Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert"

Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert"


Plagegeister aller Art und deren Bekämpfung: Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert"

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 31.07.2012, 17:37   #1
musiker
 
Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert" - Standard

Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert"


Hallo,

ich habe mir leider heute morgen auch einen Verschlüsselungstrojaner eingefangen. Dabei handelt es sich um die Österreich Version mit dem Wortlaut:

"der computer ist für die verletzung der gesetze der republik österreich blockiert worden"


Ich habe einen Vollscan mit Malwarebytes Anti-Malware durchgeführt.
Weiters habe ich dann mit OTL einen Systemscan durchgeführt.

Hier die Ergebnisse der Scans:


Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.31.05

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Daniel :: *****-PC [Administrator]

Schutz: Deaktiviert

31.07.2012 12:29:09
mbam-log-2012-07-31 (12-29-09).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 625090
Laufzeit: 1 Stunde(n), 48 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|TsUsbRedirectionGroupPolicyExtension (Trojan.Cridex) -> Daten: C:\Users\Daniel\AppData\Local\Microsoft\Windows\4551\TsUsbRedirectionGroupPolicyExtension.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 9
C:\Users\Daniel\AppData\Local\Microsoft\Windows\4551\TsUsbRedirectionGroupPolicyExtension.exe (Trojan.Cridex) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Daniel\Desktop\Fifa Manager 11-RELOADED-crack\Fifa Manager 11-RELOADED-crack\activation.exe (Malware.Packer.gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows.old\Program Files\Adobe\Adobe Audition 3.0\PATCH.exe (PUP.Hacktool.Patcher) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows.old\Users\hp\Desktop\ADOBEAUDITION\Crack\PATCH.exe (PUP.Hacktool.Patcher) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows.old\Users\hp\Desktop\sibelius3\KeyGen\Sibelius 3.1.2 KeyGen Registrierung.exe (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows.old\Users\hp\Desktop\Stick Carina 2011-08-16\REST\Neuer Ordner\sonstiges\AutoCAD 2009 Architectue\Autodesk AutoCAD Architecture 2009 (KEYGEN)\Crack\XF-ACADA2k9-32bit-KG.exe (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows.old\Users\hp\Downloads\ddlwarez____goldyswingtimclubfiagragermanxxxdvdripxvidwlc.exe (PUP.Adware.MediaGet) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows.old\Users\hp\Downloads\iLividSetupV1 (2).exe (Affiliate.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows.old\Users\hp\Downloads\iLividSetupV1 (4).exe (Affiliate.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Otl Ergebnis:


OTL logfile created on: 31.07.2012 16:54:47 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Daniel\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy

2,96 Gb Total Physical Memory | 2,53 Gb Available Physical Memory | 85,21% Memory free
6,12 Gb Paging File | 5,87 Gb Available in Paging File | 95,91% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 101,61 Gb Free Space | 34,09% Space Free | Partition Type: NTFS

Computer Name: DANIEL-PC | User Name: Daniel | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Daniel\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Flexera Software, Inc.)
SRV - (PassThru Service) -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe ()
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (Autodesk Content Service) -- C:\Programme\Autodesk\Content Service\Connect.Service.ContentService.exe ()
SRV - (IAANTMON) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (Microsoft Office Groove Audit Service) -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (YahooAUService) -- C:\Programme\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (AEADIFilters) -- C:\Windows\System32\AEADISRV.EXE (Andrea Electronics Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (UIUSys) -- system32\DRIVERS\UIUSYS.SYS File not found
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (cpuz130) -- C:\Users\Daniel\AppData\Local\Temp\cpuz130\cpuz_x32.sys File not found
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (hpdskflt) -- C:\Windows\System32\drivers\hpdskflt.sys (Hewlett-Packard Company)
DRV - (Accelerometer) -- C:\Windows\System32\drivers\Accelerometer.sys (Hewlett-Packard Company)
DRV - (htcnprot) -- C:\Windows\System32\drivers\htcnprot.sys (Windows (R) Win 7 DDK provider)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (e1yexpress) -- C:\Windows\System32\drivers\e1y6032.sys (Intel Corporation)
DRV - (NETw5v32) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (HBtnKey) -- C:\Windows\System32\drivers\CPQBTTN.sys (Hewlett-Packard Company)
DRV - (rismc32) -- C:\Windows\System32\drivers\rismc32.sys (RICOH Company, Ltd.)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (HTCAND32) -- C:\Windows\System32\drivers\ANDROIDUSB.sys (HTC, Corporation)
DRV - (HpqKbFiltr) -- C:\Windows\System32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (EC168BDA) -- C:\Windows\System32\drivers\EC168BDA.sys (e3C, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at
IE - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5E 97 47 67 ED 6E CD 01 [binary data]
IE - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>
IE - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 46.19.143.93:80

========== FireFox ==========



FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Daniel\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Daniel\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Daniel\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.14 18:24:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.19 11:29:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.09 08:50:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.07.25 10:59:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.19 11:29:11 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.09 08:50:35 | 000,000,000 | ---D | M]

[2012.01.20 16:46:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniel\AppData\Roaming\mozilla\Extensions
[2012.05.18 10:44:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniel\AppData\Roaming\mozilla\Firefox\Profiles\uqjxdk7z.default\extensions
[2012.05.18 10:44:01 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Daniel\AppData\Roaming\mozilla\Firefox\Profiles\uqjxdk7z.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012.05.02 20:05:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.01.27 19:37:28 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.06.19 11:29:11 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.05.02 20:04:55 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.05.02 20:04:55 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.05.02 20:04:55 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.02 20:04:55 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.02 20:04:55 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.02 20:04:55 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

========== Chrome ==========

CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie= {inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Daniel\AppData\Local\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Daniel\AppData\Local\Google\Chrome\Application\20.0.1132.57\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Daniel\AppData\Local\Google\Chrome\Application\20.0.1132.57\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Daniel\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Marlies Dekkers = C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fepnljgdbelppefncogilfbjikmnbhjm\2_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [ApplyEsf-eDocPrintPro] C:\Program Files\Common Files\MAYComputer\eDocPrintPro\ApplyEsf.exe (May Software)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\soundmax.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000..\Run: [Akamai NetSession Interface] C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000..\Run: [DetectTray] C:\Programme\DVBT\DetectTray.exe ()
O4 - HKU\S-1-5-21-2693753266-4196873943-3087956277-1000..\Run: [Messenger (Yahoo!)] C:\Programme\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3E2F05E9-C828-4FE0-9EC2-982915891D11}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7E735D49-66F2-4214-A4ED-3907D9A0F6BF}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB8F8030-5C77-4694-92DB-757D3616962F}: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.01.19 20:39:01 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{00d26423-42cf-11e1-a41f-002186c4180d}\Shell - "" = AutoRun
O33 - MountPoints2\{00d26423-42cf-11e1-a41f-002186c4180d}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{60d1af51-4124-11e1-b809-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{60d1af51-4124-11e1-b809-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Setup.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.31 10:56:14 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Malwarebytes
[2012.07.31 10:56:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.31 10:56:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.31 10:56:03 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.07.31 10:56:03 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.07.31 10:54:26 | 010,652,120 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Daniel\Desktop\mbam-setup-1.62.0.1300.exe
[2012.07.31 10:49:04 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\Daniel\Desktop\OTL.exe
[2012.07.31 09:39:50 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\hellomoto
[2012.07.31 09:06:48 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{332E70F3-550B-46B4-8B96-96ABCBC70FBA}
[2012.07.30 17:13:52 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{A2192A1C-B037-4661-A498-6028881AEF47}
[2012.07.30 17:13:42 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{504A7659-92F4-4A1C-A141-918561A8097D}
[2012.07.30 07:57:55 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{401D151C-430A-4637-8D35-67712AB53FAE}
[2012.07.29 19:46:27 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{B91ACA73-CA86-4216-9CBE-47203F863174}
[2012.07.29 19:46:16 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{E102F91D-A895-4258-803E-8F4BCEC2F507}
[2012.07.28 18:19:11 | 000,000,000 | ---D | C] -- C:\Users\Daniel\Desktop\Alben Hauermarkt
[2012.07.28 12:16:07 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{91042788-63D5-485D-BC96-6946B668B494}
[2012.07.28 12:15:56 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{AEA9B575-1E33-403B-9E7F-DDC9ACD4F785}
[2012.07.27 08:36:50 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{EE7FF9A3-3423-483D-9CAE-267DD11ED16F}
[2012.07.27 08:36:38 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{EE891498-E050-4A15-9E2E-3AE39F854656}
[2012.07.26 08:37:25 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{369D82B3-79BC-4100-9E42-FAD1AFC0DCD7}
[2012.07.26 08:37:15 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{42A6BB75-E224-4E3E-B52F-14A81E3F9825}
[2012.07.25 10:59:31 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Thunderbird
[2012.07.25 10:59:31 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\Thunderbird
[2012.07.25 10:59:24 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2012.07.25 08:56:20 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{E6789066-5654-4EE2-804A-DCDF4885B7AB}
[2012.07.25 08:56:08 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{78B26F97-B192-4095-A1B0-00172672139E}
[2012.07.24 12:48:08 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Unity
[2012.07.24 12:39:35 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\Unity
[2012.07.24 09:25:32 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{B94E117F-5DCC-428E-A013-9B5FB1FC8B21}
[2012.07.24 09:25:22 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{24551577-C59B-402E-9CDD-78546C29E81D}
[2012.07.23 16:08:24 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\HappyFoto-Designer
[2012.07.23 16:07:54 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_33.dll
[2012.07.23 16:07:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HappyFoto-Designer
[2012.07.23 16:06:32 | 000,000,000 | ---D | C] -- C:\ProgramData\HappyFoto-Designer
[2012.07.23 16:06:30 | 000,000,000 | ---D | C] -- C:\Program Files\HappyFoto-Designer
[2012.07.23 08:09:06 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{F9B644F9-FCF7-4119-9923-A92F375325E7}
[2012.07.23 08:08:55 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{81F09520-50BD-412A-9006-36CFBC709D79}
[2012.07.22 15:58:33 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{85E4682D-9F78-4842-AF09-358629E0E544}
[2012.07.22 15:58:22 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{F2E0B744-55A1-4D41-916D-9A920E9EEEDB}
[2012.07.21 16:38:24 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{78E4EEFA-5B20-4C49-8CF5-EDCFA629D810}
[2012.07.21 16:38:04 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{1C94F6B5-708B-4D4C-8DB0-FC459214517F}
[2012.07.20 10:03:15 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{BB099147-201C-4642-9BEB-42F598002ADE}
[2012.07.20 10:03:04 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{BC89E061-4898-4B51-A90D-F0E51E78FE68}
[2012.07.19 07:50:23 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{1D819CB3-42E9-43F0-AB98-F43A07879FF1}
[2012.07.19 07:50:03 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{04792ECD-ACD6-4C2E-A2CB-7EEEB3711D6F}
[2012.07.18 21:41:55 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{0EC46607-EF3C-432A-A53B-D7497640D6BC}
[2012.07.18 07:37:04 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{48371485-5888-41B6-AA12-BD1E85DFCAE8}
[2012.07.18 07:36:54 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{C57AC64E-A3BF-49AC-9F24-1541C8CC062B}
[2012.07.17 13:07:58 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{D6F52957-081E-481A-81AF-90B4DAF79C12}
[2012.07.16 10:02:03 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{495308C5-4555-4022-8309-E90E5FF92F7A}
[2012.07.16 10:01:38 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{00B97890-D469-4DDC-A423-49440867447C}
[2012.07.14 13:56:03 | 002,047,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.07.14 13:55:52 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{A41FFD56-C809-4B3C-B4FC-48BF0CC7BFF8}
[2012.07.14 13:55:24 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{CFA9FA5A-3CBD-4D78-ADAE-100D064F9607}
[2012.07.14 13:51:52 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.07.14 13:51:51 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.07.14 13:51:51 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.07.14 13:51:51 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.07.14 13:51:50 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.07.14 13:51:50 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.07.14 13:51:50 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.07.13 21:01:32 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.07.13 20:51:11 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{769BDD22-F308-4107-B7DC-2B5D37920115}
[2012.07.13 20:51:01 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{8770C210-F4ED-4DE2-93B7-4B97716A86BD}
[2012.07.07 11:21:45 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{BAB51CD5-4293-4B9A-BD2C-661DBCA398E5}
[2012.07.07 11:21:28 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{CDF673D2-DA08-47A2-9D2A-6A06B65EDD22}
[2012.07.06 13:18:08 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{64983DBD-1196-499A-A95E-562A5E5EE40B}
[2012.07.06 13:17:58 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{653CAFF9-6F50-4040-B3CC-C93B2104EA00}
[2012.07.06 12:40:51 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{4F59963C-8AE5-4BAD-8BB9-9D0F11C798CB}
[2012.07.05 12:20:58 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{0A982BA3-071B-4DC8-8C62-C45F253ED671}
[2012.07.05 12:20:48 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{B370AECB-038D-474B-AB8D-0196F6FA2D33}
[2012.07.04 08:59:28 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{A529BE3C-300B-47FA-95B8-91E43D56E836}
[2012.07.04 08:59:18 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{BEDCF2D9-8BAA-4805-917E-86078EB9665E}
[2012.07.03 10:07:51 | 000,000,000 | ---D | C] -- C:\Program Files\Browser Mouse
[2012.07.03 09:33:59 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{57C7F431-0172-4F46-8079-1F9BFD794ABF}
[2012.07.03 09:33:48 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{4CC6BE6A-3102-482E-B3D4-73EA9534DEDC}
[2012.07.02 08:15:18 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{2D1E7D18-BD48-4403-AC51-09C1135137A0}
[2012.07.02 08:15:08 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\{90474B4A-3470-48A1-B616-7B7FA422E11D}

========== Files - Modified Within 30 Days ==========

[2012.07.31 16:52:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.31 12:23:58 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.31 12:23:57 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.31 11:06:05 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.07.31 10:56:04 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.31 10:52:56 | 010,652,120 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Daniel\Desktop\mbam-setup-1.62.0.1300.exe
[2012.07.31 10:27:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2693753266-4196873943-3087956277-1000UA.job
[2012.07.31 10:27:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2693753266-4196873943-3087956277-1000Core.job
[2012.07.30 19:02:49 | 286,211,588 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.07.26 23:20:24 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Daniel\Desktop\OTL.exe
[2012.07.25 10:59:26 | 000,001,790 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2012.07.25 10:10:46 | 000,050,560 | ---- | M] () -- C:\Users\Daniel\Documents\ny.jpg
[2012.07.24 20:47:43 | 000,016,896 | ---- | M] () -- C:\Users\Daniel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.24 20:05:55 | 000,688,882 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.24 20:05:55 | 000,646,704 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.24 20:05:55 | 000,151,878 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.24 20:05:55 | 000,124,460 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.14 18:16:36 | 000,442,152 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.13 21:24:46 | 000,002,047 | ---- | M] () -- C:\Users\Daniel\Desktop\Google Chrome.lnk
[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2012.07.31 10:56:04 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.25 10:59:26 | 000,001,802 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
[2012.07.25 10:59:26 | 000,001,790 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2012.07.25 10:10:42 | 000,050,560 | ---- | C] () -- C:\Users\Daniel\Documents\ny.jpg
[2012.07.03 10:07:51 | 000,006,205 | ---- | C] () -- C:\Windows\System32\LWBHMVXD.VXD
[2012.04.24 10:26:49 | 000,004,096 | -H-- | C] () -- C:\Users\Daniel\AppData\Local\keyfile3.drm
[2012.02.17 17:43:33 | 000,159,462 | ---- | C] () -- C:\Windows\hpwins06.dat
[2012.02.17 17:43:33 | 000,001,756 | ---- | C] () -- C:\Windows\hpwmdl06.dat
[2012.01.23 11:55:59 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2012.01.23 11:55:59 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2012.01.23 11:55:19 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012.01.23 11:55:05 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.01.20 22:23:45 | 000,016,896 | ---- | C] () -- C:\Users\Daniel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.01.19 21:13:09 | 000,000,147 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2012.01.16 05:30:44 | 000,688,882 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2012.01.16 05:30:44 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2012.01.16 05:30:44 | 000,151,878 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2012.01.16 05:30:44 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2012.01.15 20:52:40 | 000,000,680 | ---- | C] () -- C:\Users\Daniel\AppData\Local\d3d9caps.dat
[2012.01.15 20:44:25 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat

========== LOP Check ==========

[2012.01.19 21:42:25 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\Autodesk
[2012.06.26 16:58:20 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\DAEMON Tools Lite
[2012.05.03 18:01:21 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\Foxit Software
[2012.07.31 09:40:04 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\hellomoto
[2012.01.24 17:47:35 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\Hewlett Packard
[2012.01.17 17:39:15 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\Hewlett Packard Company
[2012.02.19 20:30:31 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\HTC
[2012.02.19 20:27:20 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012.02.19 20:29:09 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\Outlook
[2012.07.25 10:59:31 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\Thunderbird
[2012.07.24 12:48:08 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\Unity
[2012.07.31 11:06:05 | 000,032,606 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >


OTL Ergebnis 2. Datei:


OTL Extras logfile created on: 31.07.2012 16:54:47 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Daniel\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy

2,96 Gb Total Physical Memory | 2,53 Gb Available Physical Memory | 85,21% Memory free
6,12 Gb Paging File | 5,87 Gb Available in Paging File | 95,91% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 101,61 Gb Free Space | 34,09% Space Free | Partition Type: NTFS

Computer Name: DANIEL-PC | User Name: Daniel | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2693753266-4196873943-3087956277-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C38C015-37E0-4194-98B7-2D880C79DAED}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{14780468-3C89-4990-B6B4-6FA5CCBEC13D}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{20EB75FB-8C96-4CC7-B5C1-C4D514038360}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{3E0A8BD0-A0E4-4CFF-A107-E4E7183183E4}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe |
"{B56CA375-A19F-4ABD-B3A2-FB51C741AEF7}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{E23F3951-A94E-43AE-8B86-F29658EAA3B9}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{247463AB-30CA-47F8-BA9C-EBFCA811CA80}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{533A7ADE-66E6-41E7-9803-4C2355228CF4}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{6B78597B-E731-419D-A9C0-2B932B22E879}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{7D122547-936C-46F2-8ADE-4684E2ECD814}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{8A6EA792-4436-4D15-942D-8B76A6DE50D2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8EADCAAA-C39A-4616-939D-E6BDB94C948D}" = protocol=17 | dir=in | app=c:\program files\htc\htc sync 3.0\htcupctloader.exe |
"{D4C448D6-C459-427B-9070-708209DA9A7F}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{EF23A7F4-CC7E-4CD7-9766-FC7C8BD42BC4}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{F4671C29-F002-4B93-851C-19FE1932BC84}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{F8E7A3E9-0ADD-4238-A481-1447772149EF}" = protocol=6 | dir=in | app=c:\program files\htc\htc sync 3.0\htcupctloader.exe |
"{FB58E92D-D12D-4432-B741-9BB26A09B4EC}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"TCP Query User{07B3D08D-84CD-4E55-91D2-1695FACEE085}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"TCP Query User{7CEAB728-984C-4207-881E-F88D73745C09}C:\users\daniel\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\daniel\appdata\local\akamai\netsession_win.exe |
"UDP Query User{F022A7E9-05F8-49B5-8330-CB8E0D5D27CE}C:\users\daniel\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\daniel\appdata\local\akamai\netsession_win.exe |
"UDP Query User{FABFB124-00F3-4CC4-A192-1A96F0832F7D}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01339AE5-04D4-43F8-008E-13AD788DC4F7}" = SimCity 4
"{014CF29F-D3C0-4303-B3E9-CA10AD1E6085}" = Dlubal-Anwendungen RSTAB
"{086F9A69-CD39-4893-A9FB-D3A0634CE3F7}" = Autodesk Content Service
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{115C3431-11CA-4917-B498-4CA1FF2AD06D}" = DVBT Driver
"{154E4F71-DFC0-4B31-8D99-F97615031B02}" = HP Webcam Application
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{240556C4-80D1-465F-81D8-E0B9D108548A}" = 5300_5400_Help
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{324CEC09-007A-48eb-90E0-9D42D4D5EB0A}" = NetDeviceManager
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5783F2D7-A001-0407-0002-0060B0CE6BBA}" = AutoCAD 2012 - Deutsch
"{5783F2D7-A001-0407-1002-0060B0CE6BBA}" = AutoCAD 2012 Language Pack - Deutsch
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{65420DC9-306E-4371-905F-F4DC3B418E52}" = Autodesk Material Library Base Resolution Image Library 2012
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7668700F-1E1D-4E37-A7AE-29DFA7BE4B8F}" = eDocPrintPro v3.17.4
"{77B3331C-1644-4C9E-9F1C-7D2A5517102E}" = BPDSoftware_Ini_CCR_Vista
"{7A3FFA58-876F-489C-B6CF-0503916224DF}" = HTC Sync
"{7ABD82AD-E13E-4673-A450-0890D43C8F9D}" = MPM
"{7F3AD00A-1819-4B15-BB7D-08B3586336D7}" = 3DMark06
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F0837C2-EE09-4903-88F3-1976FE7FFF4E}" = Autodesk Material Library 2012
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}" = FARO LS 1.1.406.58
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}" = HP Wireless Assistant
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F238A60-C445-4B81-8EDE-07DC924E98F8}" = HP MULTIPLE MODEM INSTALLER for VISTA
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3D5974C-59EC-486C-8654-20339CBDE698}" = Outlook Tools
"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AD277ED4-7E41-4074-911D-D34AF41B9D49}" = HP Officejet Pro K5300/5400 Series
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 276.21
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 276.21
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 136.02
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B40DCEFF-9B7B-4c36-B4FA-6CE7EABFB4B8}" = K5400
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{CDC4FC15-480C-49C1-85DA-1CFBBFC6CD08}" = DVBT
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D49EE5B7-1AEB-49C9-B77D-4AEE7249F505}" = BPD_HPSU
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E552C39C-C70E-464F-9733-8311331BDD90}" = Autodesk Inventor Fusion Plugin Language Pack for AutoCAD 2012
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E630D30A-79EE-407A-8F51-9D57D1F45230}" = gs_x86
"{EAB3AC1A-68FF-486B-9C6B-E48EBB4B05CC}" = Autodesk Inventor Fusion Plugin for AutoCAD 2012
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{ECAD4F6A-0BF3-4028-9C81-E5D9F9606CBA}" = BPDSoftware
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F1D7AC58-554A-4A58-B784-B61558B1449A}" = QLBCASL
"{F36ACF30-DF9F-4F5C-8445-DF9B16C072B3}" = ESU for Microsoft Vista SP1
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F5CC2EF8-20A4-4366-A681-3FE849E65809}" = RICOH Media Driver
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA0CE30A-B8EF-4b6b-85BF-D2B2C354A32C}" = ProductContext
"{FBA70FCC-BD23-4120-BA30-3E0DDF66AE82}" = 5300_5400_Readme
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"{FFF5619F-6669-4EC5-A85E-9994F70A9E5D}" = Autodesk Inventor Fusion 2012
"{FFF7F80F-929E-497F-A112-B070DE816128}" = Autodesk Inventor Fusion 2012 Language Pack
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"AutoCAD 2012 - Deutsch" = AutoCAD 2012 - Deutsch
"Autodesk Inventor Fusion 2012" = Autodesk Inventor Fusion 2012
"Autodesk Inventor Fusion Plugin for AutoCAD 2012" = Autodesk Inventor Fusion plug-in for AutoCAD 2012
"Avira AntiVir Desktop" = Avira Free Antivirus
"DAEMON Tools Lite" = DAEMON Tools Lite
"DivX Setup" = DivX-Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Foxit Reader_is1" = Foxit Reader
"HappyFoto-Designer_is1" = HappyFoto-Designer 4.5
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"InstallShield_{115C3431-11CA-4917-B498-4CA1FF2AD06D}" = DVBT Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"OpenAL" = OpenAL
"PROSet" = Intel(R) Network Connections Drivers
"SopCast" = SopCast 3.5.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 1.1.11
"WinLiveSuite" = Windows Live Essentials
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2693753266-4196873943-3087956277-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"Akamai" = Akamai NetSession Interface
"Google Chrome" = Google Chrome
"UnityWebPlayer" = Unity Web Player

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 31.07.2012 04:35:32 | Computer Name = Daniel-PC | Source = WinMgmt | ID = 10
Description =

Error - 31.07.2012 04:42:13 | Computer Name = Daniel-PC | Source = WinMgmt | ID = 10
Description =

Error - 31.07.2012 04:48:26 | Computer Name = Daniel-PC | Source = EventSystem | ID = 4609
Description =

Error - 31.07.2012 04:48:58 | Computer Name = Daniel-PC | Source = WinMgmt | ID = 10
Description =

Error - 31.07.2012 05:03:02 | Computer Name = Daniel-PC | Source = WinMgmt | ID = 10
Description =

Error - 31.07.2012 05:08:53 | Computer Name = Daniel-PC | Source = EventSystem | ID = 4609
Description =

Error - 31.07.2012 05:09:12 | Computer Name = Daniel-PC | Source = WinMgmt | ID = 10
Description =

Error - 31.07.2012 06:27:10 | Computer Name = Daniel-PC | Source = EventSystem | ID = 4609
Description =

Error - 31.07.2012 06:27:53 | Computer Name = Daniel-PC | Source = WinMgmt | ID = 10
Description =

Error - 31.07.2012 10:52:51 | Computer Name = Daniel-PC | Source = EventSystem | ID = 4609
Description =

[ System Events ]
Error - 31.07.2012 06:27:00 | Computer Name = Daniel-PC | Source = DCOM | ID = 10005
Description =

Error - 31.07.2012 06:27:09 | Computer Name = Daniel-PC | Source = DCOM | ID = 10005
Description =

Error - 31.07.2012 06:27:49 | Computer Name = Daniel-PC | Source = DCOM | ID = 10005
Description =

Error - 31.07.2012 06:27:54 | Computer Name = Daniel-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 31.07.2012 06:27:54 | Computer Name = Daniel-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 31.07.2012 10:52:42 | Computer Name = Daniel-PC | Source = DCOM | ID = 10005
Description =

Error - 31.07.2012 10:52:51 | Computer Name = Daniel-PC | Source = DCOM | ID = 10005
Description =

Error - 31.07.2012 10:53:30 | Computer Name = Daniel-PC | Source = DCOM | ID = 10005
Description =

Error - 31.07.2012 10:53:37 | Computer Name = Daniel-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 31.07.2012 10:53:37 | Computer Name = Daniel-PC | Source = Service Control Manager | ID = 7026
Description =


< End of report >


Ich hoffe ihr könnt mir weiterhelfen. Was ist nun der weiter Lösungsweg, um meinen PC wieder "gesund" zu bekommen?

Vielen Dank schonmal im voraus.

Alt 31.07.2012, 17:59   #2
markusg
/// Malware-holic
 
Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert" - Standard

Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert"


hi
für eine weitere analyse benötige ich mal folgendes.
c:\Users\name\AppData\LocalLow\Sun\Java\Deployment\cache
dort rechtsklick auf den ordner cache, diesen mit winrar oder einem anderen programm packen, und im upload channel hochladen bitte
Trojaner-Board Upload Channel
wenn dies erledigt ist, bittemelden.
__________________

__________________
Alt 31.07.2012, 18:15   #3
musiker
 
Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert" - Standard

Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert"


Habe diesen Ordner gezippt und hochgeladen.
__________________
Alt 01.08.2012, 19:59   #4
markusg
/// Malware-holic
 
Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert" - Standard

Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert"


C:\Users\Daniel\Desktop\Fifa Manager 11-RELOADED-crack\Fifa Manager 11-RELOADED-crack\activation.exe (Malware.Packer.gen) -> Erfolgreich gelöscht und in
Quarantäne gestellt.
C:\Windows.old\Program Files\Adobe\Adobe Audition 3.0\PATCH.exe (PUP.Hacktool.Patcher) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows.old\Users\hp\Desktop\ADOBEAUDITION\Crack\PATCH.exe (PUP.Hacktool.Patcher) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows.old\Users\hp\Desktop\sibelius3\KeyGen\Sibelius 3.1.2 KeyGen Registrierung.exe (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne
gestellt.
C:\Windows.old\Users\hp\Desktop\Stick Carina 2011-08-16\REST\Neuer Ordner\sonstiges\AutoCAD 2009 Architectue\Autodesk AutoCAD Architecture 2009 (KEYGEN)\Crack\XF-ACADA2k9-32bit-KG.exe
(RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.

die verwendung von keygens ist illegal, dies unterstützen wir nicht, da gibts nur hilfe beim neu aufsetzen:
der pc muss neu aufgesetzt und dann abgesichert werden
1. Datenrettung:2. Formatieren, Windows neu instalieren:3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
ich werde außerdem noch weitere punkte dazu posten.
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Antwort

Themen zu Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert"
32 bit, 7-zip, affiliate.downloader, akamai, application/pdf:, autorun, avira, bho, blockiert, browser, computer, der computer ist für die verletzung, desktop, error, firefox, flash player, format, helper, homepage, install.exe, keygen, langs, logfile, object, office 2007, officejet, plug-in, pup.adware.mediaget, registry, republik österreich, rundll, security, senden, software, stick, svchost.exe, trojan.cridex, vista, windows.old


« Polizeivirus Österreich v. 29.07.2012 | TR/Crypt.XPACK.Gen5 »


Ähnliche Themen: Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert"


  1. Polizei (Österreich) Control Department "Ihr Computer ist gesperrt"
    Plagegeister aller Art und deren Bekämpfung - 26.03.2013 (12)
  2. BKA TROJANER: Der Computer ist für die Verletzung der Gesetze der Republik Österreich blockiert worden
    Plagegeister aller Art und deren Bekämpfung - 17.10.2012 (3)
  3. BKA TROJANER _ Der Computer ist für die Verletzung der Gesetze der Republik Österreich blockiert worden
    Log-Analyse und Auswertung - 26.09.2012 (2)
  4. Der Computer ist für die Verletzung der Gesetze der Republik Österreich gesperrt worden
    Log-Analyse und Auswertung - 20.09.2012 (6)
  5. Der Computer ist für die Verletzung der Gesetze der Republik Österreich blockiert worden
    Log-Analyse und Auswertung - 19.09.2012 (3)
  6. Der Computer ist für die Verletzung der Gesetze der Republik Österreich blockiert worden
    Log-Analyse und Auswertung - 15.09.2012 (20)
  7. BKA Trojaner? - der computer ist für die verletzung der gesetze der republik österreich gesperrt
    Plagegeister aller Art und deren Bekämpfung - 11.09.2012 (15)
  8. Der Computer ist für die Verletzung der Gesetze der Republik Österreich blockiert worden
    Log-Analyse und Auswertung - 09.09.2012 (10)
  9. Der Computer ist für die Verletzung der Gesetze der Republik Österreich blockiert worden
    Plagegeister aller Art und deren Bekämpfung - 09.09.2012 (2)
  10. Trojaner Republik Österreich sperrt den Computer - 100€ Zahlungsforderung
    Log-Analyse und Auswertung - 06.09.2012 (5)
  11. "Der Computer ist für die Verletzung der Gesetze der Republik Österreich blockiert worden".
    Plagegeister aller Art und deren Bekämpfung - 24.08.2012 (2)
  12. Der Computer ist für die Verletzung der Gesetze der Republik Österreich blockiert worden
    Plagegeister aller Art und deren Bekämpfung - 23.08.2012 (3)
  13. Der Computer ist für die Verletzung der Gesetze der Republik Österreich gesperrt worden.
    Log-Analyse und Auswertung - 14.08.2012 (11)
  14. Der Computer ist für die Verletzung der Gesetze der Republik Österreich gesperrt worden.
    Log-Analyse und Auswertung - 11.08.2012 (2)
  15. Trojaner "der computer ist für die verletzung der gesetze der republik österreich blockiert worden"
    Log-Analyse und Auswertung - 10.08.2012 (1)
  16. Trojaner: "Verletzung Rechte Republik Österreich"
    Log-Analyse und Auswertung - 08.08.2012 (29)
  17. der computer ist für die verletzung der gesetze der republik österreich blockiert worden
    Plagegeister aller Art und deren Bekämpfung - 07.08.2012 (6)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert" - Hallo, ich habe mir leider heute morgen auch einen Verschlüsselungstrojaner eingefangen. Dabei handelt es sich um die Österreich Version mit dem Wortlaut: "der computer ist für die verletzung der gesetze - Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert"...
Archiv
Du betrachtest: Verschlüsselungstrojaner Österreich Version "Der Computer ist (...)Republik Österreich blockiert" auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19