Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche Seiten

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

 
Alt 07.11.2011, 18:53   #6
V...
 
Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche Seiten - Standard

Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche Seiten



Den letzten Schritt hab ich genau so ausgeführt wie du es beschrieben hast:

Zitat:
Zitat von kira Beitrag anzeigen

4.
erneut einen Scan mit OTL:
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.
Extras.txt:
Code:
ATTFilter
OTL Extras logfile created on: 07.11.2011 18:33:25 - Run 3
OTL by OldTimer - Version 3.2.31.0     Folder = c:\Users\Vanessa\Downloads
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19154)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,97 Gb Total Physical Memory | 0,51 Gb Available Physical Memory | 26,04% Memory free
4,16 Gb Paging File | 2,27 Gb Available in Paging File | 54,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 137,82 Gb Total Space | 67,44 Gb Free Space | 48,93% Space Free | Partition Type: NTFS
Drive E: | 1,33 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF1.50
Drive Q: | 9,77 Gb Total Space | 2,54 Gb Free Space | 25,97% Space Free | Partition Type: NTFS
Drive S: | 1,46 Gb Total Space | 0,67 Gb Free Space | 46,00% Space Free | Partition Type: NTFS
 
Computer Name: VANESSAS-LAPTOP | User Name: Vanessa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09A09E0D-9A15-4CCE-8331-F1DD30AB504C}" = rport=139 | protocol=6 | dir=out | app=system | 
"{3F3E98EB-3415-42AD-83BF-32FB7A8B7841}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{4675FE0D-B2B6-476F-AF75-5C2B5FBF09CD}" = rport=138 | protocol=17 | dir=out | app=system | 
"{6E7EB384-2709-4459-A40F-33848B76A711}" = rport=445 | protocol=6 | dir=out | app=system | 
"{70EFD100-29C5-44BB-8B02-DBBE7A83EF25}" = rport=137 | protocol=17 | dir=out | app=system | 
"{7E70A9B9-D16E-45D4-9626-B2B835719A9F}" = lport=137 | protocol=17 | dir=in | app=system | 
"{92BB5A3D-A0F4-4AE7-B30A-6D795E092F7C}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 
"{A56FD662-5DB3-4DD7-B744-12C36190959A}" = lport=138 | protocol=17 | dir=in | app=system | 
"{BEFA3E62-93A0-4495-863E-C5F8F77639B1}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{CE9FA5C3-3865-4227-8EA4-18F0FF7F9ED0}" = lport=445 | protocol=6 | dir=in | app=system | 
"{D6ABFE06-D458-48EE-B96C-204657DBC09E}" = lport=139 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0372A025-C6F2-41EC-B918-B8628F78314F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{0B903C40-2C3B-43E6-9DE4-AD17F582E472}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{220DE4D4-4E4D-49D2-9262-BB8866850A9E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{28D6B046-2CA8-455F-95A3-5A21A2B1B0F6}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{2BA277B8-BAA3-4233-9E90-99AA50B16EA3}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{2E60803E-43D5-480E-97B7-317440C1B731}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3707853B-35F1-4FFD-B13F-2F52C48FEF7F}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{3D547D15-8F10-4EB9-850B-A63F43B62BEF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{42866980-A412-4326-811B-FFDFC94A8640}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{479C703E-A3E3-4197-B520-42BF27D2A7FE}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
"{55A31779-3B7F-422F-8CC6-EE65EEFC2A02}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{5D02A2C0-8B85-4DE3-B55C-A85BDFA89957}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe | 
"{66C080D6-2E0A-4A17-BB31-EBED362BAA7E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{7370A286-18D7-45C6-92AE-0F9B74C097DA}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
"{73E4C4D7-1DFA-498C-A447-D33183AAA4FF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
"{74891EB0-AFAD-48F7-8AD3-2354A27C04AD}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{767DADD6-F6BD-4C4C-BC4C-3E0E95F2F457}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{79CFEF6D-3799-45BD-9D98-F0D4158D3DDC}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
"{7DF52391-44AC-447A-B9D6-87453651C140}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{850F9F08-7D2C-4A63-8191-473E1A0B88E7}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{88D53692-F964-4CF1-9DE9-C44B7AF1CB1D}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe | 
"{9C7A5CEF-192C-4A63-B514-67DB5DA93151}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe | 
"{B651EA50-6BD0-4D7B-8945-B700A83AEEAE}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{D16A3CBD-09D9-436D-A628-3D5BB38F2C46}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{DA745680-61C3-4336-889A-193F0732688F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{DB5ED0A3-2FD8-4188-934C-716E6BFE0BB6}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe | 
"{DD069386-7789-40EB-B973-8397FCF05D46}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{EA2E295F-9A92-48F9-8CF8-8DB70AE84CEB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
"TCP Query User{11E185BD-BE1A-472C-8D8A-7B70FB34E702}C:\program files\icq7.6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"UDP Query User{B86A65BB-2DA8-4B0D-BF95-9DD4B5EA1202}C:\program files\icq7.6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = ThinkPad Bluetooth with Enhanced Data Rate Software 6.1.0.4500
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{055B9AD2-48E1-462E-9992-814123063C46}" = Lenovo_ATK_Package
"{05860BD6-2B3C-4B16-A300-964403ACF13C}" = ThinkVantage GPS
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = MSN Toolbar
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Central Data
"{098122AB-C605-4853-B441-C0A4EB359B75}" = DirectXInstallService
"{0C7DE40E-7C89-4AFB-B744-846F1B582B71}" = SBITS
"{1007F41F-7D69-468E-8017-3849A5A973C2}" = ThinkVantage Technologies Welcome Message
"{10DDCDDD-9A59-4496-9371-C17F1668D433}" = Windows Live Toolbar
"{1297C681-92D7-40EF-93BF-03F66EC5105C}" = ThinkPad-Dienstprogramm 'EasyEject'
"{17CBC505-D1AE-459D-B445-3D2000A85842}" = Dienstprogramm "ThinkPad UltraNav"
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Central Tools
"{29ED20C9-5E15-4969-9279-25BF3727A3DA}" = iTunes
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Drag-to-Disc
"{2FAAD1C5-2D9D-4EDB-BCD1-FF6573986439}" = Mobile Broadband Connect
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Integrated Camera
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F963A06-7C18-4039-9789-9644B3266AE7}" = Verizon Wireless BroadbandAccess Self Activation
"{44E9D4C2-946C-4378-9354-558803C47A68}" = Client Security - Password Manager
"{461A4763-28B5-425A-AE3D-B9B54EDF0F21}" = CIB pdf brewer
"{46A84694-59EC-48F0-964C-7E76E9F8A2ED}" = ThinkVantage System für aktiven Festplattenschutz
"{4AB5764A-3894-49A2-BAA8-C4665F74CD4C}" = Registry patch to improve USB device detection on resume from sleep for Windows Vista
"{4BD295B9-0190-4C54-B08E-33A6ECA922DF}" = ThinkVantage Access Connections
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{537BF16E-7412-448C-95D8-846E85A1D817}" = Roxio Creator Small Business Edition
"{58E65E96-6649-4CBE-9382-35326D694E6F}" = MSN Toolbar Platform
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.55.01
"{61BEA823-ECAF-49F1-8378-A59B3B8AD247}" = Microsoft Default Manager
"{6280149E-EFF3-4F1B-BD43-5B7EDD6F620A}" = Ergänzung zu Lenovo Care
"{64211D43-D195-413C-A7E7-666C10B53E1F}" = Ericsson Wireless Module Core
"{65706020-7B6F-41F2-8047-FC69579E386A}" = Präsentationsdirektor
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{668ACF05-E455-4932-A2D2-5822A8206FEB}" = Camera Center
"{69333A04-5134-40A5-A055-9166A7AA1EC8}" = 
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Central Audio
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{7821C7B2-7E21-4CF3-925B-58B6A8BC6311}" = LibreOffice 3.4
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7E4C16B8-8F76-4940-8505-98E93C00BF19}" = Rescue and Recovery
"{852AFD2D-07CC-46FD-A159-671102782771}" = Intel(R) PROSet/Wireless WiFi-Software
"{8675339C-128C-44DD-83BF-0A5D6ABD8297}" = System Update
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{90FABD40-E741-446F-839D-CEAE905D63BE}" = ThinkPad Mobility Center Customization
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{986F64DC-FF15-449D-998F-EE3BCEC6666A}" = Help Center
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CECB23C-F4BC-4FDA-A306-E544A216176A}" = ThinkVantage Status Gadget
"{9F98C9F8-9B49-411C-AFB9-AF633249FA7C}" = ThinkVantage Fingerprint Software 5.8
"{A00B9A50-3090-4CFF-9CDA-82DA0BEDAA21}" = Apple Mobile Device Support
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B334D9AE-1393-423E-97C0-3BDC3360E692}" = Sonic Icons for Lenovo
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Central Copy
"{C1940CF0-E2DD-11E0-BB25-B8AC6F97B88E}" = Google Earth
"{C6FA39A7-26B1-480A-BC74-6D17531AC222}" = Access Help
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF52099A-3BEA-4C41-AEA8-1E190F04D737}" = Lenovo Care
"{D36B4583-E804-406B-9D56-F97931286C5B}" = 32 Bit HP CIO Components Installer
"{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}" = ThinkPad Energie-Manager
"{DB71210F-8314-4AE3-B7A7-EBAF85BD30E9}" = Wallpapers
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E755160F-E930-11E0-8B86-F04DA23A5C58}" = Vegas Pro 11.0
"{E7E836B8-4BDD-454F-82E6-5FEA17C83AD4}" = Message Center
"{E8A54984-9776-4283-ACE2-782BA850A1C0}" = Roxio Creator Small Business Edition
"{E9627240-E930-11E0-8690-F04DA23A5C58}" = MSVCRT Redists
"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Central Core
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F18DB86D-BC16-4E01-BCCE-63F62B931D82}" = InterVideo Register Manager
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FA62B4C2-6CFD-462F-9B59-68A730001AB3}" = Product Recovery Disc Burning Utility
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"{FE163F11-1919-4257-A280-FF5AF8DAEECB}" = ICQ Sparberater
"414DA9DB2E84AAFAD2D2715FD9BABFAB2D209FFD" = Windows Driver Package - Lenovo 1.44 (05/14/2008 1.44)
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"avast" = avast! Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"Dipmon" = Registry Patch of Enabling Device Initiated Power Management(DIPM) on SATA for Windows Vista
"FPIRPOn" = Registry patch of Changing Timing of IDLE IRP by Finger Print Driver for Windows Vista 
"Free Studio_is1" = Free Studio version 5.2.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.11.923
"G'MIC for GIMP_is1" = G'MIC for GIMP Version 1.5.0.4
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ICQToolbar" = ICQ Toolbar
"IrfanView" = IrfanView (remove only)
"Lenovo Registration" = Lenovo Registration
"Lenovo Welcome_is1" = Lenovo Welcome v1.0.24.3
"LENOVO.SMIIF" = Lenovo System Interface Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 7.0.1 (x86 de)" = Mozilla Firefox 7.0.1 (x86 de)
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"OnScreenDisplay" = Anzeige am Bildschirm
"PC-Doctor 5 for Windows" = PC-Doctor 5 für Windows
"PhotoScape" = PhotoScape
"Power Management Driver" = ThinkPad Power Management Driver for SL Series
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = ThinkPad UltraNav Driver
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"USBPMon" = Registry patch for Windows Vista USB S3 PM Enablement
"VLC media player" = VLC media player 1.1.11
"Winamp" = Winamp
"Windows Live Toolbar" = Windows Live Toolbar
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 07.11.2011 11:17:59 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 07.11.2011 11:17:59 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 56448634
 
Error - 07.11.2011 11:17:59 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 56448634
 
Error - 07.11.2011 11:18:00 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 07.11.2011 11:18:00 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 56449789
 
Error - 07.11.2011 11:18:00 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 56449789
 
Error - 07.11.2011 11:21:17 | Computer Name = Vanessas-Laptop | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung AvastSvc.exe, Version 6.0.1289.0, Zeitstempel
 0x4e6684a2, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18327, Zeitstempel 0x4cb73436,
 Ausnahmecode 0xc0000005, Fehleroffset 0x000665d6,  Prozess-ID 0x1e8, Anwendungsstartzeit
 01cc9cd7f241cc6a.
 
Error - 07.11.2011 11:40:09 | Computer Name = Vanessas-Laptop | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Users\Vanessa\Downloads\vegaspro11.0.371_64bit.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 07.11.2011 11:51:35 | Computer Name = Vanessas-Laptop | Source = Perflib | ID = 1010
Description = 
 
Error - 07.11.2011 13:21:24 | Computer Name = Vanessas-Laptop | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 13.10.2011 07:11:53 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 13.10.2011 07:13:48 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description = 
 
Error - 13.10.2011 07:14:21 | Computer Name = Vanessas-Laptop | Source = DCOM | ID = 10010
Description = 
 
Error - 13.10.2011 07:14:22 | Computer Name = Vanessas-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1000
Description = 
 
Error - 13.10.2011 07:14:23 | Computer Name = Vanessas-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 13.10.2011 07:14:27 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description = 
 
Error - 13.10.2011 07:14:57 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description = 
 
Error - 13.10.2011 07:15:27 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description = 
 
Error - 13.10.2011 07:16:32 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description = 
 
Error - 13.10.2011 07:17:02 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description = 
 
 
< End of report >
         

 

Themen zu Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche Seiten
.dll, anti-malware, antivir, appdata, automatisch, backdoor.bot, backdoor.cycbot, dateien, explorer, google, iexplore.exe, lvvm.exe, malware, malware.packer, malwarebytes, microsoft, neue, problem, proxy-server, roaming, seite, seiten, software, systemwiederherstellung, temp, troaner, trojan.agent, trojan.fakealert, vuwl web directory weiterleitung von google suchergebnissen, weiterleitung, winlogon, wpbt0.dll




Ähnliche Themen: Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche Seiten


  1. Link Klick öffnet zunächst eine Link Fremde Seite " Casino Werbung " " Siele Werbung " "Erotik Seiten " oder ähnliches!
    Plagegeister aller Art und deren Bekämpfung - 26.08.2015 (17)
  2. Windows7: Seiten springen auf Werbung um, Seiten nich zu öffnen oder schließen "Tr.Drop.Rotbrow.K.1 " und 8 weitere Viren in Quarantäne"
    Log-Analyse und Auswertung - 21.03.2015 (9)
  3. Weiterleitung nach Google Anfrage zu "ihavenet"
    Log-Analyse und Auswertung - 24.09.2013 (26)
  4. Probleme bei google-Weiterleitung, link führt zu "ihavenet.com"
    Log-Analyse und Auswertung - 24.05.2013 (8)
  5. "The document has moved. Redirecting"+"Popup unten rechts"+"Nicht alle Links anklickbar"
    Plagegeister aller Art und deren Bekämpfung - 24.10.2012 (38)
  6. Links auf Antiviren Seiten werden mit Google 404 abgefangen, Online Banking Daten "gestohlen"
    Plagegeister aller Art und deren Bekämpfung - 04.07.2012 (2)
  7. Weiterleitung bei google (bing etc.)-Suche auf falsche Seite "rocketnews.com/...."
    Plagegeister aller Art und deren Bekämpfung - 13.05.2012 (2)
  8. Suchmaschine: Weiterleitung auf falsche/andere als gewünschte Seiten "rocketnews" (Fehlleitung)
    Log-Analyse und Auswertung - 26.04.2012 (17)
  9. "abnow" Weiterleitung bei Google
    Log-Analyse und Auswertung - 15.03.2012 (13)
  10. vuwl web directory (Weiterleitung von Googlesearch Einträgen über Proxy)
    Plagegeister aller Art und deren Bekämpfung - 18.10.2011 (13)
  11. Google-Weiterleitung (meistens) auf die Webseite "goingonearth"
    Log-Analyse und Auswertung - 01.08.2011 (19)
  12. Google-Links werden auf "100ksearches.com" weitergeleitet!
    Plagegeister aller Art und deren Bekämpfung - 23.07.2011 (27)
  13. Weiterleitung von Google-Links auf z.B. "k-directory.co.uk" oder ähnliche Seiten
    Plagegeister aller Art und deren Bekämpfung - 19.11.2010 (21)
  14. Weiterleitung von Google auf andere Suchseiten (K-Directory und Co.)
    Plagegeister aller Art und deren Bekämpfung - 30.10.2010 (18)
  15. Google öffnet "falsche Links", hatte ANTIVIRUS GT
    Plagegeister aller Art und deren Bekämpfung - 18.09.2010 (18)
  16. Weiterleitung zu Ad-Seiten bei Google- und Yahoo-Links
    Log-Analyse und Auswertung - 01.05.2009 (1)
  17. Google links "gefaket" und Explorer langsam
    Plagegeister aller Art und deren Bekämpfung - 28.09.2008 (0)

Zum Thema Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche Seiten - Den letzten Schritt hab ich genau so ausgeführt wie du es beschrieben hast: Zitat: Zitat von kira 4. erneut einen Scan mit OTL : Doppelklick auf die OTL.exe Vista und - Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche Seiten...
Archiv
Du betrachtest: Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche Seiten auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.