Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   PC mit sbcvvhost_win86 infiziert (https://www.trojaner-board.de/107101-pc-sbcvvhost_win86-infiziert.html)

silentbamper 28.12.2011 16:51
PC mit sbcvvhost_win86 infiziert
 
Hallo liebes Forum

Wie schon gesagt hat mein Desktop Pcmit diesem Virus infiziert. Hab Windows Vista 64bit. Könnte mir bitte jemd helfen da ich von solchen sachen überhaupt keine ahnung hab:headbang:, danke.

markusg 28.12.2011 17:00
hallo
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.


Lade OTLpe Download OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
  • Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
  • Lege eine leere CD in Deinen Brenner.
  • ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
  • Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
  • Du kannst nun die Fenster des Brennprogramms schließen.
Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD


Bebilderte Anleitung: OTLpe-Scan
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
  • Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

silentbamper 29.12.2011 14:28
Also erst mal danke für die schnelle antwort.
Leider gibt es mehrere Probleme:
- Die Fragen "Do you wish to load the remote registry" kommt bei mir nicht.
- Nach dem Start von OTLPE muss ci ein verzeichniss auswählen ( ich hab C:/windows ausgewählt)
- Lass ich den Scan dan durchlaufen, hält er nach ca 10 min an mit der Meldung " Out of Memory"

P.S
Alles andere hat einwandfrei Funktioniert

markusg 29.12.2011 16:04
versuchs noch mal, ohne das script, also einfach auf scan klicken.

silentbamper 29.12.2011 16:35
Also diesesmal hat es funktioniert. Hier ist das textdokument:OTL Logfile:
Code:
OTL logfile created on: 12/29/2011 4:18:32 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
64bit-Windows Vista (TM) Ultimate Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): c:\pagefile.sys 2048 6139 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 596.17 Gb Total Space | 234.36 Gb Free Space | 39.31% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/12/19 06:46:33 | 000,288,768 | ---- | M] (Works Ltd.) [Auto] -- C:\Windows\System32\aptwgkikk.dll -- (LanmanWorkstation)
SRV:64bit: - [2008/01/20 21:50:23 | 000,195,584 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2008/01/20 21:46:39 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2011/12/12 15:35:08 | 000,751,464 | ---- | M] (Tunngle.net GmbH) [On_Demand] -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe -- (TunngleService)
SRV - [2011/12/08 12:51:18 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/12/05 12:58:05 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto] -- C:\Windows\SysWOW64\UpdSvc.dll -- (Update-Service)
SRV - [2011/10/11 07:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/10/11 07:59:39 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2011/10/11 07:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/08/15 10:18:12 | 002,329,480 | ---- | M] (LogMeIn Inc.) [Auto] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2010/06/07 10:05:06 | 000,240,232 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010/03/18 06:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/10 12:07:00 | 003,458,548 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand] -- C:\Windows\SysWow64\GameMon.des -- (npggsvc)
SRV - [2010/01/15 07:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/10/17 05:17:52 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/03/29 23:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/12/09 09:09:30 | 000,068,136 | ---- | M] () [Auto] -- C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE -- (ES lite Service)
SRV - [2008/11/11 02:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008/10/27 18:01:00 | 000,364,544 | ---- | M] (AVM Berlin) [Auto] -- C:\Program Files (x86)\avmwlanstick\WLanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2007/08/15 03:49:25 | 000,063,040 | ---- | M] () [Auto] -- C:\Program Files (x86)\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe -- (PnkBstrA)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/12/08 10:45:31 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/10/11 08:00:01 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/10/11 08:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011/03/11 09:35:35 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011/01/04 09:11:16 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand] -- C:\Windows\System32\drivers\TFsExDisk.sys -- (TFsExDisk)
DRV:64bit: - [2010/05/25 01:45:38 | 000,020,568 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand] -- C:\Windows\System32\drivers\dgderdrv.sys -- (dgderdrv)
DRV:64bit: - [2010/02/03 08:56:56 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2010/01/26 04:49:48 | 000,048,144 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System] -- C:\Windows\System32\drivers\uimx64.sys -- (UimBus)
DRV:64bit: - [2010/01/26 04:49:44 | 000,158,736 | ---- | M] (Paragon) [Kernel | System] -- C:\Windows\System32\drivers\Uim_IMx64.sys -- (Uim_IM)
DRV:64bit: - [2009/11/28 06:15:46 | 000,310,984 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2009/11/28 06:15:44 | 000,042,696 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2009/09/30 19:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WpdUsb.sys -- (WpdUsb)
DRV:64bit: - [2009/09/16 01:02:42 | 000,031,232 | ---- | M] (Tunngle.net) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle)
DRV:64bit: - [2009/09/11 05:49:18 | 000,076,552 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WmXlCore.sys -- (WmXlCore)
DRV:64bit: - [2009/09/11 05:49:08 | 000,015,880 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WmVirHid.sys -- (WmVirHid)
DRV:64bit: - [2009/09/11 05:48:46 | 000,041,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WmFilter.sys -- (WmFilter)
DRV:64bit: - [2009/09/11 05:48:36 | 000,026,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WmBEnum.sys -- (WmBEnum)
DRV:64bit: - [2009/01/19 13:32:22 | 000,334,344 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV:64bit: - [2008/10/27 19:01:00 | 000,014,120 | R--- | M] (AVM Berlin) [Kernel | On_Demand] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2008/10/27 18:01:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV:64bit: - [2008/09/12 03:31:29 | 000,041,216 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\Windows\System32\drivers\SaiBus.sys -- (SaiNtBus)
DRV:64bit: - [2008/09/12 03:31:29 | 000,016,000 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\Windows\System32\drivers\SaiMini.sys -- (SaiMini)
DRV:64bit: - [2008/09/12 03:31:16 | 000,131,584 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\Windows\System32\drivers\SaiK0836.sys -- (SaiK0836)
DRV:64bit: - [2008/08/28 04:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2008/08/06 03:26:08 | 000,174,592 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2006/09/18 16:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- C:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2005/07/14 13:59:00 | 000,243,712 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\rt2500usb.sys -- (rt2500usb) DWL-G122(rev.B)
DRV - [2011/12/28 10:33:16 | 000,023,080 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand] -- C:\Windows\gdrv.sys -- (gdrv)
DRV - [2011/07/14 12:47:24 | 000,030,528 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\GVTDrv64.sys -- (GVTDrv64)
DRV - [2007/03/16 03:11:20 | 000,015,648 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand] -- C:\Windows\SysWOW64\drivers\TBPanelx64.sys -- (Cardex)
DRV - [2005/01/03 10:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Chef_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\Chef_ON_C\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://start.icq.com/ [binary data]
IE - HKU\Chef_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.facemoods.com/?a=ddrnw
IE - HKU\Chef_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Chef_ON_C\..\URLSearchHook: {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - Reg Error: Key error. File not found
IE - HKU\Chef_ON_C\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - Reg Error: Key error. File not found
IE - HKU\Chef_ON_C\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - Reg Error: Key error. File not found
IE - HKU\Chef_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Chef_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.box;*.local
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaultthis.engineName: "Apps-O-Rama Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2758806&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {75656794-AB59-4712-BFBC-5D816D56F3BC}:1.1.3
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.0.19
FF - prefs.js..extensions.enabledItems: {073fbacd-9ac2-4e44-8b72-e2dad6810509}:3.3.0.19
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {2458abc0-f443-11dd-87af-0800200c9a66}:3.6.3.1.03.04.10
FF - prefs.js..extensions.enabledItems: djziggy@gmail.com:1.2.3
FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c9626}:1.6
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2758806&q="
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF64_11_1_102.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files (x86)\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@unity3d.com/UnityPlayer: C:\Program Files (x86)\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Program Files (x86)\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 4.0b1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 1\components
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 4.0b1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 1\plugins
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/12/24 10:15:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/06/19 06:27:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Thunderbird 3.1.16\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011/11/16 07:11:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Thunderbird 3.1.16\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2011/06/04 13:33:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chef\AppData\Roaming\Mozilla\Extensions
[2011/06/04 13:33:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chef\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/12/06 07:43:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions
[2011/12/05 07:43:58 | 000,000,000 | ---D | M] (Apps-O-Rama Community Toolbar) -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\{073fbacd-9ac2-4e44-8b72-e2dad6810509}
[2010/06/05 09:38:25 | 000,000,000 | ---D | M] (ANTHEM) -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\{07b2a769-ed19-4483-87ce-c643914c9626}
[2010/04/28 12:32:13 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/04/16 12:08:02 | 000,000,000 | ---D | M] (HypreCam Toolbar) -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}
[2011/12/06 07:43:57 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010/07/28 11:08:35 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/12/05 07:44:03 | 000,000,000 | ---D | M] (myBabylon EnglishBB Community Toolbar) -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}
[2010/03/11 13:09:11 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010/12/19 03:24:26 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\battlefieldheroespatcher@ea.com
[2011/04/14 11:43:09 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\battlefieldplay4free@ea.com
[2011/12/05 13:00:39 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\ffxtlbr@Facemoods.com
[2011/11/11 07:51:18 | 000,000,000 | ---D | M] ("Avira SearchFree Toolbar plus Web Protection") -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\extensions\toolbar@ask.com
[2010/04/03 11:56:31 | 000,002,331 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\searchplugins\bigseekpro.xml
[2010/02/13 13:57:39 | 000,002,171 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\searchplugins\bing.xml
[2011/01/17 05:11:42 | 000,000,925 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\searchplugins\conduit.xml
[2011/12/23 11:16:55 | 000,000,950 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\searchplugins\icqplugin-1.xml
[2009/04/26 05:45:12 | 000,000,950 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\searchplugins\icqplugin-2.xml
[2009/05/04 09:12:14 | 000,000,950 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\searchplugins\icqplugin-3.xml
[2009/06/15 08:45:07 | 000,000,950 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\searchplugins\icqplugin-4.xml
[2009/07/04 13:28:46 | 000,000,950 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\searchplugins\icqplugin-5.xml
[2009/07/10 08:42:31 | 000,000,961 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\searchplugins\icqplugin-6.xml
[2009/03/01 06:02:44 | 000,000,944 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Mozilla\Firefox\Profiles\t4y0phif.default\searchplugins\icqplugin.xml
[2011/12/24 10:15:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) --
[2011/12/21 02:42:29 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/05/03 21:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/12/21 00:08:50 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/12/21 00:02:40 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/12/21 00:08:50 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/12/05 13:00:42 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
[2011/12/21 00:08:50 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/12/21 00:08:50 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/12/21 00:08:50 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006/09/18 16:37:24 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg64.dll (Google Inc.)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files (x86)\DVDVideoSoft\tbDVD1.dll (Conduit Ltd.)
O2 - BHO: (no name) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll (facemoods.com)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files (x86)\DVDVideoSoft\tbDVD1.dll (Conduit Ltd.)
O3 - HKU\Chef_ON_C\..\Toolbar\WebBrowser: (no name) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - No CLSID value found.
O3 - HKU\Chef_ON_C\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKU\Chef_ON_C\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\Chef_ON_C\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Program Files (x86)\DVDVideoSoft\tbDVD1.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [facemoods] C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [WBhXTAWuFpmNyON] C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe (CPdL)
O4 - HKU\Chef_ON_C..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKU\Chef_ON_C..\Run: [OscarEditor] C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe ()
O4 - HKU\Chef_ON_C..\Run: [Speech Recognition] C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation)
O4 - HKU\Chef_ON_C..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - HKU\Chef_ON_C..\Run: [TBPanel] C:\Program Files (x86)\Vtune\TBPanel.exe ()
O4 - HKU\Chef_ON_C..\Run: [WBhXTAWuFpmNyON] C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe (CPdL)
O4 - HKU\Chef_ON_C..\Run: [WMPNSCFG]  File not found
O4 - HKU\LocalService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKLM..\RunOnceEx: []  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Chef\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Chef\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\Chef\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Chef\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15:64bit: - Chef_ON_C\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15:64bit: - Chef_ON_C\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} hxxp://www.fiaa.eu/OPLauncher.cab (Perparer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe) - C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe (CPdL)
O20 - HKU\Chef_ON_C Winlogon: Shell - (C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe) - C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe (CPdL)
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{07530971-2a75-11de-90ea-00241d13c03e}\Shell - "" = AutoRun
O33 - MountPoints2\{07530971-2a75-11de-90ea-00241d13c03e}\Shell\AutoRun\command - "" = F:\pushinst.exe
O33 - MountPoints2\{e1e4318e-4bdb-11e0-b7e7-001f3f04c6da}\Shell - "" = AutoRun
O33 - MountPoints2\{e1e4318e-4bdb-11e0-b7e7-001f3f04c6da}\Shell\AutoRun\command - "" = E:\setup.exe
O33 - MountPoints2\{f3cbf407-285e-11de-acf4-00241d13c03e}\Shell - "" = AutoRun
O33 - MountPoints2\{f3cbf407-285e-11de-acf4-00241d13c03e}\Shell\AutoRun\command - "" = F:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/12/28 07:17:49 | 000,095,744 | ---- | C] (Kassl GmbH) -- C:\Users\Chef\AppData\Roaming\dwlGina3.dll
[2011/12/28 07:15:26 | 000,344,064 | ---- | C] (CPdL) -- C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe
[2011/12/25 10:30:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
[2011/12/21 10:30:38 | 000,000,000 | ---D | C] -- C:\Users\Chef\Desktop\wop_update_1044to1045
[2011/12/21 10:00:26 | 000,000,000 | ---D | C] -- C:\Users\Chef\Desktop\wop_update_1041to1044
[2011/12/21 09:58:42 | 000,000,000 | ---D | C] -- C:\Users\Chef\Desktop\wop_update_1036_to_1041
[2011/12/21 09:55:26 | 000,000,000 | ---D | C] -- C:\Users\Chef\Desktop\wop_update_1035to1036
[2011/12/21 09:49:16 | 000,000,000 | ---D | C] -- C:\Users\Chef\Desktop\wop_update_1034to1035
[2011/12/21 09:32:51 | 000,000,000 | ---D | C] -- C:\Users\Chef\Desktop\wop_update_1032to1034
[2011/12/19 09:11:11 | 000,000,000 | ---D | C] -- C:\Users\Chef\Desktop\wop_update_1045to1047
[2011/12/19 09:09:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YUPLAY
[2011/12/19 09:05:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wings of Prey
[2011/12/18 13:04:00 | 000,000,000 | ---D | C] -- C:\Users\Chef\Documents\EA Games
[2011/12/18 12:08:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AGEIA
[2011/12/18 12:08:03 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\AGEIA
[2011/12/18 12:08:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AGEIA Technologies
[2011/12/17 06:02:46 | 000,000,000 | ---D | C] -- C:\Users\Chef\AppData\Local\Ubisoft Game Launcher
[2011/12/15 07:40:33 | 000,000,000 | ---D | C] -- C:\Users\Chef\Desktop\eurocom
[2011/12/14 14:40:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2011/12/14 14:40:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi
[2011/12/14 09:19:01 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2011/12/14 09:18:43 | 000,559,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2011/12/14 09:18:43 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011/12/14 09:18:39 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011/12/14 09:18:37 | 001,538,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2011/12/14 09:18:37 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2011/12/14 09:18:37 | 000,710,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011/12/14 09:18:37 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2011/12/14 09:18:37 | 000,479,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011/12/14 09:18:37 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2011/12/14 09:18:37 | 000,252,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011/12/14 09:18:37 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\occache.dll
[2011/12/14 09:18:37 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011/12/14 09:18:37 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll
[2011/12/14 09:18:37 | 000,072,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2011/12/14 09:18:37 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011/12/14 09:18:36 | 000,206,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2011/12/14 09:18:36 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2011/12/14 09:18:36 | 000,174,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ie4uinit.exe
[2011/12/14 09:18:36 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011/12/14 09:18:36 | 000,162,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011/12/14 09:18:36 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2011/12/14 09:18:36 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2011/12/14 09:18:36 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2011/12/14 09:18:36 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2011/12/14 09:18:36 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2011/12/14 09:18:36 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2011/12/14 09:18:36 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2011/12/14 09:18:36 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011/12/14 09:18:36 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2011/12/14 09:18:36 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2011/12/14 09:18:36 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2011/12/14 09:18:36 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011/12/11 04:24:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/12/11 04:24:47 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2011/12/06 10:59:05 | 000,000,000 | ---D | C] -- C:\Users\Chef\Documents\ANNO 2070
[2011/12/06 06:46:48 | 000,288,768 | ---- | C] (Works Ltd.) -- C:\Windows\System32\aptwgkikk.dll
[2011/12/05 13:00:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\facemoods.com
[2011/12/05 12:59:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\JDownloader
[2011/12/05 12:58:05 | 000,114,000 | ---- | C] (Joosoft.com GmbH) -- C:\Windows\SysWow64\UpdSvc.dll
[2011/11/30 08:09:35 | 000,000,000 | ---D | C] -- C:\Users\Chef\Desktop\fip
[4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Chef\AppData\Local\*.tmp files -> C:\Users\Chef\AppData\Local\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/12/28 10:54:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/12/28 10:53:46 | 000,004,144 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/28 10:53:46 | 000,004,144 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/28 10:52:39 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/28 10:49:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/28 10:38:56 | 000,642,720 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011/12/28 10:38:56 | 000,607,708 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/12/28 10:38:56 | 000,132,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011/12/28 10:38:56 | 000,108,980 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/12/28 10:33:16 | 000,023,080 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\Windows\gdrv.sys
[2011/12/28 10:33:09 | 000,244,965 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/12/28 07:17:49 | 000,095,744 | ---- | M] (Kassl GmbH) -- C:\Users\Chef\AppData\Roaming\dwlGina3.dll
[2011/12/28 07:15:25 | 000,344,064 | ---- | M] (CPdL) -- C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe
[2011/12/27 16:41:06 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{FB8587EE-D91A-43E5-BC8D-A0A29F2B4F6D}.job
[2011/12/27 16:38:12 | 000,244,965 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/12/27 04:22:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2011/12/25 14:26:31 | 002,300,296 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/12/25 10:30:16 | 000,000,792 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Tunngle beta.lnk
[2011/12/25 10:30:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
[2011/12/24 10:15:47 | 000,000,912 | ---- | M] () -- C:\Users\Chef\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/12/24 10:15:47 | 000,000,900 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/12/22 15:26:25 | 009,625,049 | ---- | M] () -- C:\Users\Chef\Desktop\Nightcore - E.T. (Dubstep).mp3
[2011/12/21 10:32:59 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wings of Prey
[2011/12/21 10:00:48 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YUPLAY
[2011/12/19 09:05:15 | 000,001,904 | ---- | M] () -- C:\Users\Chef\Desktop\Wings of Prey.lnk
[2011/12/19 06:46:33 | 000,288,768 | ---- | M] (Works Ltd.) -- C:\Windows\System32\aptwgkikk.dll
[2011/12/18 12:58:19 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts
[2011/12/18 12:08:07 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AGEIA
[2011/12/15 10:03:07 | 000,183,152 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011/12/15 08:46:49 | 000,000,680 | ---- | M] () -- C:\Users\Chef\AppData\Local\d3d9caps.dat
[2011/12/14 14:40:44 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2011/12/13 14:22:17 | 000,002,655 | ---- | M] () -- C:\Users\Chef\Desktop\Microsoft Office Word 2007.lnk
[2011/12/11 06:57:38 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\Access.dat
[2011/12/11 04:24:48 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/12/10 17:54:33 | 130,918,876 | ---- | M] () -- C:\Users\Chef\Desktop\Dwm 2011-12-10 23-54-30-10.avi
[2011/12/10 08:32:26 | 000,144,896 | ---- | M] () -- C:\Users\Chef\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/10 04:28:36 | 012,963,929 | ---- | M] () -- C:\Users\Chef\Desktop\Under The Iron Sky -- Full Version + Lyrics.mp3
[2011/12/10 04:09:58 | 010,003,289 | ---- | M] () -- C:\Users\Chef\Desktop\Mastodon - Indian Theme [NEW TRACK] - Jonah Hex Soundtrack.mp3
[2011/12/08 10:45:31 | 000,130,760 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011/12/07 08:03:10 | 000,001,154 | ---- | M] () -- C:\Users\Chef\Desktop\ANNO 2070 spielen.lnk
[2011/12/05 13:00:14 | 000,001,805 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader.lnk
[2011/12/05 13:00:14 | 000,001,784 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Deinstallationsprogramm.lnk
[2011/12/05 13:00:13 | 000,001,763 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Update.lnk
[2011/12/05 12:58:05 | 000,114,000 | ---- | M] (Joosoft.com GmbH) -- C:\Windows\SysWow64\UpdSvc.dll
[2011/12/02 14:03:03 | 007,200,089 | ---- | M] () -- C:\Users\Chef\Desktop\Marlon Roudette - New Age.mp3
[2011/11/30 10:47:32 | 010,555,289 | ---- | M] () -- C:\Users\Chef\Desktop\Rufus Wainwright - Hallelujah - Creative Lyrics.mp3
[4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Chef\AppData\Local\*.tmp files -> C:\Users\Chef\AppData\Local\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/12/25 10:30:16 | 000,000,792 | ---- | C] () -- C:\Users\Chef\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Tunngle beta.lnk
[2011/12/22 15:25:59 | 009,625,049 | ---- | C] () -- C:\Users\Chef\Desktop\Nightcore - E.T. (Dubstep).mp3
[2011/12/19 09:05:15 | 000,001,904 | ---- | C] () -- C:\Users\Chef\Desktop\Wings of Prey.lnk
[2011/12/10 17:54:30 | 130,918,876 | ---- | C] () -- C:\Users\Chef\Desktop\Dwm 2011-12-10 23-54-30-10.avi
[2011/12/10 04:28:22 | 012,963,929 | ---- | C] () -- C:\Users\Chef\Desktop\Under The Iron Sky -- Full Version + Lyrics.mp3
[2011/12/10 04:09:38 | 010,003,289 | ---- | C] () -- C:\Users\Chef\Desktop\Mastodon - Indian Theme [NEW TRACK] - Jonah Hex Soundtrack.mp3
[2011/12/07 08:03:10 | 000,001,154 | ---- | C] () -- C:\Users\Chef\Desktop\ANNO 2070 spielen.lnk
[2011/12/05 13:00:14 | 000,001,805 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader.lnk
[2011/12/05 13:00:14 | 000,001,784 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Deinstallationsprogramm.lnk
[2011/12/05 13:00:13 | 000,001,763 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Update.lnk
[2011/12/02 14:02:55 | 007,200,089 | ---- | C] () -- C:\Users\Chef\Desktop\Marlon Roudette - New Age.mp3
[2011/11/30 10:47:20 | 010,555,289 | ---- | C] () -- C:\Users\Chef\Desktop\Rufus Wainwright - Hallelujah - Creative Lyrics.mp3
[2011/09/27 07:16:33 | 000,000,703 | ---- | C] () -- C:\Windows\eReg.dat
[2011/08/15 13:26:55 | 063,289,352 | ---- | C] () -- C:\Users\Chef\AppData\Roaming\.minecraft.rar
[2011/07/24 03:51:47 | 000,000,114 | ---- | C] () -- C:\Users\Chef\AppData\default.pls
[2011/05/17 08:09:27 | 000,000,004 | ---- | C] () -- C:\Users\Chef\AppData\Roaming\steam_md4.dat
[2011/04/09 11:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/03/31 13:00:33 | 000,036,892 | ---- | C] () -- C:\Windows\SysWow64\bassmod.dll
[2011/03/18 13:23:59 | 000,000,552 | ---- | C] () -- C:\Users\Chef\AppData\Local\d3d8caps.dat
[2011/02/23 13:34:08 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2011/02/17 12:23:58 | 000,010,240 | ---- | C] () -- C:\Windows\SysWow64\vidx16.dll
[2011/02/04 14:35:14 | 000,151,552 | ---- | C] () -- C:\Windows\SysWow64\nvRegDev.dll
[2011/01/04 09:10:56 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011/01/04 09:10:56 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011/01/04 09:10:56 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011/01/04 09:10:56 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2010/11/26 16:00:42 | 000,000,136 | ---- | C] () -- C:\Windows\SIERRA.INI
[2010/09/09 09:53:27 | 000,000,092 | ---- | C] () -- C:\Users\Chef\AppData\Local\fusioncache.dat
[2010/09/09 09:42:08 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2010/04/04 04:13:45 | 000,019,456 | ---- | C] () -- C:\Users\Chef\AppData\Local\WebpageIcons.db
[2010/03/13 04:25:12 | 001,510,686 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/03/02 11:21:22 | 000,183,152 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2010/03/02 11:21:20 | 002,407,792 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_heroes.exe
[2010/03/02 11:21:20 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2010/01/27 11:56:54 | 000,244,965 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010/01/27 11:55:41 | 000,244,965 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/12/24 13:12:36 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat
[2009/12/24 13:12:36 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat
[2009/12/24 13:12:36 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat
[2009/12/24 13:12:36 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat
[2009/12/24 13:12:36 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat
[2009/12/24 13:12:36 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat
[2009/12/24 13:12:36 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat
[2009/12/24 13:12:36 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat
[2009/12/24 13:12:36 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat
[2009/12/24 13:12:36 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat
[2009/12/24 13:12:36 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat
[2009/12/24 13:12:36 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat
[2009/12/24 13:12:36 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat
[2009/12/24 13:12:36 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat
[2009/12/24 13:12:36 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat
[2009/12/24 13:12:36 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat
[2009/12/24 13:12:36 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat
[2009/12/24 13:12:36 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat
[2009/12/24 13:12:36 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini
[2009/11/28 06:19:23 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009/10/06 02:16:00 | 000,819,200 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2009/08/20 11:06:43 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009/08/20 11:06:07 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2009/08/20 11:05:35 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/04/19 06:12:49 | 000,000,680 | ---- | C] () -- C:\Users\Chef\AppData\Local\d3d9caps.dat
[2009/04/18 08:04:15 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2009/04/15 13:09:46 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009/04/14 14:18:41 | 000,144,896 | ---- | C] () -- C:\Users\Chef\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/13 15:43:43 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2009/04/13 15:11:14 | 000,000,026 | ---- | C] () -- C:\Windows\Irremote.ini
[2009/04/13 14:48:47 | 000,030,528 | ---- | C] () -- C:\Windows\GVTDrv64.sys
[2009/04/13 13:51:20 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2009/04/13 13:47:39 | 000,000,732 | ---- | C] () -- C:\Users\Chef\AppData\Local\d3d9caps64.dat
[2009/03/02 04:33:32 | 000,067,584 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2008/10/30 03:49:34 | 000,000,022 | ---- | C] () -- C:\ProgramData\8f01a90e-7eb3-48d3-93b1-50d88fd146fb
[2008/01/20 21:49:10 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2007/06/21 01:34:08 | 000,203,328 | R--- | C] () -- C:\Windows\GSetup.exe
[2007/06/19 02:59:36 | 000,070,400 | ---- | C] () -- C:\Windows\SysWow64\PhysXLoader.dll
[2007/04/20 01:57:30 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2007/04/20 01:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll
[2007/04/20 01:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll
[2007/04/20 01:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2007/04/20 01:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll
[2007/04/20 01:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll
[2007/04/20 01:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll
[2007/04/20 01:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll
[2007/04/20 01:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll
[2006/11/02 10:35:48 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 10:00:58 | 000,197,632 | ---- | C] () -- C:\Windows\SysWow64\ir32_32.dll
[2006/11/02 07:37:14 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2006/11/02 07:24:17 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2006/11/02 07:18:17 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2006/11/02 04:47:54 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
 
========== LOP Check ==========
 
[2011/11/07 14:29:21 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\.minecraft
[2010/02/04 08:32:51 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\Ankh - Heart of Osiris
[2011/08/06 11:02:47 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\Booster
[2011/03/11 09:37:00 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\DAEMON Tools Lite
[2011/03/11 09:32:30 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\DAEMON Tools Pro
[2011/08/12 06:03:31 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\DarksporeData
[2011/10/05 12:27:17 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\DVDVideoSoft
[2011/10/05 12:27:06 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\DVDVideoSoftIEHelpers
[2009/12/24 13:46:52 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\EPSON
[2011/11/28 14:02:47 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\gtk-2.0
[2011/05/05 09:32:06 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\K-Meleon
[2010/01/07 06:18:24 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\LEGO Company
[2010/07/29 04:39:21 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\PC Suite
[2009/12/01 11:33:19 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\ProtectDisc
[2010/08/26 14:20:13 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\Publish Providers
[2011/10/09 11:16:40 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\pymclevel
[2009/07/20 12:34:24 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\RapidSolution
[2011/07/07 10:29:38 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\Samsung
[2010/08/26 14:25:31 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\Sony
[2010/01/08 15:01:12 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\SPORE
[2009/04/16 08:03:20 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\TeamViewer
[2011/06/04 13:33:51 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\Thunderbird
[2011/10/02 15:27:37 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\TS3Client
[2011/12/27 12:19:05 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\Tunngle
[2011/12/06 06:58:27 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\Ubisoft
[2009/07/24 10:22:08 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\Unity
[2011/04/24 14:05:10 | 000,000,000 | ---D | M] -- C:\Users\Chef\AppData\Roaming\wargaming.net
[2010/10/04 06:54:32 | 000,000,000 | ---D | M] -- C:\ProgramData\2DBoy
[2009/04/13 13:45:42 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2006/11/02 10:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2010/03/24 12:55:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Codemasters
[2010/04/04 14:28:40 | 000,000,000 | ---D | M] -- C:\ProgramData\createpart
[2011/03/11 09:35:08 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Lite
[2011/03/11 09:32:30 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Pro
[2006/11/02 10:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006/11/02 10:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/04/13 13:45:42 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2011/03/04 13:36:26 | 000,000,000 | ---D | M] -- C:\ProgramData\EA Core
[2010/11/03 04:24:44 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2009/12/24 13:27:09 | 000,000,000 | ---D | M] -- C:\ProgramData\EPSON
[2010/04/04 07:14:24 | 000,000,000 | ---D | M] -- C:\ProgramData\explauncher
[2009/04/13 13:45:42 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006/11/02 10:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2010/09/09 05:27:57 | 000,000,000 | ---D | M] -- C:\ProgramData\foldit
[2009/04/16 08:03:26 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2010/02/04 07:54:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Intenium
[2010/04/04 07:23:49 | 000,000,000 | ---D | M] -- C:\ProgramData\launcher
[2010/04/04 07:24:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Paragon
[2010/07/29 04:39:22 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Suite
[2011/03/20 04:23:14 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files
[2009/11/18 13:21:02 | 000,000,000 | ---D | M] -- C:\ProgramData\RapidSolution
[2011/11/03 05:32:38 | 000,000,000 | ---D | M] -- C:\ProgramData\Samsung
[2011/12/17 06:02:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Solidshield
[2010/08/26 14:04:39 | 000,000,000 | ---D | M] -- C:\ProgramData\Sony
[2006/11/02 10:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2009/04/13 13:45:42 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2011/12/10 17:56:29 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
[2006/11/02 10:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2009/04/16 09:07:23 | 000,000,000 | ---D | M] -- C:\ProgramData\TrackMania
[2011/12/28 06:07:09 | 000,000,000 | ---D | M] -- C:\ProgramData\Tunngle
[2009/12/24 13:15:12 | 000,000,000 | ---D | M] -- C:\ProgramData\UDL
[2009/04/13 13:45:42 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2010/04/04 14:25:02 | 000,000,000 | ---D | M] -- C:\ProgramData\wipe
[2010/07/11 06:08:19 | 000,000,000 | ---D | M] -- C:\ProgramData\WOP
[2010/09/10 03:43:03 | 000,000,000 | -H-D | M] -- C:\ProgramData\{0151C9FC-719D-4459-B1E2-4685CC6E62A8}
[2010/09/10 03:43:01 | 000,000,000 | -H-D | M] -- C:\ProgramData\{5794CDCB-FAB7-4C15-9069-4D8AC02592DE}
[2011/12/28 10:53:46 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/12/27 16:41:06 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{FB8587EE-D91A-43E5-BC8D-A0A29F2B4F6D}.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\Chef\Desktop\shotgun sound effect.mp4:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Chef\Desktop\gunshot effect_ explosion_ blood effect and smoke.mp4:TOC.WMV
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:888AFB86
< End of report >
--- --- ---

markusg 29.12.2011 16:41
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
:OTL
O4 - HKU\Chef_ON_C..\Run: [WBhXTAWuFpmNyON] C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe (CPdL)
O4 - HKLM..\Run: [WBhXTAWuFpmNyON] C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe (CPdL)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Chef_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKLM Winlogon: Shell - (C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe) - C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe (CPdL)
O20 - HKU\Chef_ON_C Winlogon: Shell - (C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe) - C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe (CPdL)
[2011/12/28 07:17:49 | 000,095,744 | ---- | C] (Kassl GmbH) -- C:\Users\Chef\AppData\Roaming\dwlGina3.dll
[2011/12/06 06:46:48 | 000,288,768 | ---- | C] (Works Ltd.) -- C:\Windows\System32\aptwgkikk.dll
:Files
C:\Users\Chef\AppData\Roaming\sbcvvhost_win86.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.
falls alles geklappt hatt:

öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

silentbamper 29.12.2011 18:24
Ok hat funktioniert. Hab die Datei hochgeladen.

markusg 29.12.2011 18:38
nutzt du das system für onlinebanking einkäufe sonstige zahlungsabwicklungen oder ähnlich wichtiges?

silentbamper 29.12.2011 18:40
hab ein amazonkonto? Solch ich das Passwort ändern?

markusg 29.12.2011 18:43
der pc muss neu aufgesetzt und dann abgesichert werden
1. Datenrettung:2. Formatieren, Windows neuinstallieren:3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.

silentbamper 29.12.2011 19:00
Ok Autorun hab ich deaktiviert, das Daten retten dauert ne weile.
Ist es in ordnung wen ich Windos 7 später installiere?

markusg 29.12.2011 19:32
wie meinst du später? wir müssen erst die daten retten dann formatieren und dann windows instalieren, anders gehts ja sowieso nicht :-)

silentbamper 29.12.2011 19:45
Also Daten hab ich schon gerette, Passwörter hab ich auch schon geändert. Als nächstes muss ich also Formatieren und später Windows neuinstalieren.

markusg 29.12.2011 19:59
du hast von dem betroffenen system aus passwörter geendert? das macht ja keinen sinn :-)
weist du wie man formatiert oder nicht.
klar musst du formatieren, die reihenfolge was zu tun ist habe ich ja aufgeschrieben.

silentbamper 30.12.2011 11:21
Hab natürlich von nem anderen System aus die Passwörter geändert ;).
Wie man formatiert weiß ich nicht.


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:24 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19