/2011 15:45
Es19#24
Du startest einfach OTL, und kopierst den Text aus der Codebox vollständig in das Kästchen "Benutzerdefinierte Scans/Fixes" hinein und startest mit einem Klick auf "Fix".
06/20/2011 15:48
Hiesan#25
Ja, habs scho :D
Das kam nach dem neustart
All processes killed
Error: Unable to interpret <[EMPTYTEMP]> in the current context!
Error: Unable to interpret <[RESETHOSTS]> in the current context!
Error: Unable to interpret <[CLEARALLRESTOREPOINTS]> in the current context!
Error: Unable to interpret <[REBOOT]> in the current context!
OTL by OldTimer - Version 3.2.9.0 log created on 06202011_154013
Files\Folders moved on Reboot...
C:\Users\Sven\AppData\Local\Temp\FXSAPIDebugLogFil e.txt moved successfully.
Registry entries deleted on Reboot...
Soll ich neu scannen?
Das kam nach dem neustart
All processes killed
Error: Unable to interpret <[EMPTYTEMP]> in the current context!
Error: Unable to interpret <[RESETHOSTS]> in the current context!
Error: Unable to interpret <[CLEARALLRESTOREPOINTS]> in the current context!
Error: Unable to interpret <[REBOOT]> in the current context!
OTL by OldTimer - Version 3.2.9.0 log created on 06202011_154013
Files\Folders moved on Reboot...
C:\Users\Sven\AppData\Local\Temp\FXSAPIDebugLogFil e.txt moved successfully.
Registry entries deleted on Reboot...
Soll ich neu scannen?
06/20/2011 16:53
Es19#26
Ist okay.
Jetzt scannst du mit MBAM und postest das Log erneut.
Jetzt scannst du mit MBAM und postest das Log erneut.
06/20/2011 16:58
Diablo_#27
Hi,
ich melde mich nochmal kurz, es wäre vieleicht sinnvoll, deine Passwörter von einem sauberen PC zu ändern.
Ist in dem Fall Cybergate. Somit hat der Angreifer den vollen Zugriff auf dein System.
Grüße
ich melde mich nochmal kurz, es wäre vieleicht sinnvoll, deine Passwörter von einem sauberen PC zu ändern.
Code:
c:\Users\Sven\AppData\Roaming\install\server.exe
Grüße
06/20/2011 17:23
Hiesan#28
Ich kenne Cybergate ... Ich habe es selber, dass ich weiß, wann PWs gespeichert sind, damit ein Hacker nicht viel davon hat :>
Ich editiere Ergebnis rein, da es sich immer aufhängt
Ich editiere Ergebnis rein, da es sich immer aufhängt
06/20/2011 17:39
Diablo_#29
Hi,Quote:
Ich editiere Ergebnis rein, da es sich immer aufhängt
du kannst Mbam ja wieder im abgesichertem Modus ausführen.
Grüße
06/20/2011 17:44
Hiesan#30
Welche?
Es gibt ja 3 abgesicherte Modie ;)
Es gibt ja 3 abgesicherte Modie ;)