| |
| |||||||
Log-Analyse und Auswertung: Windows Security Center: Achtung! Computer gesperrt - mich hat's auch erwischtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
04.02.2012, 03:56
| #1 |
| |  Windows Security Center: Achtung! Computer gesperrt - mich hat's auch erwischt Hallo, mich hat es beim surfen vorhin auch erwischt. Ich habe mir diesen Trojaner/Virus eingefangen der 100€ von mir haben und meine Daten löschen will. Mittlerweile bin ich im abgesicherten Modus unterwegs und habe den OTL Scan durchlaufen lassen. Ich wäre euch dankbar, wenn ihr mir weiter helfen könntet. Anbei die beiden Logfiles. OTL.txt Code:
ATTFilter OTL logfile created on: 04.02.2012 01:54:29 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = F:\Desktop Enterprise Edition N Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,97 Gb Total Physical Memory | 1,39 Gb Available Physical Memory | 70,72% Memory free 6,85 Gb Paging File | 6,29 Gb Available in Paging File | 91,78% Paging File free Paging file location(s): f:\pagefile.sys 5000 5000 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 24,32 Gb Total Space | 8,41 Gb Free Space | 34,58% Space Free | Partition Type: NTFS Drive F: | 208,47 Gb Total Space | 194,67 Gb Free Space | 93,38% Space Free | Partition Type: NTFS Computer Name: NB-SHO | User Name: *** | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - F:\Desktop\OTL.exe (OldTimer Tools) PRC - F:\APP\VideoLAN\VLC\vlc.exe () PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - F:\APP\FirefoxPortable\FirefoxPortable.exe (PortableApps.com) PRC - F:\APP\FirefoxPortable\App\Firefox\firefox.exe (Mozilla Corporation) PRC - F:\APP\FirefoxPortable\App\Firefox\plugin-container.exe (Mozilla Corporation) ========== Modules (No Company Name) ========== MOD - C:\Windows\Temp\nsfBA5B.tmp\registry.dll () MOD - C:\Windows\Temp\nsfBA5B.tmp\System.dll () MOD - C:\Windows\Temp\nsfBA5B.tmp\newadvsplash.dll () MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libvorbis_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libxml_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libtaglib_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libtheora_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libswscale_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libzip_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libwaveout_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libyuy2_i420_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libvout_wrapper_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libyuy2_i422_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libyuvp_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libugly_resampler_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libqt4_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libskins2_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libschroedinger_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libspeex_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libscaletempo_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libstream_filter_rar_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libsimple_channel_mixer_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libscale_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libstream_filter_record_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libpng_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libmp4_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libmpgatofixed32_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libplaylist_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libmono_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libmpeg_audio_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\liblibass_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\liblua_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libi420_rgb_sse2_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libi420_rgb_mmx_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libi420_rgb_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libi420_yuy2_sse2_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libhotkeys_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libi422_yuy2_sse2_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libi420_yuy2_mmx_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libi420_yuy2_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libi422_yuy2_mmx_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libi422_yuy2_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\liblpcm_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libmemcpymmxext_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libglobalhotkeys_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libi422_i420_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libgrey_yuv_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libfreetype_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libfaad_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libflac_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libfluidsynth_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libdvdnav_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libdshow_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libdtstofloat32_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libdirectx_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libdirect3d_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libdummy_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libfilesystem_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libdts_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libfake_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libdtstospdif_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libdolby_surround_decoder_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libfloat32_mixer_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libdrawable_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libavcodec_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libaout_sdl_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libblend_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libaout_directx_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libaraw_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libcdg_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libaes3_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libconverter_fixed_plugin.dll () MOD - F:\APP\VideoLAN\VLC\libvlccore.dll () MOD - F:\APP\VideoLAN\VLC\vlc.exe () MOD - F:\APP\VideoLAN\VLC\libvlc.dll () MOD - F:\APP\VideoLAN\VLC\plugins\libaccess_bd_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\liba52tofloat32_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\liba52_plugin.dll () MOD - F:\APP\VideoLAN\VLC\plugins\liba52tospdif_plugin.dll () MOD - C:\Programme\WinRAR\RarExt.dll () MOD - F:\APP\FirefoxPortable\App\Firefox\js3250.dll () MOD - F:\DATEV\PROGRAMM\B0000391\DokSchutzShExt.dll () MOD - C:\Programme\Common Files\Adobe\Shell\psicon.dll () ========== Win32 Services (SafeList) ========== SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (DATEV Update-Service) -- F:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe (DATEV eG) SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) SRV - (DVckService) -- F:\DATEV\PROGRAMM\B0000150\ScServer\DVckService.exe (DATEV eG) SRV - (SCardService) -- F:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardService.exe (DATEV eG) SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (DatevPrintService) -- F:\DATEV\PROGRAMM\B0001442\PSNTServ.exe (DATEV eG) SRV - (ScReadSpool) -- C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe (VoyagerSoft, LLC) SRV - (Apache2) -- C:\Program Files\TC\Server\xampplite\apache\bin\Apache.exe (Apache Software Foundation) ========== Driver Services (SafeList) ========== DRV - (SCR3XX2K) -- C:\Windows\System32\drivers\SCR3XX2K.sys (SCM Microsystems Inc.) DRV - (Avgtdix) -- C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.) DRV - (Avgrkx86) -- C:\Windows\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.) DRV - (Avgmfx86) -- C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.) DRV - (truecrypt) -- C:\Windows\System32\drivers\truecrypt.sys (TrueCrypt Foundation) DRV - (AVGIDSEH) -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. ) DRV - (Avgldx86) -- C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.) DRV - (vmbus) -- C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (L1E) -- C:\Windows\System32\drivers\L1E62x86.sys (Atheros Communications, Inc.) DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ironto&s={searchTerms}&f=4 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://192.168.135.64/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 81 3A 6B 5D D3 D1 CB 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2012.02.03 09:23:25 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.04 00:34:56 | 000,000,000 | ---D | M] [2012.01.21 12:58:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions [2012.01.19 10:58:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions-BackupByFirefoxPortable [2012.01.19 10:58:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions-BackupByFirefoxPortable\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2011.09.26 12:54:56 | 000,002,049 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml O1 HOSTS File: ([2011.02.22 10:35:48 | 000,001,565 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 192.168.128.1 ps1 O1 - Hosts: 192.168.128.2 ps2 O1 - Hosts: 192.168.128.3 ps3 O1 - Hosts: 192.168.135.1 tc1 O1 - Hosts: 192.168.135.2 tc2 O1 - Hosts: 192.168.135.3 tc3 O1 - Hosts: 192.168.135.5 tc5 O1 - Hosts: 192.168.135.6 tc1a O1 - Hosts: 192.168.135.12 tc12 O1 - Hosts: 192.168.135.12 kulsa-ag.finanzen O1 - Hosts: 192.168.135.12 tc-franchise-rechnungen O1 - Hosts: 192.168.135.12 dawo-rechnungen O1 - Hosts: 192.168.135.62 tc-notes-behringen O1 - Hosts: 192.168.135.80 tcfda O1 - Hosts: 192.168.135.80 pathchecker O1 - Hosts: 192.168.135.80 tcnet O1 - Hosts: 192.168.135.82 tc-script O1 - Hosts: 192.168.136.1 berlin O1 - Hosts: 192.168.136.5 polen O1 - Hosts: 192.168.136.6 esb O1 - Hosts: 192.168.136.11 hs1 O1 - Hosts: 192.168.136.12 hs2 O1 - Hosts: 192.168.136.13 hs3 O1 - Hosts: 192.168.136.21 hs1a O1 - Hosts: 9 more lines... O2 - BHO: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC) O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll (Babylon BHO) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll (facemoods.com BHO) O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Programme\DealPly\DealPlyIE.dll (DealPly Technologies Ltd) O2 - BHO: (SCardBHOEvent Class) - {AF8CD625-E04A-4A8F-A90A-0C74846C2E30} - F:\DATEV\SYSTEM\DVCCSASCardBHO002.dll (DATEV eG) O3 - HKLM\..\Toolbar: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC) O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll (Babylon Ltd.) O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll (facemoods.com) O4 - HKLM..\Run: [AUTOSTARTEXECUTE] F:\DATEV\PROGRAMM\Install\DvInesAutostartHelper.Exe (DATEV eG) O4 - HKLM..\Run: [AVG_TRAY] C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [DATEV_SCardMan] F:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardManager.exe (DATEV eG) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [DVCCSAWTSSetEntryNTE] F:\DATEV\PROGRAMM\B0000150\ScWTS\DVCCSAWTSSetEntryNTE.exe (DATEV eG) O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe (facemoods.com) O4 - HKLM..\Run: [SiPaHost] F:\DATEV\PROGRAMM\B0000398\SiPaHost.exe (DATEV eG) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.) O4 - HKCU..\Run: [vasja] C:\Windows\Temp\0.9549214043420116.exe (Orb Networks) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: datev.at ([]http is out of zone range - 5) O15 - HKCU\..Trusted Domains: datev.at ([]https is out of zone range - 5) O15 - HKCU\..Trusted Domains: datev.com ([]http is out of zone range - 5) O15 - HKCU\..Trusted Domains: datev.com ([]https is out of zone range - 5) O15 - HKCU\..Trusted Domains: datev.de ([]http is out of zone range - 5) O15 - HKCU\..Trusted Domains: datev.de ([]https is out of zone range - 5) O15 - HKCU\..Trusted Domains: datev.de ([www] http is out of zone range - 5) O15 - HKCU\..Trusted Domains: datev.de ([www] https is out of zone range - 5) O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] http is out of zone range - 5) O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] https is out of zone range - 5) O15 - HKCU\..Trusted Domains: datevstadt.de ([]http is out of zone range - 5) O15 - HKCU\..Trusted Domains: datevstadt.de ([]https is out of zone range - 5) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.20.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{013A8FF7-8AF9-4989-97B0-480E56573584}: DhcpNameServer = 192.168.2.2 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{67F7BFFF-89AD-49CA-BB75-4382641B4CA3}: DhcpNameServer = 192.168.135.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6DB33068-86F3-4364-9E99-BAA1879D6486}: DhcpNameServer = 192.168.20.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D298D99F-289F-4D9E-B82B-7C7061AE9DB6}: DhcpNameServer = 192.168.135.254 O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{17bf3180-3dd1-11e0-8e52-0026180fe28e}\Shell - "" = AutoRun O33 - MountPoints2\{17bf3180-3dd1-11e0-8e52-0026180fe28e}\Shell\AutoRun\command - "" = E:\Password.exe O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.02.04 01:52:37 | 000,584,192 | ---- | C] (OldTimer Tools) -- F:\Desktop\OTL.exe [2012.02.04 01:36:32 | 000,000,000 | ---D | C] -- F:\Desktop\Desktop-Zeug [2012.02.04 00:37:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\DDMSettings [2012.02.04 00:32:03 | 000,927,072 | ---- | C] (DivX, LLC) -- F:\Desktop\DivXInstaller_8.2.1.exe [2012.01.25 00:07:02 | 000,000,000 | ---D | C] -- F:\Desktop\Rechnung Zalando-Dateien [2012.01.19 15:14:28 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll [2012.01.19 15:14:28 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sspisrv.dll [2012.01.19 10:58:35 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Mozilla [2012.01.15 21:01:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\FullTiltPoker [2012.01.15 21:00:48 | 000,000,000 | ---D | C] -- C:\Program Files\Full Tilt Poker [2012.01.11 11:17:15 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll [2012.01.11 11:17:14 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll [2012.01.11 11:17:14 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll [2012.01.11 02:07:03 | 000,000,000 | ---D | C] -- F:\Desktop\Vortrag NGWS [2010.08.25 18:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll ========== Files - Modified Within 30 Days ========== [2012.02.04 01:52:38 | 000,584,192 | ---- | M] (OldTimer Tools) -- F:\Desktop\OTL.exe [2012.02.04 01:30:38 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.02.04 01:30:38 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.02.04 01:30:38 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.02.04 01:30:38 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.02.04 01:26:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.02.04 00:50:55 | 000,014,960 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.02.04 00:50:55 | 000,014,960 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.02.04 00:34:58 | 000,002,064 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk [2012.02.04 00:34:58 | 000,001,511 | ---- | M] () -- F:\Desktop\DivX Movies.lnk [2012.02.04 00:34:29 | 000,001,084 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk [2012.02.04 00:32:03 | 000,927,072 | ---- | M] (DivX, LLC) -- F:\Desktop\DivXInstaller_8.2.1.exe [2012.02.03 20:58:42 | 088,091,593 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm [2012.02.03 12:58:39 | 000,293,214 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm [2012.02.03 09:23:31 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2011.lnk [2012.02.01 09:55:28 | 000,249,268 | ---- | M] () -- F:\Desktop\Rekla Ex Partner 01-12.php.pdf [2012.02.01 09:52:39 | 000,189,041 | ---- | M] () -- F:\Desktop\Rekla akt Partner 01-12.php.pdf [2012.01.31 02:48:58 | 000,059,618 | ---- | M] () -- F:\Desktop\Stellenbeschreibung.pdf [2012.01.25 00:07:08 | 000,006,017 | ---- | M] () -- F:\Desktop\Rechnung Zalando.htm [2012.01.13 17:13:43 | 000,650,749 | ---- | M] () -- F:\Desktop\RV akt-LP lang.pdf [2012.01.13 17:07:49 | 000,096,800 | ---- | M] () -- F:\Desktop\RV akt-LP kurz.pdf [2012.01.13 17:04:29 | 000,095,139 | ---- | M] () -- F:\Desktop\RV Ex-LP lang.pdf [2012.01.13 16:57:12 | 000,060,397 | ---- | M] () -- F:\Desktop\RV Ex-LP kurz.pdf ========== Files Created - No Company Name ========== [2012.02.04 00:34:58 | 000,001,511 | ---- | C] () -- F:\Desktop\DivX Movies.lnk [2012.02.04 00:34:29 | 000,001,084 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk [2012.02.04 00:34:07 | 000,002,064 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk [2012.02.01 09:55:26 | 000,249,268 | ---- | C] () -- F:\Desktop\Rekla Ex Partner 01-12.php.pdf [2012.02.01 09:52:36 | 000,189,041 | ---- | C] () -- F:\Desktop\Rekla akt Partner 01-12.php.pdf [2012.01.31 02:48:56 | 000,059,618 | ---- | C] () -- F:\Desktop\Stellenbeschreibung.pdf [2012.01.25 00:07:01 | 000,006,017 | ---- | C] () -- F:\Desktop\Rechnung Zalando.htm [2012.01.13 17:13:40 | 000,650,749 | ---- | C] () -- F:\Desktop\RV akt-LP lang.pdf [2012.01.13 17:07:48 | 000,096,800 | ---- | C] () -- F:\Desktop\RV akt-LP kurz.pdf [2012.01.13 17:04:27 | 000,095,139 | ---- | C] () -- F:\Desktop\RV Ex-LP lang.pdf [2012.01.13 16:57:10 | 000,060,397 | ---- | C] () -- F:\Desktop\RV Ex-LP kurz.pdf [2011.09.14 07:20:31 | 000,098,304 | ---- | C] () -- C:\Windows\System32\redmonnt.dll [2011.06.07 07:18:39 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2011.05.03 08:33:56 | 000,004,096 | -H-- | C] () -- C:\Users\***\AppData\Local\keyfile3.drm [2011.03.18 09:52:45 | 000,000,021 | ---- | C] () -- C:\Windows\DvInesKurusOleServer003.INI [2011.03.18 09:51:36 | 000,000,088 | ---- | C] () -- C:\Windows\dvinesinstalllocation001.INI [2011.03.18 09:51:35 | 000,000,088 | ---- | C] () -- C:\Windows\dvinesinstart001.INI [2011.03.18 09:49:25 | 000,000,089 | ---- | C] () -- C:\Windows\Startup.INI [2011.02.23 13:23:49 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe [2011.02.23 13:22:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2010.08.25 19:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin [2010.08.25 19:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin [2010.08.25 19:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin [2010.08.25 18:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config [2010.08.25 18:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll [2010.08.25 18:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll [2009.09.17 14:07:34 | 000,038,496 | ---- | C] () -- C:\Windows\System32\JNILibrary.dll [2009.09.17 14:07:26 | 000,112,224 | ---- | C] () -- C:\Windows\System32\INetCert.dll [2009.09.01 01:11:21 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2009.09.01 01:11:21 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2009.09.01 01:11:21 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2009.09.01 01:11:21 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2009.07.14 05:55:27 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 05:02:04 | 000,472,376 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2009.07.14 03:05:48 | 000,615,810 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2009.07.14 03:05:48 | 000,106,190 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.07.13 23:09:19 | 000,139,824 | ---- | C] () -- C:\Windows\System32\igfcg500.bin [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat < End of report > Code:
ATTFilter OTL Extras logfile created on: 04.02.2012 01:54:29 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = F:\Desktop
Enterprise Edition N Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,97 Gb Total Physical Memory | 1,39 Gb Available Physical Memory | 70,72% Memory free
6,85 Gb Paging File | 6,29 Gb Available in Paging File | 91,78% Paging File free
Paging file location(s): f:\pagefile.sys 5000 5000 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 24,32 Gb Total Space | 8,41 Gb Free Space | 34,58% Space Free | Partition Type: NTFS
Drive F: | 208,47 Gb Total Space | 194,67 Gb Free Space | 93,38% Space Free | Partition Type: NTFS
Computer Name: NB-SHO | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "F:\APP\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "F:\APP\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 24
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5FCFEBE0-EBDA-42A5-BC6E-67B94A47D6F0}" = kobdfu x64x86 driver installation
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{735DEB9C-61BD-4D31-994B-92395BBB4E45}" = Microsoft XML Parser
"{73AA12E1-5FFD-4545-9A28-CE7C318F284E}" = AVG 2011
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9BC76CCE-A9EC-4A3A-9B51-D823805E1D1F}" = SolidConverterPDF
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{E533E637-FB3E-4F28-8B18-449CC9AB7235}" = AVG 2011
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"AVG" = AVG 2011
"BabylonToolbar" = Babylon toolbar on IE
"CCleaner" = CCleaner
"DATEVB00000482.0" = DATEV Installation V.2.8
"DealPly" = DealPly
"DivX Setup" = DivX-Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"facemoods" = Facemoods Toolbar
"InfraRecorder" = InfraRecorder
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"RealPlayer 12.0" = RealPlayer
"TrueCrypt" = TrueCrypt
"UTAX TA Product Library" = UTAX TA Product Library
"VLC media player" = VLC media player 1.1.11
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FoxTab PDF Converter" = FoxTab PDF Converter
"FoxTab PDF Creator" = FoxTab PDF Creator
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 03.02.2012 20:12:57 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
Error - 03.02.2012 20:12:57 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
Error - 03.02.2012 20:12:57 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
Error - 03.02.2012 20:12:57 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 13
Description =
Error - 03.02.2012 20:13:42 | Computer Name = NB-SHO | Source = VSS | ID = 8193
Description =
[ OSession Events ]
Error - 04.07.2011 05:57:19 | Computer Name = NB-SHO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 3460 seconds with 1860 seconds of active time. This session ended with a
crash.
Error - 04.07.2011 07:04:42 | Computer Name = NB-SHO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 1105 seconds with 240 seconds of active time. This session ended with a
crash.
Error - 04.07.2011 08:16:59 | Computer Name = NB-SHO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 4210 seconds with 180 seconds of active time. This session ended with a
crash.
[ System Events ]
Error - 23.12.2011 04:56:19 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
Fehlercode lautet 0x8009001d. Der interne Fehlerstatus ist 10014.
Error - 23.12.2011 04:56:19 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10003.
Error - 23.12.2011 04:56:20 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
Fehlercode lautet 0x8009001d. Der interne Fehlerstatus ist 10014.
Error - 23.12.2011 04:56:20 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10003.
Error - 23.12.2011 04:56:21 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
Fehlercode lautet 0x8009001d. Der interne Fehlerstatus ist 10014.
Error - 23.12.2011 04:56:21 | Computer Name = NB-SHO | Source = Schannel | ID = 36870
Description = Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der
Anmeldeinformationen Client für SSL. Der vom kryptografischen Modul zurückgegebene
Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10003.
Error - 01.01.2012 15:32:36 | Computer Name = NB-SHO | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?29.?12.?2011 um 01:17:25 unerwartet heruntergefahren.
Error - 01.01.2012 15:45:06 | Computer Name = NB-SHO | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?01.?01.?2012 um 20:39:14 unerwartet heruntergefahren.
Error - 01.01.2012 16:00:15 | Computer Name = NB-SHO | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
Firmware verfügbar ist.
Error - 02.01.2012 03:01:47 | Computer Name = NB-SHO | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?02.?01.?2012 um 01:08:21 unerwartet heruntergefahren.
< End of report >
Viele Grüße und noch ein schönes Wochenende... |
| Themen zu Windows Security Center: Achtung! Computer gesperrt - mich hat's auch erwischt |
| achtung!, adobe, adobe flash player, babylon, babylon toolbar, babylontoolbar, browser, computer, daten löschen, dealply, defender, error, excel.exe, explorer, fehler, flash player, format, foxtab pdf converter, gesperrt, helper, helper.exe, install.exe, langs, löschen, microsoft, microsoft office word, mozilla, object, pdf creator, photoshop, plug-in, programme, rundll, scan, security, security update, software, surfen, temp, trojaner/virus, webcheck, windows, wrapper |
Baum-Darstellung