Virus?

06/19/2011, 21:49	#16
Hiesan elite*gold: 0 The Black Market: 34/0/0 Join Date: Jan 2011 Posts: 5,789 Received Thanks: 1,860	Das Programm hat sich leider aufgehängt :/ War bei 10 Funde bei 200.000 Dateien. Leider kann ich nicht sagen, was für Dateien

06/19/2011, 21:52

#17

Diablo_

elite*gold: 5

The Black Market: 7/0/0

Join Date: Sep 2010

Posts: 9,927

Received Thanks: 4,387

Quote:

Originally Posted by .D∑ν!Ł°

Das Programm hat sich leider aufgehängt :/
War bei 10 Funde bei 200.000 Dateien.

Leider kann ich nicht sagen, was für Dateien

Wenn wirklich garnichts mehr geth, führe den Scan im abgesichertem Modus aus.

Grüße

Thanks

1 User

06/19/2011, 22:12	#18
Hiesan elite*gold: 0 The Black Market: 34/0/0 Join Date: Jan 2011 Posts: 5,789 Received Thanks: 1,860	Liegt vielleicht daran, weil ich nebenher Minecraft gespielt habe. Ich gehe jetzt sowieso gleich offline (PC aus) & ab ins Bett Morgen scanne ich neu und editiere das Ergebnis rein (Wenn keiner davor gepostet hat) Also dann bis morgen

06/20/2011, 13:40	#19
Hiesan elite*gold: 0 The Black Market: 34/0/0 Join Date: Jan 2011 Posts: 5,789 Received Thanks: 1,860	@Mod Doppelpost, da es WICHTIG ist, bitte nicht Verwarnen/Warnen Spoiler Malwarebytes' Anti-Malware 1.51.0.1200 Datenbank Version: 6897 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 20.06.2011 13:37:37 mbam-log-2011-06-20 (13-37-30).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 189629 Laufzeit: 18 Minute(n), 33 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 3 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 2 Infizierte Dateien: 8 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\Run\Policies (Backdoor.HMCPol.Gen) -> Value: Policies -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run\Audio Device (Trojan.Agent.I) -> Value: Audio Device -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Policies\Explorer\Run\Policies (Backdoor.HMCPol.Gen) -> Value: Policies -> No action taken. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: c:\directory\cybergate (Trojan.PWS) -> No action taken. c:\directory\cybergate\install (Trojan.PWS) -> No action taken. Infizierte Dateien: c:\Users\Sven\AppData\Local\Temp\21199771_antivir. exe (Spyware.PWS) -> No action taken. c:\Users\Sven\AppData\Local\Temp\2727225_google chrome.exe (Spyware.PWS) -> No action taken. c:\Users\Sven\AppData\Local\Temp\yontoosetup-dropdowndeals-silentinstaller.exe (Adware.Agent) -> No action taken. c:\Users\Sven\downloads\downloader_1184391.exe (Spyware.PWS) -> No action taken. c:\Users\Sven\AppData\Roaming\install\server.exe (Backdoor.Bot.M) -> No action taken. c:\Users\Sven\AppData\Roaming\system32\svchost.exe (Trojan.Agent) -> No action taken. c:\Users\Sven\AppData\Local\Temp\xxxyyyzzz.dat (Malware.Trace) -> No action taken. c:\Users\Sven\AppData\Roaming\owcpvfslqjzw.exe (Trojan.Agent.I) -> No action taken. Das ist das Ergebnis vom Scan!

06/20/2011, 13:56	#20
Es19 elite*gold: 207 The Black Market: 8/0/0 Join Date: May 2010 Posts: 949 Received Thanks: 188	Sein Webhoster hat die Abuse-Meldung erhalten, die Seite, die der "Hacker" für die Verbreitung und das Datensammeln benutzt hat, wird umgehend vom Netz genommen. Behalte das Ergebnis zunächst. Nun führst du einen Quickscan mit durch. Poste die OTL.txt ebenfalls im Spoiler. Weitere Anweisungen folgen danach.

Thanks

1 User

06/20/2011, 14:06	#21
Hiesan elite*gold: 0 The Black Market: 34/0/0 Join Date: Jan 2011 Posts: 5,789 Received Thanks: 1,860	Spoiler OTL logfile created on: 20.06.2011 13:59:24 - Run 1 OTL by OldTimer - Version 3.2.9.0 Folder = C:\Users\Sven\Downloads 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 \| Country: Deutschland \| Language: DEU \| Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory \| 2,00 Gb Available Physical Memory \| 55,00% Memory free 7,00 Gb Paging File \| 6,00 Gb Available in Paging File \| 77,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files (x86) Drive C: \| 931,51 Gb Total Space \| 668,18 Gb Free Space \| 71,73% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: SVEN-PC Current User Name: Sven Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: On Skip Microsoft Files: On File Age = 90 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2011.06.20 13:59:13 \| 000,574,976 \| ---- \| M] (OldTimer Tools) -- C:\Users\Sven\Downloads\OTL.exe PRC - [2011.06.14 01:52:23 \| 001,011,768 \| ---- \| M] (Google Inc.) -- C:\Users\Sven\AppData\Local\Google\Chrome\Applicat ion\chrome.exe PRC - [2011.06.01 20:12:43 \| 000,075,136 \| ---- \| M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2011.05.25 17:29:54 \| 001,951,112 \| ---- \| M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe PRC - [2011.04.01 05:11:52 \| 000,428,640 \| ---- \| M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe PRC - [2011.02.26 07:33:07 \| 002,614,784 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\SysWOW64\explorer.exe PRC - [2011.02.25 10:46:22 \| 000,249,648 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE PRC - [2011.01.26 17:08:14 \| 004,177,272 \| ---- \| M] (Sysinternals - ) -- C:\Users\Sven\Desktop\procexp.exe PRC - [2010.12.15 21:04:10 \| 005,536,152 \| ---- \| M] (Salfeld Computer) -- C:\Windows\tray\wintmr.exe PRC - [2010.12.15 21:04:08 \| 005,527,448 \| ---- \| M] (Salfeld Computer) -- C:\Windows\SysWOW64\cc32\webtmr.exe PRC - [2010.12.15 21:03:30 \| 002,361,856 \| ---- \| M] (Salfeld Computer) -- C:\Windows\SysWOW64\ccsync.exe PRC - [2010.12.07 12:32:02 \| 002,228,008 \| ---- \| M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe PRC - [2010.11.22 22:52:46 \| 000,718,072 \| ---- \| M] (Tunngle.net GmbH) -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe PRC - [2010.04.24 02:10:34 \| 000,209,768 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2010.04.24 02:10:28 \| 000,483,688 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2010.02.28 03:33:14 \| 000,821,664 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE ========== Modules (SafeList) ========== MOD - [2011.06.20 13:59:13 \| 000,574,976 \| ---- \| M] (OldTimer Tools) -- C:\Users\Sven\Downloads\OTL.exe MOD - [2010.08.21 07:21:32 \| 001,680,896 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420f e3fa2b8113bd\comctl32.dll MOD - [2009.07.14 03:14:10 \| 000,095,232 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msscript.ocx ========== Win32 Services (SafeList) ========== SRV:64bit: - File not found [Auto \| Running] -- C:\Windows\SysNative\PnkBstrA.exe -- (PnkBstrA) SRV:64bit: - [2011.02.19 15:48:32 \| 000,203,776 \| ---- \| M] (AMD) [Auto \| Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2010.11.11 15:36:38 \| 000,282,616 \| ---- \| M] (Microsoft Corporation) [On_Demand \| Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv) SRV:64bit: - [2010.11.11 15:36:38 \| 000,012,784 \| ---- \| M] (Microsoft Corporation) [Auto \| Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc) SRV:64bit: - [2010.09.22 19:10:10 \| 000,057,184 \| ---- \| M] (Microsoft Corporation) [Disabled \| Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV:64bit: - [2010.09.21 15:49:00 \| 002,286,976 \| ---- \| M] (Microsoft Corp.) [Auto \| Running] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2011.06.19 19:39:59 \| 000,403,240 \| ---- \| M] (Valve Corporation) [On_Demand \| Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2011.06.01 20:12:43 \| 000,075,136 \| ---- \| M] () [Auto \| Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2011.05.25 17:29:52 \| 002,275,720 \| ---- \| M] (LogMeIn Inc.) [Auto \| Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2011.04.01 05:11:52 \| 000,428,640 \| ---- \| M] (Logitech Inc.) [Auto \| Running] -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv) SRV - [2011.02.28 18:44:14 \| 000,183,560 \| ---- \| M] (Microsoft Corporation.) [On_Demand \| Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011.02.25 10:46:22 \| 000,249,648 \| ---- \| M] (Microsoft Corporation) [Auto \| Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort) SRV - [2010.12.07 12:32:02 \| 002,228,008 \| ---- \| M] (TeamViewer GmbH) [Auto \| Running] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6) SRV - [2010.11.22 22:52:46 \| 000,718,072 \| ---- \| M] (Tunngle.net GmbH) [Auto \| Running] -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe -- (TunngleService) SRV - [2010.09.23 01:21:24 \| 001,493,352 \| ---- \| M] (Microsoft Corporation) [On_Demand \| Stopped] -- C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe -- (fsssvc) SRV - [2010.04.24 02:10:34 \| 000,209,768 \| ---- \| M] (Microsoft Corporation) [On_Demand \| Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2010.04.24 02:10:28 \| 000,483,688 \| ---- \| M] (Microsoft Corporation) [Auto \| Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2010.03.18 17:23:04 \| 000,044,376 \| ---- \| M] (Microsoft Corporation) [On_Demand \| Stopped] -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\as pnet_state.exe -- (aspnet_state) SRV - [2010.03.18 15:27:14 \| 000,138,576 \| ---- \| M] (Microsoft Corporation) [Auto \| Stopped] -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ms corsvw.exe -- (clr_optimization_v4.0.30319_64) SRV - [2010.03.18 14:16:28 \| 000,130,384 \| ---- \| M] (Microsoft Corporation) [Auto \| Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msco rsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.28 03:33:14 \| 000,821,664 \| ---- \| M] (Microsoft Corporation) [Auto \| Running] -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE -- (cvhsvc) ========== Driver Services (SafeList) ========== DRV:64bit: - File not found [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\DRIVERS\LVPr2M64.sys -- (LVPr2M64) DRV:64bit: - File not found [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\EagleX64.sys -- (EagleX64) DRV:64bit: - [2011.04.01 05:07:54 \| 004,184,672 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64) Logitech Webcam 200(UVC) DRV:64bit: - [2011.03.11 08:22:41 \| 000,107,904 \| ---- \| M] (Advanced Micro Devices) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:22:40 \| 000,027,008 \| ---- \| M] (Advanced Micro Devices) [Kernel \| Boot \| Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.02.19 15:48:53 \| 000,299,520 \| ---- \| M] (Advanced Micro Devices, Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2011.02.19 15:48:40 \| 009,085,952 \| ---- \| M] (ATI Technologies Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2011.02.19 15:47:56 \| 000,115,216 \| ---- \| M] (Advanced Micro Devices) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2010.10.24 22:25:38 \| 000,072,064 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2010.09.23 01:36:48 \| 000,048,488 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2010.07.28 09:13:50 \| 000,031,088 \| ---- \| M] (CyberLink Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd) DRV:64bit: - [2010.04.24 02:10:32 \| 000,022,376 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2010.04.24 02:10:28 \| 000,269,672 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2010.04.24 02:10:28 \| 000,025,960 \| ---- \| M] (Microsoft Corporation) [File_System \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2010.04.24 02:10:20 \| 000,721,768 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2010.03.22 12:57:20 \| 000,347,680 \| ---- \| M] (Realtek ) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009.12.01 15:49:52 \| 000,038,992 \| ---- \| M] (Screaming Bee LLC) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc) DRV:64bit: - [2009.10.07 10:47:44 \| 000,327,704 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64) DRV:64bit: - [2009.10.07 10:45:37 \| 000,271,640 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\lvpopf64.sys -- (lvpopf64) DRV:64bit: - [2009.09.16 07:02:42 \| 000,031,232 \| ---- \| M] (Tunngle.net) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle) DRV:64bit: - [2009.08.09 23:25:45 \| 000,036,352 \| ---- \| M] (Elaborate Bytes AG) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone) DRV:64bit: - [2009.07.14 03:52:20 \| 000,194,128 \| ---- \| M] (AMD Technologies Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 \| 000,065,600 \| ---- \| M] (LSI Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 \| 000,077,888 \| ---- \| M] (Hewlett-Packard Company) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 03:45:55 \| 000,024,656 \| ---- \| M] (Promise Technology) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:39:20 \| 000,023,040 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice) DRV:64bit: - [2009.06.10 22:38:56 \| 000,000,308 \| ---- \| M] () [File_System \| On_Demand \| Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs) DRV:64bit: - [2009.06.10 22:35:38 \| 000,707,072 \| ---- \| M] (Ralink Technology, Corp.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\netr7364.sys -- (netr7364) DRV:64bit: - [2009.06.10 22:34:33 \| 003,286,016 \| ---- \| M] (Broadcom Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 \| 000,468,480 \| ---- \| M] (Broadcom Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 \| 000,270,848 \| ---- \| M] (Broadcom Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 \| 000,031,232 \| ---- \| M] (Hauppauge Computer Works, Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.03.18 17:35:42 \| 000,033,856 \| -H-- \| M] (LogMeIn, Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2009.01.19 20:32:22 \| 000,334,344 \| ---- \| M] (Protect Software GmbH) [Kernel \| Auto \| Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11) DRV:64bit: - [2008.12.26 11:56:04 \| 000,021,504 \| ---- \| M] (Avnex) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer) Avnex Virtual Audio Device (WDM) DRV:64bit: - [2008.09.04 07:36:16 \| 000,027,136 \| ---- \| M] (LG Electronics Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag) DRV:64bit: - [2008.09.04 07:35:40 \| 000,033,792 \| ---- \| M] (LG Electronics Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem) DRV:64bit: - [2008.09.04 07:35:06 \| 000,017,920 \| ---- \| M] (LG Electronics Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus) DRV:64bit: - [2007.02.18 00:22:48 \| 000,296,816 \| ---- \| M] (Microsoft Corporation) [Kernel \| System \| Running] -- C:\Windows\SysNative\Treiber\VMM.sys -- (vmm) DRV:64bit: - [2007.01.29 06:20:34 \| 000,079,760 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\VMNetSrv.sys -- (VPCNetS2) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 08 BC B0 39 96 AE CB 01 [binary data] IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaultthis.engineName: "Productivity 2.2 Customized Web Search" FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2903601&SearchSource=3&q={s earchTerms}" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "http://start.icq.com/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.88 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: :1.2.1 FF - prefs.js..extensions.enabledItems: :1.0.53.2 FF - prefs.js..extensions.enabledItems: :1.1.4.0024 FF - prefs.js..extensions.enabledItems: :3.3.3.2 FF - prefs.js..extensions.enabledItems: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4}:3.3.3.2 FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=" FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.07 21:27:55 \| 000,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.05.07 21:27:55 \| 000,000,000 \| ---D \| M] [2011.01.07 20:16:10 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\mozilla\Extensions [2011.06.19 19:41:09 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions [2011.05.27 15:44:29 \| 000,000,000 \| ---D \| M] (FireShot) -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba} [2011.04.30 15:00:48 \| 000,000,000 \| ---D \| M] (BittorrentBar_DE Community Toolbar) -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} [2011.04.29 12:15:28 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2011.01.08 12:57:50 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.03.28 17:53:37 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\battlefieldplay4f [2011.04.30 15:00:48 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\ m [2011.03.26 14:53:32 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\ffxtlbr@Facemoods .com [2011.06.19 19:41:09 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Prof iles\258270zu.default\extensions\ [2011.01.10 13:55:34 \| 000,000,935 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\conduit.xml [2011.04.01 18:09:07 \| 000,002,059 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\daemon-search.xml [2011.06.14 21:53:45 \| 000,000,950 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin-1.xml [2011.03.24 19:33:41 \| 000,000,950 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin-2.xml [2011.04.01 18:20:27 \| 000,000,950 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin-3.xml [2011.04.29 15:42:10 \| 000,000,950 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin-4.xml [2011.05.07 21:28:23 \| 000,000,950 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin-5.xml [2011.04.29 12:15:25 \| 000,000,168 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin.gif [2011.04.29 12:15:25 \| 000,000,618 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin.src [2011.03.30 15:14:34 \| 000,001,042 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\Mozilla\FireFox\Prof iles\258270zu.default\searchplugins\icqplugin.xml [2011.06.14 14:15:25 \| 000,000,000 \| ---D \| M] -- C:\Program Files (x86)\mozilla firefox\extensions [2011.02.05 12:23:45 \| 000,000,000 \| ---D \| M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.02.22 20:32:11 \| 000,000,000 \| ---D \| M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.06.14 14:15:25 \| 000,000,000 \| ---D \| M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011.05.07 21:27:47 \| 000,142,296 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.05.04 04:52:23 \| 000,476,904 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011.05.07 21:27:51 \| 000,001,392 \| ---- \| M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.05.07 21:27:51 \| 000,002,252 \| ---- \| M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.05.07 21:27:51 \| 000,001,153 \| ---- \| M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.03.26 14:53:33 \| 000,002,046 \| ---- \| M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchddr.xml [2011.05.07 21:27:51 \| 000,006,805 \| ---- \| M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.05.07 21:27:51 \| 000,001,178 \| ---- \| M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.05.07 21:27:51 \| 000,001,105 \| ---- \| M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 \| 000,000,824 \| ---- \| M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\bh\facemood s.dll (facemoods.com BHO) O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodsTl br.dll (facemoods.com) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [ChicoSys] C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (CyberLink) O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe (CyberLink Corp.) O4 - HKCU..\Run: [Audio Device] C:\Users\Sven\AppData\Roaming\oWcpVFSLqJZw.exe () O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [Logitech Vid] C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe (Logitech Inc.) O4 - HKCU..\Run: [RGSC] C:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe File not found O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer\Run: Policies = c:\directory\CyberGate\install\server.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: HideFastUserSwitching = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoSaveSettings = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoFind = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoControlPanel = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer\Run: Policies = c:\directory\CyberGate\install\server.exe File not found O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: DisableClock = 1 O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sven\AppData\Roaming\DVDVideoSoftIEHelper s\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sven\AppData\Roaming\DVDVideoSoftIEHelper s\freeyoutubetomp3converter.htm () O9 - Extra Button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O9 - Extra Button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_26) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.e xe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.ex e (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O30:64bit: - LSA: Security Packages - (livessp) - C:\Windows\SysNative\livessp.dll (Microsoft Corp.) O30 - LSA: Security Packages - (livessp) - C:\Windows\SysWow64\livessp.dll (Microsoft Corp.) O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk ) - File not found O35:64bit:* - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 90 Days ========== [2011.06.20 10:46:34 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\TeamSpeak 3 Client [2011.06.19 20:00:56 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\VocoderGUI [2011.06.19 19:52:51 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\Reallusion [2011.06.19 19:52:23 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Reallusion [2011.06.19 19:51:37 \| 000,000,000 \| ---D \| C] -- C:\Users\Public\Documents\Reallusion [2011.06.19 19:51:32 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\Malwarebytes [2011.06.19 19:51:21 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Common Files\Reallusion [2011.06.19 19:51:16 \| 000,039,984 \| ---- \| C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2011.06.19 19:51:13 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Malwarebytes [2011.06.19 19:51:10 \| 000,025,912 \| ---- \| C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.06.19 19:51:09 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Reallusion [2011.06.19 19:51:09 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.06.19 19:42:19 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Fake Voice [2011.06.19 19:41:07 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Yontoo Layers [2011.06.19 19:41:07 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Tarma Installer [2011.06.18 09:56:10 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Activision [2011.06.17 14:11:09 \| 001,047,880 \| ---- \| C] (Sysinternals - ) -- C:\Users\Sven\Desktop\procexp64.exe [2011.06.16 20:55:58 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Documents\My Games [2011.06.16 20:53:51 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Microsoft XNA [2011.06.16 20:49:15 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Desktop\Terraria 1.04 [2011.06.14 14:15:50 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Common Files\Java [2011.06.13 22:18:21 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Desktop\Worldback ups [2011.06.13 12:15:39 \| 000,679,936 \| ---- \| C] (Generated by JEDI) -- C:\Windows\SysWow64\D3DX81ab.dll [2011.06.13 12:15:30 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Cheat Engine [2011.06.12 20:31:54 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\AV Vcs 7.0 DIAMOND [2011.06.12 10:01:40 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Desktop\Nostale DE [2011.06.11 18:00:51 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Documents\Tunngle [2011.06.11 18:00:51 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\Tunngle [2011.06.11 18:00:51 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Tunngle [2011.06.11 18:00:44 \| 000,031,232 \| ---- \| C] (Tunngle.net) -- C:\Windows\SysNative\drivers\tap0901t.sys [2011.06.11 18:00:41 \| 000,000,000 \| ---D \| C] -- C:\Users\Public\Documents\Tunngle [2011.06.11 18:00:33 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Tunngle [2011.06.11 14:58:47 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\99nos [2011.06.11 14:19:16 \| 000,000,000 \| -H-D \| C] -- C:\Windows\msdownld.tmp [2011.06.11 14:19:12 \| 000,000,000 \| ---D \| C] -- C:\Windows\SysWow64\directx [2011.06.11 09:53:23 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\LolClient [2011.06.11 09:38:12 \| 000,000,000 \| ---D \| C] -- C:\Riot Games [2011.06.10 22:34:46 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Desktop\LeagueOfLegends [2011.06.02 20:29:32 \| 000,000,000 \| ---D \| C] -- C:\Programme\GIMP-2.0 [2011.06.01 20:11:14 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\NVIDIA Corporation [2011.06.01 18:49:05 \| 077,683,512 \| ---- \| C] (K2 Network, Inc.) -- C:\APB_Reloaded_Installer.exe [2011.06.01 18:47:52 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\GamersFirst LIVE! [2011.06.01 18:47:32 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\PMB Files [2011.06.01 18:47:31 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\PMB Files [2011.06.01 18:47:14 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\GamersFirst [2011.06.01 16:39:06 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\EA Sports [2011.06.01 14:11:59 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\ProtectDisc Driver Installer [2011.06.01 13:45:31 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Cobra 11 - Highway Nights [2011.05.31 14:58:30 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\LogMeIn Hamachi [2011.05.30 16:55:09 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\.minecraft [2011.05.28 20:25:12 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\NosTale(DE) [2011.05.28 18:57:26 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\BitTorrent [2011.05.28 18:56:03 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\BitTorrent [2011.05.28 17:07:00 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\go [2011.05.28 17:06:53 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Easybits GO [2011.05.27 19:22:38 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\alaplaya [2011.05.27 15:43:05 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Skype Extras [2011.05.27 15:31:10 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Common Files\Skype [2011.05.22 10:09:23 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\InstallShield [2011.05.20 18:39:46 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2 [2011.05.20 18:27:49 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Documents\Avatar [2011.05.20 18:25:58 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\CyberLink [2011.05.20 18:05:13 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Documents\Youcam [2011.05.20 13:27:20 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\LogiShrd [2011.05.20 13:27:11 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Logitech [2011.05.20 13:23:26 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\LogiShrd [2011.05.20 13:23:23 \| 000,000,000 \| ---D \| C] -- C:\Programme\Logitech [2011.05.13 13:51:41 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Documents\Mount&Blade With Fire and Sword [2011.05.13 13:51:41 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\Mount&Blade With Fire and Sword [2011.05.12 19:09:12 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Mount&Blade With Fire and Sword [2011.05.12 16:06:14 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard [2011.05.12 16:00:36 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Jack Claw [2011.05.08 16:18:06 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\Toribash [2011.05.08 16:17:35 \| 000,000,000 \| ---D \| C] -- C:\Games [2011.05.05 19:09:48 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Desktop\minecraft [2011.05.05 18:49:18 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Desktop\MinecraftAlpha [2011.05.05 18:21:25 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\FileZilla [2011.05.05 18:21:05 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\FileZilla FTP Client [2011.04.29 12:13:58 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\ICQ7.5 [2011.04.20 17:08:03 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Minecraft PC Gamer Demo [2011.04.19 18:02:17 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Documents\Rockstar Games [2011.04.19 17:51:20 \| 000,000,000 \| -HSD \| C] -- C:\ProgramData\SecuROM [2011.04.19 17:09:44 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\Rockstar Games [2011.04.19 15:42:22 \| 000,178,800 \| ---- \| C] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt_x64.dll [2011.04.19 15:39:04 \| 000,000,000 \| ---D \| C] -- C:\Windows\SysWow64\xlive [2011.04.19 15:39:02 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Microsoft Games for Windows - LIVE [2011.04.18 17:51:01 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\Vitalwerks [2011.04.18 17:50:47 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\No-IP [2011.04.16 17:53:33 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\Sony [2011.04.16 17:50:44 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\Sony [2011.04.16 17:25:40 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Desktop\Musik [2011.04.15 17:18:54 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\CSO [2011.04.15 17:16:02 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Nexon [2011.04.12 16:45:38 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Documents\Navicat [2011.04.12 13:08:39 \| 000,000,000 \| ---D \| C] -- C:\Windows\SysNative\Treiber [2011.04.12 13:08:38 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Microsoft Virtual PC [2011.04.09 19:30:17 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Steam [2011.04.01 18:09:08 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\DAEMON Tools Toolbar [2011.04.01 16:34:37 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Documents\FIFA 10 [2011.04.01 16:30:44 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\Leadertech [2011.04.01 14:11:58 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\Avnex [2011.04.01 14:06:33 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Screaming Bee [2011.04.01 14:01:04 \| 000,021,504 \| ---- \| C] (Avnex) -- C:\Windows\SysNative\drivers\vcsvad.sys [2011.03.30 13:49:15 \| 000,033,856 \| -H-- \| C] (LogMeIn, Inc.) -- C:\Windows\SysNative\hamachi.sys [2011.03.29 16:51:47 \| 000,000,000 \| ---D \| C] -- C:\Programme\WinRAR [2011.03.29 14:58:53 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Documents\CyberLink [2011.03.29 14:57:28 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Roaming\CyberLink [2011.03.29 14:57:28 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\CyberLink [2011.03.29 14:56:01 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\SmartSound Software Inc [2011.03.29 14:55:57 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\SmartSound Software [2011.03.29 14:55:57 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\eSellerate [2011.03.29 14:54:42 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Apple Computer [2011.03.29 14:54:12 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Common Files\Apple [2011.03.29 14:53:56 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\Apple [2011.03.29 14:53:53 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Apple Software Update [2011.03.29 14:53:53 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Apple [2011.03.29 14:53:22 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Cyberlink [2011.03.29 14:50:17 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Temp [2011.03.27 19:29:35 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Microsoft [2011.03.27 18:44:21 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\{7441053F-2C71-467A-B52E-1B58CDF085B2} [2011.03.27 18:44:18 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\LiveZilla [2011.03.27 18:28:20 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Documents\LiveZilla [2011.03.26 23:06:58 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Media Center Programs [2011.03.26 23:01:19 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Tomb Raider - Anniversary [2011.03.26 22:56:02 \| 000,000,000 \| ---D \| C] -- C:\Windows\Downloaded Installations [2011.03.26 13:12:03 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\{001FB394-1A79-433D-824E-C0A9A79860E3} [2011.03.26 13:11:47 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Tracing [2011.03.26 13:08:39 \| 000,000,000 \| ---D \| C] -- C:\Windows\de [2011.03.26 12:42:48 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Audacity [2011.03.25 19:58:20 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\AppData\Local\PunkBuster [2011.03.25 19:57:32 \| 000,000,000 \| ---D \| C] -- C:\Users\Sven\Documents\Battlefield Play4Free [2011.03.25 19:45:13 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\EA Games [1 C:\Windows\.tmp files -> C:\Windows\.tmp -> ] ========== Files - Modified Within 90 Days ========== [2011.06.20 14:01:51 \| 002,621,440 \| -HS- \| M] () -- C:\Users\Sven\ntuser.dat [2011.06.20 13:50:04 \| 000,001,116 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1871683680-2125603932-3787906597-1001UA.job [2011.06.20 13:00:01 \| 000,014,624 \| -H-- \| M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.06.20 13:00:01 \| 000,014,624 \| -H-- \| M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.06.20 12:53:19 \| 001,047,880 \| ---- \| M] (Sysinternals - ) -- C:\Users\Sven\Desktop\procexp64.exe [2011.06.20 12:52:03 \| 000,000,145 \| ---- \| M] () -- C:\Windows\SysWow64\swctl.dll [2011.06.20 12:51:17 \| 000,000,006 \| -H-- \| M] () -- C:\Windows\tasks\SA.DAT [2011.06.20 12:51:11 \| 000,067,584 \| --S- \| M] () -- C:\Windows\bootstat.dat [2011.06.20 12:51:10 \| 000,000,000 \| ---- \| M] () -- C:\Windows\SysNative\drivers\lvuvc.hs [2011.06.20 12:51:01 \| 3019,350,016 \| -HS- \| M] () -- C:\hiberfil.sys [2011.06.20 12:50:19 \| 000,000,000 \| ---- \| M] () -- C:\Windows\SysWow64\Access.dat [2011.06.20 12:49:55 \| 009,197,365 \| -H-- \| M] () -- C:\Users\Sven\AppData\Local\IconCache.db [2011.06.20 10:50:05 \| 000,001,064 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1871683680-2125603932-3787906597-1001Core.job [2011.06.20 10:46:42 \| 000,001,215 \| ---- \| M] () -- C:\Users\Sven\Desktop\TeamSpeak 3 Client.lnk [2011.06.19 19:51:16 \| 000,001,119 \| ---- \| M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.06.19 19:19:03 \| 000,102,400 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\chrtmp [2011.06.19 10:33:52 \| 000,035,853 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\Anonymous2.jpg [2011.06.19 10:29:45 \| 000,009,216 \| ---- \| M] () -- C:\Users\Sven\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.06.18 09:57:29 \| 000,001,069 \| ---- \| M] () -- C:\Users\Sven\Desktop\CoDSP - Verknüpfung.lnk [2011.06.17 22:36:48 \| 001,600,928 \| ---- \| M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.06.17 22:36:48 \| 000,700,830 \| ---- \| M] () -- C:\Windows\SysNative\perfh007.dat [2011.06.17 22:36:48 \| 000,655,146 \| ---- \| M] () -- C:\Windows\SysNative\perfh009.dat [2011.06.17 22:36:48 \| 000,149,808 \| ---- \| M] () -- C:\Windows\SysNative\perfc007.dat [2011.06.17 22:36:48 \| 000,122,720 \| ---- \| M] () -- C:\Windows\SysNative\perfc009.dat [2011.06.17 22:36:29 \| 001,600,928 \| ---- \| M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.06.16 12:01:16 \| 000,276,976 \| ---- \| M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.06.15 15:11:45 \| 000,006,625 \| ---- \| M] () -- C:\Users\Sven\AppData\Roaming\antivir.png [2011.06.14 11:45:06 \| 000,004,096 \| ---- \| M] () -- C:\Users\Public\Documents\00001199.LCS [2011.06.13 14:59:06 \| 000,004,096 \| ---- \| M] () -- C:\Users\Public\Documents\000017B4.LCS [2011.06.12 19:23:06 \| 000,136,364 \| ---- \| M] () -- C:\Users\Sven\Desktop\GM#.wav [2011.06.12 16:13:01 \| 000,001,203 \| ---- \| M] () -- C:\Users\Sven\Desktop\LolEditor - Verknüpfung.lnk [2011.06.12 15:09:03 \| 000,544,768 \| RHS- \| M] () -- C:\Users\Sven\AppData\Roaming\oWcpVFSLqJZw.exe [2011.06.12 08:45:58 \| 000,001,855 \| ---- \| M] () -- C:\Users\Sven\Desktop\99nos.lnk [2011.06.11 19:02:48 \| 000,063,032 \| ---- \| M] () -- C:\Users\Sven\AppData\Local\GDIPFONTCACHEV1.DAT [2011.06.11 18:30:08 \| 000,317,355 \| ---- \| M] () -- C:\Users\Sven\Desktop\TheEvil's Sägewerk Punktehack (PS)-V1.2.exe [2011.06.11 18:00:47 \| 000,000,939 \| ---- \| M] () -- C:\Users\Public\Desktop\Tunngle beta.lnk [2011.06.11 13:26:51 \| 003,235,840 \| ---- \| M] () -- C:\Users\Sven\Desktop\PersoBuilder_v1.01.exe [2011.06.11 09:41:50 \| 000,001,728 \| ---- \| M] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk [2011.06.08 16:20:27 \| 000,094,878 \| ---- \| M] () -- C:\Users\Sven\Desktop\modpack-v4.17_MC.beta.1.5_01.zip [2011.06.02 20:33:19 \| 000,001,480 \| ---- \| M] () -- C:\Users\Sven\.recently-used.xbel [2011.06.02 20:30:16 \| 000,000,916 \| ---- \| M] () -- C:\Users\Public\Desktop\GIMP 2.lnk [2011.06.02 15:05:59 \| 000,281,656 \| ---- \| M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2011.06.02 12:14:44 \| 000,281,656 \| ---- \| M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.06.02 10:32:04 \| 000,281,200 \| ---- \| M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2011.06.02 09:57:37 \| 000,957,367 \| ---- \| M] () -- C:\Users\Sven\Desktop\mcpatcher-2.1.0_01.exe [2011.06.01 20:12:43 \| 000,075,136 \| ---- \| M] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.06.01 19:49:08 \| 3805,508,496 \| ---- \| M] () -- C:\Client1.5.0.562750.7z [2011.06.01 19:48:31 \| 077,683,512 \| ---- \| M] (K2 Network, Inc.) -- C:\APB_Reloaded_Installer.exe [2011.06.01 18:48:41 \| 000,001,170 \| ---- \| M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk [2011.06.01 15:07:29 \| 000,001,161 \| ---- \| M] () -- C:\Users\Public\Desktop\Cobra 11 - Highway Nights spielen.lnk [2011.05.29 09:11:30 \| 000,039,984 \| ---- \| M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2011.05.29 09:11:20 \| 000,025,912 \| ---- \| M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.05.28 20:29:45 \| 000,001,690 \| ---- \| M] () -- C:\Users\Public\Desktop\NosTale.lnk [2011.05.28 18:58:57 \| 000,000,973 \| ---- \| M] () -- C:\Users\Public\Desktop\BitTorrent.lnk [2011.05.27 19:30:10 \| 000,001,822 \| ---- \| M] () -- C:\Users\Public\Desktop\S4League.lnk [2011.05.27 15:31:10 \| 000,002,515 \| ---- \| M] () -- C:\Users\Public\Desktop\Skype.lnk [2011.05.22 15:55:12 \| 476,357,996 \| ---- \| M] () -- C:\Windows\MEMORY.DMP [2011.05.20 18:39:30 \| 000,524,288 \| -HS- \| M] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TMContainer00000000000000000002.regt rans-ms [2011.05.20 18:39:30 \| 000,524,288 \| -HS- \| M] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TMContainer00000000000000000001.regt rans-ms [2011.05.20 18:39:30 \| 000,065,536 \| -HS- \| M] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TM.blf [2011.05.12 19:19:28 \| 000,000,127 \| ---- \| M] () -- C:\Windows\SysNative\MRT.INI [2011.04.19 15:42:22 \| 000,178,800 \| ---- \| M] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt_x64.dll [2011.04.15 16:53:33 \| 000,001,408 \| ---- \| M] () -- C:\Users\Sven\Desktop\Free YouTube to MP3 Converter.lnk [2011.04.09 19:30:19 \| 000,002,539 \| ---- \| M] () -- C:\Users\Public\Desktop\Steam.lnk [2011.04.09 18:55:28 \| 000,179,261 \| ---- \| M] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.04.03 09:13:47 \| 000,000,024 \| ---- \| M] () -- C:\Windows\AM_D8.PRF [2011.04.02 15:43:27 \| 000,270,142 \| ---- \| M] () -- C:\Users\Sven\Desktop\Minecraft.exe [2011.04.01 05:07:02 \| 010,877,272 \| ---- \| M] () -- C:\Windows\SysWow64\LogiDPP.dll [2011.04.01 05:07:02 \| 010,877,272 \| ---- \| M] () -- C:\Windows\SysNative\LogiDPP.dll [2011.04.01 05:07:02 \| 000,102,744 \| ---- \| M] () -- C:\Windows\SysWow64\LogiDPPApp.exe [2011.04.01 05:07:02 \| 000,102,744 \| ---- \| M] () -- C:\Windows\SysNative\LogiDPPApp.exe [2011.04.01 05:06:56 \| 000,331,608 \| ---- \| M] () -- C:\Windows\SysWow64\DevManagerCore.dll [2011.04.01 05:06:56 \| 000,331,608 \| ---- \| M] () -- C:\Windows\SysNative\DevManagerCore.dll [2011.04.01 04:56:00 \| 000,027,872 \| ---- \| M] () -- C:\Windows\SysNative\lvcoin64.ini [2011.03.26 12:42:50 \| 000,000,953 \| ---- \| M] () -- C:\Users\Sven\Desktop\Audacity.lnk [1 C:\Windows\.tmp files -> C:\Windows\.tmp -> ] ========== Files Created - No Company Name ========== [2011.06.20 10:46:42 \| 000,001,215 \| ---- \| C] () -- C:\Users\Sven\Desktop\TeamSpeak 3 Client.lnk [2011.06.19 19:51:16 \| 000,001,119 \| ---- \| C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.06.19 10:33:52 \| 000,035,853 \| ---- \| C] () -- C:\Users\Sven\AppData\Roaming\Anonymous2.jpg [2011.06.18 09:57:29 \| 000,001,069 \| ---- \| C] () -- C:\Users\Sven\Desktop\CoDSP - Verknüpfung.lnk [2011.06.15 15:11:45 \| 000,006,625 \| ---- \| C] () -- C:\Users\Sven\AppData\Roaming\antivir.png [2011.06.13 12:15:39 \| 001,970,176 \| ---- \| C] () -- C:\Windows\SysWow64\d3dx9.dll [2011.06.12 19:23:04 \| 000,136,364 \| ---- \| C] () -- C:\Users\Sven\Desktop\GM#.wav [2011.06.12 18:37:30 \| 000,839,009 \| ---- \| C] () -- C:\Users\Sven\Desktop\Bot2000 V2.1.exe [2011.06.12 17:27:56 \| 000,317,355 \| ---- \| C] () -- C:\Users\Sven\Desktop\TheEvil's Sägewerk Punktehack (PS)-V1.2.exe [2011.06.12 15:09:04 \| 000,544,768 \| RHS- \| C] () -- C:\Users\Sven\AppData\Roaming\oWcpVFSLqJZw.exe [2011.06.11 22:28:00 \| 000,000,000 \| ---- \| C] () -- C:\Windows\SysWow64\Access.dat [2011.06.11 18:00:47 \| 000,000,939 \| ---- \| C] () -- C:\Users\Public\Desktop\Tunngle beta.lnk [2011.06.11 15:07:39 \| 000,001,855 \| ---- \| C] () -- C:\Users\Sven\Desktop\99nos.lnk [2011.06.11 14:42:28 \| 000,004,096 \| ---- \| C] () -- C:\Users\Public\Documents\000017B4.LCS [2011.06.11 13:25:40 \| 003,235,840 \| ---- \| C] () -- C:\Users\Sven\Desktop\PersoBuilder_v1.01.exe [2011.06.11 09:41:50 \| 000,001,728 \| ---- \| C] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk [2011.06.06 17:28:26 \| 000,094,878 \| ---- \| C] () -- C:\Users\Sven\Desktop\modpack-v4.17_MC.beta.1.5_01.zip [2011.06.02 20:33:19 \| 000,001,480 \| ---- \| C] () -- C:\Users\Sven\.recently-used.xbel [2011.06.02 20:30:16 \| 000,000,916 \| ---- \| C] () -- C:\Users\Public\Desktop\GIMP 2.lnk [2011.06.02 09:57:35 \| 000,957,367 \| ---- \| C] () -- C:\Users\Sven\Desktop\mcpatcher-2.1.0_01.exe [2011.06.01 20:12:46 \| 000,281,656 \| ---- \| C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.06.01 20:12:46 \| 000,281,200 \| ---- \| C] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2011.06.01 20:12:43 \| 000,075,136 \| ---- \| C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.06.01 18:49:05 \| 3805,508,496 \| ---- \| C] () -- C:\Client1.5.0.562750.7z [2011.06.01 18:47:20 \| 000,001,170 \| ---- \| C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk [2011.06.01 15:07:29 \| 000,001,161 \| ---- \| C] () -- C:\Users\Public\Desktop\Cobra 11 - Highway Nights spielen.lnk [2011.05.28 20:29:45 \| 000,001,690 \| ---- \| C] () -- C:\Users\Public\Desktop\NosTale.lnk [2011.05.28 18:58:57 \| 000,000,973 \| ---- \| C] () -- C:\Users\Public\Desktop\BitTorrent.lnk [2011.05.27 19:30:10 \| 000,001,822 \| ---- \| C] () -- C:\Users\Public\Desktop\S4League.lnk [2011.05.27 15:31:10 \| 000,002,515 \| ---- \| C] () -- C:\Users\Public\Desktop\Skype.lnk [2011.05.20 18:11:05 \| 000,524,288 \| -HS- \| C] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TMContainer00000000000000000002.regt rans-ms [2011.05.20 18:11:04 \| 000,524,288 \| -HS- \| C] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TMContainer00000000000000000001.regt rans-ms [2011.05.20 18:11:03 \| 000,065,536 \| -HS- \| C] () -- C:\Users\Sven\ntuser.dat{fbaba428-82f7-11e0-b015-d027880bc8f1}.TM.blf [2011.05.20 13:25:45 \| 000,034,068 \| ---- \| C] () -- C:\Windows\SysNative\Repository.reg [2011.05.12 19:19:28 \| 000,000,127 \| ---- \| C] () -- C:\Windows\SysNative\MRT.INI [2011.05.10 13:09:16 \| 476,357,996 \| ---- \| C] () -- C:\Windows\MEMORY.DMP [2011.04.15 20:53:08 \| 000,001,203 \| ---- \| C] () -- C:\Users\Sven\Desktop\LolEditor - Verknüpfung.lnk [2011.04.15 16:53:33 \| 000,001,408 \| ---- \| C] () -- C:\Users\Sven\Desktop\Free YouTube to MP3 Converter.lnk [2011.04.12 13:36:25 \| 001,589,248 \| ---- \| C] () -- C:\Windows\SysWow64\libmysql_d.dll [2011.04.09 19:30:19 \| 000,002,539 \| ---- \| C] () -- C:\Users\Public\Desktop\Steam.lnk [2011.04.09 18:55:28 \| 000,179,261 \| ---- \| C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.04.03 09:13:47 \| 000,000,024 \| ---- \| C] () -- C:\Windows\AM_D8.PRF [2011.04.02 15:43:26 \| 000,270,142 \| ---- \| C] () -- C:\Users\Sven\Desktop\Minecraft.exe [2011.04.01 05:07:02 \| 010,877,272 \| ---- \| C] () -- C:\Windows\SysWow64\LogiDPP.dll [2011.04.01 05:07:02 \| 010,877,272 \| ---- \| C] () -- C:\Windows\SysNative\LogiDPP.dll [2011.04.01 05:07:02 \| 000,102,744 \| ---- \| C] () -- C:\Windows\SysWow64\LogiDPPApp.exe [2011.04.01 05:07:02 \| 000,102,744 \| ---- \| C] () -- C:\Windows\SysNative\LogiDPPApp.exe [2011.04.01 05:06:56 \| 000,331,608 \| ---- \| C] () -- C:\Windows\SysWow64\DevManagerCore.dll [2011.04.01 05:06:56 \| 000,331,608 \| ---- \| C] () -- C:\Windows\SysNative\DevManagerCore.dll [2011.04.01 04:56:00 \| 000,027,872 \| ---- \| C] () -- C:\Windows\SysNative\lvcoin64.ini [2011.03.26 12:42:50 \| 000,000,953 \| ---- \| C] () -- C:\Users\Sven\Desktop\Audacity.lnk [2011.03.25 20:04:30 \| 000,281,656 \| ---- \| C] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2011.01.07 21:17:19 \| 001,600,928 \| ---- \| C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.01.07 19:55:43 \| 000,000,145 \| -H-- \| C] () -- C:\Windows\SysWow64\ctlsw.ini [2011.01.07 19:55:43 \| 000,000,145 \| ---- \| C] () -- C:\Windows\SysWow64\swctl.dll [2011.01.07 19:55:28 \| 000,009,368 \| ---- \| C] () -- C:\Windows\SysWow64\drivers\mchccinj.sys [2009.07.14 01:42:10 \| 000,064,000 \| ---- \| C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:03:59 \| 000,364,544 \| ---- \| C] () -- C:\Windows\SysWow64\msjetoledb40.dll ========== LOP Check ========== [2011.06.20 13:43:14 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\.minecraft [2011.03.10 17:42:21 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\.Nitrous [2011.04.01 14:11:58 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\Avnex [2011.05.28 20:08:41 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\BitTorrent [2011.03.11 18:30:37 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\DAEMON Tools Lite [2011.02.25 18:00:22 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\DMCache [2011.01.08 12:57:50 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\DVDVideoSoftIEHelper s [2011.02.20 10:50:03 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\Fighters [2011.05.06 21:52:59 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\FileZilla [2011.01.16 12:22:14 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\FireShot [2011.03.06 12:03:22 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\FTSoftware_FlorianTh urnwald_ERSBerlinUpdater [2011.05.28 17:07:00 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\go [2011.02.14 17:32:18 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\GrabPro [2011.03.06 12:13:24 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\gtk-2.0 [2011.03.04 18:24:21 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\IcoFX [2011.06.20 12:53:29 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\ICQ [2011.02.21 17:06:23 \| 000,000,000 \| RHSD \| M] -- C:\Users\Sven\AppData\Roaming\install [2011.04.01 16:30:44 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\Leadertech [2011.02.22 13:47:10 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\LG Electronics [2011.06.11 09:53:23 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\LolClient [2011.05.13 13:52:20 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\Mount&Blade With Fire and Sword [2011.03.15 14:29:27 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\Opera [2011.03.16 14:48:00 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\Orbit [2011.02.14 17:39:56 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\ProgSense [2011.06.11 14:42:16 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\ProtectDisc [2011.04.01 14:10:56 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\Screaming Bee [2011.06.14 22:07:26 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\SoftGrid Client [2011.04.16 17:53:33 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\Sony [2011.03.06 12:25:53 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\Subversion [2006.07.28 22:11:27 \| 000,000,000 \| RHSD \| M] -- C:\Users\Sven\AppData\Roaming\system32 [2011.01.08 22:03:08 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\TeamViewer [2011.01.11 13:59:05 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\TP [2011.06.20 10:08:17 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\TS3Client [2011.06.11 19:26:16 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\Tunngle [2011.02.17 17:01:59 \| 000,000,000 \| ---D \| M] -- C:\Users\Sven\AppData\Roaming\WhiteSmoke [2011.05.27 15:42:22 \| 000,032,640 \| ---- \| M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Mal sehen was ihr dazu sagt :/

06/20/2011, 15:21

#22

Es19

elite*gold: 207

The Black Market: 8/0/0

Join Date: May 2010

Posts: 949

Received Thanks: 188

Gehe genauestens wie folgt vor:

1. OTL-Fix
Achtung: Ein Neustart wird ausgeführt.

Kopiere folgendes bei OTL in "Custom Scans/Fixes" herein:

Code:

:OTL
O4 - HKCU..\Run: [Audio Device] C:\Users\Sven\AppData\Roaming\oWcpVFSLqJZw.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer\Run: Policies = c:\directory\CyberGate\install\server.exe File not found
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer\Run: Policies = c:\directory\CyberGate\install\server.exe File not found

:Commands
[EMPTYTEMP]
[RESETHOSTS]
[CLEARALLRESTOREPOINTS]
[REBOOT]

2. Erneuter MBAM-Scan
Scanne erneut mit MBAM, wieder keine Löschungen.

Thanks

1 User

06/20/2011, 15:28	#23
Hiesan elite*gold: 0 The Black Market: 34/0/0 Join Date: Jan 2011 Posts: 5,789 Received Thanks: 1,860	Du ich verstehe davon nicht viel :< Adde mich bitte in Skype: hotgamerstv

06/20/2011, 15:45	#24
Es19 elite*gold: 207 The Black Market: 8/0/0 Join Date: May 2010 Posts: 949 Received Thanks: 188	Du startest einfach OTL, und kopierst den Text aus der Codebox vollständig in das Kästchen "Benutzerdefinierte Scans/Fixes" hinein und startest mit einem Klick auf "Fix".

Thanks

1 User

06/20/2011, 15:48	#25
Hiesan elite*gold: 0 The Black Market: 34/0/0 Join Date: Jan 2011 Posts: 5,789 Received Thanks: 1,860	Ja, habs scho Das kam nach dem neustart Spoiler All processes killed Error: Unable to interpret <[EMPTYTEMP]> in the current context! Error: Unable to interpret <[RESETHOSTS]> in the current context! Error: Unable to interpret <[CLEARALLRESTOREPOINTS]> in the current context! Error: Unable to interpret <[REBOOT]> in the current context! OTL by OldTimer - Version 3.2.9.0 log created on 06202011_154013 Files\Folders moved on Reboot... C:\Users\Sven\AppData\Local\Temp\FXSAPIDebugLogFil e.txt moved successfully. Registry entries deleted on Reboot... Soll ich neu scannen?

06/20/2011, 16:53	#26
Es19 elite*gold: 207 The Black Market: 8/0/0 Join Date: May 2010 Posts: 949 Received Thanks: 188	Ist okay. Jetzt scannst du mit MBAM und postest das Log erneut.

06/20/2011, 16:58	#27
Diablo_ elite*gold: 5 The Black Market: 7/0/0 Join Date: Sep 2010 Posts: 9,927 Received Thanks: 4,387	Hi, ich melde mich nochmal kurz, es wäre vieleicht sinnvoll, deine Passwörter von einem sauberen PC zu ändern. Code: c:\Users\Sven\AppData\Roaming\install\server.exe Ist in dem Fall Cybergate. Somit hat der Angreifer den vollen Zugriff auf dein System. Grüße

Thanks

1 User

06/20/2011, 17:23	#28
Hiesan elite*gold: 0 The Black Market: 34/0/0 Join Date: Jan 2011 Posts: 5,789 Received Thanks: 1,860	Ich kenne Cybergate ... Ich habe es selber, dass ich weiß, wann PWs gespeichert sind, damit ein Hacker nicht viel davon hat :> Ich editiere Ergebnis rein, da es sich immer aufhängt

06/20/2011, 17:39

#29

Diablo_

elite*gold: 5

The Black Market: 7/0/0

Join Date: Sep 2010

Posts: 9,927

Received Thanks: 4,387

Quote:

Originally Posted by .D∑ν!Ł°

Ich kenne Cybergate ... Ich habe es selber, dass ich weiß, wann PWs gespeichert sind, damit ein Hacker nicht viel davon hat :>

Ich editiere Ergebnis rein, da es sich immer aufhängt

Hi,

du kannst Mbam ja wieder im abgesichertem Modus ausführen.

Grüße

Thanks

1 User

06/20/2011, 17:44	#30
Hiesan elite*gold: 0 The Black Market: 34/0/0 Join Date: Jan 2011 Posts: 5,789 Received Thanks: 1,860	Welche? Es gibt ja 3 abgesicherte Modie