| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU-Trojaner auf Vista 64bitWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
31.07.2012, 23:19
| #1 |
 |  GVU-Trojaner auf Vista 64bit Hallo Team, habe auch einen GVU Trojaner eingefangen. Wie bei allen wurde mein Rechner "gesperrt" und soll nur gegen Zahlung von 100 Euro wieder freigeschaltet werden können. Es ist die Version mit dem Webcambild oben rechts. Ich habe eine Wiederherstellung von gestern durchgeführt und kann wieder am PC arbeiten. Habe natürlich Angst, dass der Virus noch im System ist und Schaden anrichtet. Ich hoffe Ihr könnt helfen den Virus unschädlich zu machen. Vielen Dank im Voraus für jegliche Hilfestellung. Extras.txt: siehe Anhang Malware-log: siehe Anhang OTL.txt: Code:
ATTFilter OTL logfile created on: 31.07.2012 22:30:14 - Run 1 OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Boss\Desktop\DOWNLOAD 64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,99 Gb Total Physical Memory | 2,89 Gb Available Physical Memory | 48,21% Memory free 14,79 Gb Paging File | 11,27 Gb Available in Paging File | 76,20% Paging File free Paging file location(s): c:\pagefile.sys 9199 9199 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,76 Gb Total Space | 182,39 Gb Free Space | 39,16% Space Free | Partition Type: NTFS Drive E: | 232,88 Gb Total Space | 110,83 Gb Free Space | 47,59% Space Free | Partition Type: NTFS Drive F: | 465,76 Gb Total Space | 272,85 Gb Free Space | 58,58% Space Free | Partition Type: NTFS Drive G: | 232,88 Gb Total Space | 64,04 Gb Free Space | 27,50% Space Free | Partition Type: NTFS Drive H: | 931,51 Gb Total Space | 352,87 Gb Free Space | 37,88% Space Free | Partition Type: NTFS Computer Name: BOSS-PC | User Name: Boss | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.07.31 19:58:22 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Boss\Desktop\DOWNLOAD\OTL.exe PRC - [2012.07.24 22:32:10 | 000,404,848 | ---- | M] (AnchorFree Inc.) -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe PRC - [2012.07.24 22:28:22 | 000,387,440 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe PRC - [2012.07.24 22:26:42 | 000,474,992 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe PRC - [2012.07.10 04:57:46 | 001,240,944 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe PRC - [2012.06.19 17:32:30 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe PRC - [2012.05.29 11:39:10 | 001,028,776 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fssm32.exe PRC - [2012.05.29 11:39:10 | 000,561,832 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\FSGK32.EXE PRC - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.02.25 15:11:09 | 000,307,824 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.12.10 22:49:03 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2011.11.08 11:15:45 | 000,488,104 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsav32.exe PRC - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE PRC - [2011.09.16 15:39:24 | 000,115,048 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2011.05.23 14:14:53 | 000,061,088 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe PRC - [2011.01.31 09:11:18 | 000,221,864 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe PRC - [2011.01.31 09:11:16 | 000,201,384 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSM32.EXE PRC - [2011.01.31 09:11:16 | 000,189,096 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE PRC - [2011.01.31 09:11:16 | 000,090,792 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSHDLL32.EXE PRC - [2010.10.18 16:01:06 | 001,882,816 | ---- | M] (Language Engineering Corporation, LLC) -- C:\Program Files (x86)\Power Translator 14\LogoMedia TranslateDotNet Server.exe PRC - [2010.09.14 19:09:52 | 001,213,848 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE PRC - [2010.09.13 15:56:02 | 000,168,960 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe PRC - [2010.09.09 15:38:16 | 000,452,016 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe PRC - [2010.04.19 12:23:10 | 000,611,968 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\Fan Xpert\QFanHelp.exe PRC - [2010.04.09 17:04:44 | 000,022,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe PRC - [2010.02.09 16:49:40 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe PRC - [2009.02.23 12:43:54 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe PRC - [2008.10.28 02:01:00 | 001,794,048 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe PRC - [2008.10.28 02:01:00 | 000,364,544 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe PRC - [2006.06.20 01:00:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\P1370Mon.exe PRC - [2006.06.09 01:11:00 | 000,024,576 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\Creative Live! Cam\VideoFX\StartFX.exe ========== Modules (No Company Name) ========== MOD - [2012.07.24 22:35:10 | 000,010,096 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\lang\gui-ger.dll MOD - [2012.07.10 04:57:46 | 001,240,944 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.01.31 09:11:30 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\F-Secure\FSGUI\strres.eng MOD - [2011.01.31 09:11:25 | 000,553,640 | ---- | M] () -- C:\Program Files (x86)\F-Secure\FSGUI\gres.dll MOD - [2011.01.31 09:11:24 | 000,045,056 | ---- | M] () -- C:\Program Files (x86)\F-Secure\FSGUI\fsavures.eng MOD - [2011.01.31 09:11:23 | 000,443,048 | ---- | M] () -- C:\Program Files (x86)\F-Secure\FSGUI\about.dll MOD - [2011.01.31 09:11:23 | 000,090,792 | ---- | M] () -- C:\Program Files (x86)\F-Secure\FSGUI\aboutres.dll MOD - [2009.09.30 05:33:07 | 000,024,576 | R--- | M] () -- C:\Windows\SysWOW64\AsIO.dll MOD - [2006.06.09 16:48:52 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\Creative\Creative Live! Cam\VideoFX\EyeCatcherEx.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2009.02.25 23:07:08 | 001,967,872 | ---- | M] (O&O Software GmbH) [Disabled | Stopped] -- C:\Windows\SysNative\oodag.exe -- (O&O Defrag) SRV:64bit: - [2008.01.19 10:02:01 | 000,041,984 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lpdsvc.dll -- (LPDSVC) SRV:64bit: - [2008.01.19 10:00:52 | 000,195,584 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.07.27 09:07:15 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.07.24 22:36:22 | 000,078,072 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService) SRV - [2012.07.24 22:32:10 | 000,404,848 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv) SRV - [2012.07.24 22:28:22 | 000,387,440 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd) SRV - [2012.07.24 22:26:42 | 000,474,992 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (hshld) SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.06.19 17:32:30 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2012.06.19 14:51:28 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.12.10 22:49:03 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2011.10.24 09:53:38 | 002,565,632 | ---- | M] (Deutsche Telekom AG) [Auto | Running] -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe -- (Netzmanager Service) SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate) SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2011.05.23 14:14:53 | 000,061,088 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe -- (FSORSPClient) SRV - [2011.01.31 09:11:23 | 000,849,576 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe -- (FSDFWD) SRV - [2011.01.31 09:11:18 | 000,221,864 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe -- (F-Secure Gatekeeper Handler Starter) SRV - [2011.01.31 09:11:16 | 000,189,096 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE -- (FSMA) SRV - [2010.10.19 14:29:03 | 002,011,944 | ---- | M] (TeamViewer GmbH) [Disabled | Stopped] -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5) SRV - [2010.10.18 16:01:06 | 001,882,816 | ---- | M] (Language Engineering Corporation, LLC) [Auto | Running] -- C:\Program Files (x86)\Power Translator 14\LogoMedia TranslateDotNet Server.exe -- (LEC TranslateDotNet Server) SRV - [2010.04.09 17:04:44 | 000,022,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe -- (XTUService) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.24 13:59:12 | 000,398,128 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe -- (TVGOnlineUpdateSvc) SRV - [2009.12.20 14:00:35 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009.08.10 22:04:48 | 000,093,848 | ---- | M] (SiSoftware) [Disabled | Stopped] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2011.SP1\RpcAgentSrv.exe -- (SandraAgentSrv) SRV - [2009.06.24 08:45:38 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service) SRV - [2009.06.24 08:29:58 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service) SRV - [2009.03.30 06:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.02.23 12:43:54 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService) SRV - [2009.01.20 01:10:54 | 003,091,200 | ---- | M] () [Auto | Running] -- C:\Programme\OO Software\DiskImage\oodiag.exe -- (O&O DiskImage) SRV - [2008.10.28 02:01:00 | 000,364,544 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service) SRV - [2008.10.15 23:06:26 | 000,481,408 | ---- | M] (market maker Software AG) [Disabled | Stopped] -- C:\Program Files (x86)\Buhl\WISO Börse 2009\bin\watchdog.exe -- (WBWatchDog) SRV - [2007.05.31 17:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2007.05.31 17:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.07.10 04:48:18 | 000,041,704 | ---- | M] (AnchorFree Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\hssdrv6.sys -- (HssDRV6) DRV:64bit: - [2012.06.27 13:36:45 | 000,142,848 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\tinspusb.sys -- (USBTINSP) DRV:64bit: - [2012.05.09 10:07:15 | 000,055,960 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\fsbts.sys -- (fsbts) DRV:64bit: - [2012.04.06 20:15:10 | 000,038,632 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\taphss.sys -- (taphss) DRV:64bit: - [2012.02.29 15:52:46 | 000,016,384 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.15 12:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.01.17 14:45:56 | 000,188,224 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2012.01.10 12:02:36 | 000,410,184 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ladfGSCamd64.sys -- (LADF_CaptureOnly) DRV:64bit: - [2012.01.10 12:02:36 | 000,341,832 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ladfGSRamd64.sys -- (LADF_RenderOnly) DRV:64bit: - [2011.10.25 10:57:38 | 000,213,504 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2011.10.25 10:57:38 | 000,096,768 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2011.10.12 08:33:42 | 000,316,208 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\mvs91xx.sys -- (mvs91xx) DRV:64bit: - [2011.10.12 08:33:42 | 000,027,440 | ---- | M] (Marvell Semiconductor Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\mv91cons.sys -- (mv91cons) DRV:64bit: - [2011.09.08 17:40:24 | 000,508,520 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169) DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\LMouFilt.Sys -- (LMouFilt) DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\LHidFilt.Sys -- (LHidFilt) DRV:64bit: - [2011.05.19 16:55:34 | 000,120,920 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\jraid.sys -- (JRAID) DRV:64bit: - [2011.03.18 17:20:22 | 000,410,184 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ladfBakerCamd64.sys -- (LADF_BakerCOnly) DRV:64bit: - [2011.03.18 14:33:48 | 000,335,688 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ladfBakerRamd64.sys -- (LADF_BakerROnly) DRV:64bit: - [2011.01.31 09:11:39 | 000,046,664 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\fses.sys -- (FSES) DRV:64bit: - [2011.01.31 09:11:23 | 000,095,784 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\fsdfw.sys -- (FSFW) DRV:64bit: - [2011.01.19 18:47:18 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz135_x64.sys -- (cpuz135) DRV:64bit: - [2010.07.09 14:19:04 | 000,021,480 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz134_x64.sys -- (cpuz134) DRV:64bit: - [2010.05.30 08:39:15 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd) DRV:64bit: - [2010.05.06 12:06:03 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\atksgt.sys -- (atksgt) DRV:64bit: - [2010.05.06 12:06:00 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\lirsgt.sys -- (lirsgt) DRV:64bit: - [2010.01.20 12:27:20 | 000,036,224 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\intelsmb.sys -- (smbusp) DRV:64bit: - [2009.11.23 17:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid) DRV:64bit: - [2009.11.23 17:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:64bit: - [2009.10.01 02:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb) DRV:64bit: - [2009.09.10 03:24:12 | 000,074,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\xusb21.sys -- (xusb21) DRV:64bit: - [2009.07.10 16:27:54 | 000,022,488 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ICTDrv.sys -- (ICTDrv) DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.05.06 03:34:52 | 000,639,512 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\t3.sys -- (t3) DRV:64bit: - [2009.01.20 01:12:04 | 000,043,016 | ---- | M] (O&O Software GmbH) [File_System | Boot | Running] -- C:\Windows\SysNative\DRIVERS\oodivdh.sys -- (oodivdh) DRV:64bit: - [2009.01.20 01:12:02 | 000,171,016 | ---- | M] (O&O Software GmbH) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\oodivd.sys -- (oodivd) DRV:64bit: - [2009.01.20 01:12:00 | 000,039,944 | ---- | M] (O&O Software GmbH) [File_System | Boot | Running] -- C:\Windows\SysNative\DRIVERS\oodisrh.sys -- (oodisrh) DRV:64bit: - [2009.01.20 01:11:58 | 000,116,232 | ---- | M] (O&O Software GmbH) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\oodisr.sys -- (oodisr) DRV:64bit: - [2008.10.28 02:01:00 | 000,524,928 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\fwlanusbn.sys -- (fwlanusbn) DRV:64bit: - [2008.10.28 02:01:00 | 000,014,120 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject) DRV:64bit: - [2008.09.15 10:07:12 | 000,054,816 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tbhsd.sys -- (tbhsd) DRV:64bit: - [2008.04.22 08:53:36 | 000,012,744 | R--- | M] (EnTech Taiwan) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ENTECH64.sys -- (ENTECH64) DRV:64bit: - [2007.10.05 10:18:06 | 000,040,832 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SaiBus.sys -- (SaiNtBus) DRV:64bit: - [2007.10.05 10:18:06 | 000,016,000 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SaiMini.sys -- (SaiMini) DRV:64bit: - [2007.05.01 16:10:48 | 000,171,144 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\SaiH0255.sys -- (SaiH0255) DRV:64bit: - [2007.04.02 01:01:02 | 000,215,008 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\P1370Afx.sys -- (P1370Afx) DRV:64bit: - [2007.03.28 10:54:18 | 000,588,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\P1370Vid.sys -- (P1370VID) DRV:64bit: - [2007.03.05 18:55:48 | 000,012,288 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\P1370Vfx.sys -- (P1370Vfx) DRV:64bit: - [2006.12.28 01:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\fwlanusb.sys -- (FWLANUSB) DRV:64bit: - [2006.11.10 15:08:58 | 000,030,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ATITool64.sys -- (ATITool) DRV:64bit: - [2006.10.31 23:23:42 | 000,015,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ASACPI.sys -- (MTsensor) DRV:64bit: - [2006.10.22 18:44:56 | 000,242,688 | ---- | M] (Marvell Semiconductor, Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\MRVW13C.sys -- (MRV6X64P) DRV:64bit: - [2005.12.06 08:59:00 | 000,005,888 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\P1370Aul.sys -- (P1370Aul) DRV:64bit: - [2005.12.05 08:30:00 | 000,122,880 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\P1370Aud.sys -- (P1370Aud) DRV - [2012.05.29 11:39:23 | 000,199,848 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys -- (F-Secure Gatekeeper) DRV - [2011.08.17 11:56:22 | 000,042,672 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysWOW64\drivers\fsbts.sys -- (fsbts) DRV - [2011.01.31 09:11:44 | 000,061,960 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\F-Secure\HIPS\drivers\fshs.sys -- (F-Secure HIPS) DRV - [2011.01.31 09:11:19 | 000,015,016 | ---- | M] () [Kernel | System | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys -- (fsvista) DRV - [2010.09.16 17:02:59 | 000,045,664 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Running] -- C:\Programme\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys -- (TelekomNM6) DRV - [2010.05.10 10:44:46 | 000,028,984 | ---- | M] (Your Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\MSI\MSIWDev\DVDSYS64_100507.sys -- (MSI_DVD_010507) DRV - [2010.05.10 10:44:40 | 000,033,592 | ---- | M] (Your Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\MSI\MSIWDev\msibios64_100507.sys -- (MSI_MSIBIOS_010507) DRV - [2010.05.10 10:44:18 | 000,014,960 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\MSI\MSIWDev\VGASYS64_100507.sys -- (MSI_VGASYS_010507) DRV - [2010.02.03 12:42:02 | 000,030,384 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\ProgramData\Intel\Extreme Tuning Utility\IOCbios\64bit\IOCBios.sys -- (IOCBIOS) DRV - [2009.08.07 23:46:56 | 000,023,112 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2011.SP1\WNt500x64\sandra.sys -- (SANDRA) DRV - [2008.01.11 14:28:02 | 000,012,464 | ---- | M] (Macrovision Europe Ltd) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\CdaC15BA.SYS -- (CdaC15BA) DRV - [2007.02.07 17:57:20 | 000,034,048 | ---- | M] (CACE Technologies) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\npf_devolo.sys -- (NPF_devolo) DRV - [2006.09.19 15:44:04 | 000,015,664 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2004.06.22 16:44:50 | 000,005,632 | ---- | M] (EnTech Taiwan) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\Entech64.sys -- (ENTECH64) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKLM\..\URLSearchHook: {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Boss\Desktop\DOWNLOAD IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.n-tv.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.) IE - HKCU\..\SearchScopes,DefaultScope = {1A8E94C8-52E7-4732-81CD-BABBB2779A07} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch IE - HKCU\..\SearchScopes\{1A8E94C8-52E7-4732-81CD-BABBB2779A07}: "URL" = hxxp://www.bing.com/search?FORM=VE3D01&q={searchTerms}&src={referrer:source?} IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGIT_de IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "SearchTheWeb" FF - prefs.js..browser.search.defaulturl: "hxxp://www.bing.com/search?FORM=VE3D01&q=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://search.iminent.com/?appId=fb5587bd-5f10-45c2-a008-4b8c44eabea8&lcid=1031&ref=homepage" FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: LECToolbar@lec.txt:1.1 FF - prefs.js..extensions.enabledItems: promtff9@promt9.ru:9.0 FF - prefs.js..keyword.URL: "hxxp://www.bing.com/search?FORM=VE3D01&q=" FF - prefs.js..network.proxy.autoconfig_url: "file:///C:/Users/Boss/Music/Temp/Tunebite/.downloading/profile/rrproxy_ffox_48fdf396.pac" FF - prefs.js..network.proxy.no_proxies_on: "*.local" FF - prefs.js..network.proxy.type: 1 FF - prefs.js..browser.startup.homepage: "hxxp://search.iminent.com/?appId=FB5587BD-5F10-45C2-A008-4B8C44EABEA8" FF - prefs.js..browser.search.selectedEngine: "SearchTheWeb" FF - prefs.js..browser.startup.homepage: "" FF - prefs.js..browser.search.selectedEngine: "" FF - prefs.js..browser.search.defaultenginename: "" FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ [2009.10.25 11:33:59 | 000,000,000 | ---D | M] FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: File not found FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@fileplanet.com/fpdlm: C:\Program Files (x86)\Download Manager\npfpdlm.dll (IGN Entertainment) FF - HKLM\Software\MozillaPlugins\@funwebproducts.com/Plugin: File not found FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ [2009.10.25 11:33:59 | 000,000,000 | ---D | M] FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files (x86)\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@wolfram.com/Mathematica: C:\Program Files (x86)\Common Files\Wolfram Research\Browser\8.0.4.2615434\npmathplugin.dll (Wolfram Research, Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@phonostar.de/phonostar: C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll ( ) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Boss\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2010.02.03 16:55:31 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.05.22 18:59:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.29 09:19:35 | 000,000,000 | ---D | M] [2008.08.24 20:39:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Boss\AppData\Roaming\mozilla\Extensions [2012.06.28 15:55:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions [2012.01.10 11:19:54 | 000,000,000 | ---D | M] (Avanquest App'-Anwendungsleiste Community Toolbar) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{1d8566bd-f06f-4029-a3be-ba80af5a09f3} [2011.04.20 08:10:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.04.30 08:46:11 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2012.05.11 18:18:38 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.01.11 12:40:41 | 000,000,000 | ---D | M] (IMinent Toolbar) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444} [2009.04.05 12:31:49 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2012.04.19 17:52:45 | 000,000,000 | ---D | M] (HotSpot Shield Elite Community Toolbar) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{f16708b8-d2df-482d-9dfa-aa8d8894f0f4} [2012.01.11 12:53:20 | 000,000,000 | ---D | M] (Toolbar für amazon.de) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\0001.amztoolbar@minimalarts.de [2012.06.28 15:55:56 | 000,000,000 | ---D | M] (OneClickDownloader) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\OneClickDownload@OneClickDownload.com [2009.12.23 07:54:08 | 000,002,172 | ---- | M] () -- C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\kax47dyn.default\searchplugins\bing.xml [2010.05.30 08:39:42 | 000,002,059 | ---- | M] () -- C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\kax47dyn.default\searchplugins\daemon-search.xml [2012.04.19 16:19:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.06.28 16:16:06 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011.01.11 09:31:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.02.26 09:25:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2012.04.19 16:19:18 | 000,000,000 | ---D | M] (Hotspot Shield Helper (Please allow this installation)) -- C:\Program Files (x86)\mozilla firefox\extensions\afurladvisor@anchorfree.com [2012.01.11 12:40:21 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Program Files (x86)\mozilla firefox\extensions\quickstores@quickstores.de [2010.10.28 10:19:32 | 000,000,000 | ---D | M] (LEC Translation Toolbar) -- C:\PROGRAM FILES (X86)\POWER TRANSLATOR 14\ADDINS\LECTOOLBAR [2010.10.26 15:33:48 | 000,000,000 | ---D | M] (PROMT) -- C:\PROGRAM FILES (X86)\PRMT9\FIREFOX [2011.02.02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2009.12.22 05:57:54 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2009.12.22 05:57:54 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2009.12.22 05:57:54 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2009.12.22 05:57:54 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2009.12.22 05:57:54 | 000,000,801 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.02.14 15:24:38 | 000,429,885 | R--- | M]) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 14800 more lines... O2:64bit: - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll (AnchorFree Inc.) O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RadioHoops Toolbar) - {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.) O2 - BHO: (Avanquest App'-Anwendungsleiste Toolbar) - {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.) O2 - BHO: (Promt IE Helper) - {1F13CE11-4FAC-49A9-8155-D4F3F0F91A33} - C:\Program Files (x86)\PRMT9\PRMTIE\prmtie.dll (PROMT Ltd.) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files (x86)\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O2 - BHO: (HotSpot Shield Elite Toolbar) - {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.) O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.) O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found O3 - HKLM\..\Toolbar: (RadioHoops Toolbar) - {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Avanquest App'-Anwendungsleiste Toolbar) - {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (LEC) - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - C:\Program Files (x86)\Power Translator 14\Applications\LEC IE Translation Extension.dll (Language Engineering Corporation, LLC) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (PROMT-Übersetzer) - {C7DDDD27-F303-42A5-B979-51559F7DC0F0} - C:\Program Files (x86)\PRMT9\PRMTIE\prmtie.dll (PROMT Ltd.) O3 - HKLM\..\Toolbar: (HotSpot Shield Elite Toolbar) - {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (no name) - {FF284F5C-7CF9-4682-8701-D467C1DBB99F} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (RadioHoops Toolbar) - {0C3110F6-A2E6-4B6F-9516-6DC345E1F7EF} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Avanquest App'-Anwendungsleiste Toolbar) - {1D8566BD-F06F-4029-A3BE-BA80AF5A09F3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.) O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com) O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) O3 - HKCU\..\Toolbar\WebBrowser: (myBabylon English Toolbar) - {B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (PROMT-Übersetzer) - {C7DDDD27-F303-42A5-B979-51559F7DC0F0} - C:\Program Files (x86)\PRMT9\PRMTIE\prmtie.dll (PROMT Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (HotSpot Shield Elite Toolbar) - {F16708B8-D2DF-482D-9DFA-AA8D8894F0F4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.) O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [ProfilerU] C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [SaiMfd] C:\Programme\Saitek\SD6\Software\SaiMfd.exe (Saitek) O4:64bit: - HKLM..\Run: [Windows Defender] %ProgramFiles(x86)%\Windows Defender\MSASCui.exe -hide File not found O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVFX Engine] C:\Program Files (x86)\Creative\Creative Live! Cam\VideoFX\StartFX.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin) O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) O4 - HKLM..\Run: [F-Secure Manager] C:\Program Files (x86)\F-Secure\Common\FSM32.EXE (F-Secure Corporation) O4 - HKLM..\Run: [F-Secure TNB] C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe (F-Secure Corporation) O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.) O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [P1370Mon.exe] C:\Windows\P1370Mon.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [QFan Help] C:\Program Files (x86)\ASUS\Fan Xpert\QFanHelp.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKCU..\Run: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe (IGN Entertainment) O4 - HKCU..\Run: [POEngine5] File not found O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation) O4 - Startup: C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk = File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O8:64bit: - Extra context menu item: &Suche im Duden - res://C:\Program Files (x86)\Duden-Suche Toolbar\toolbar.dll/SEARCH.HTML File not found O8:64bit: - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Boss\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Ganze Seite übersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\page.htm () O8:64bit: - Extra context menu item: Google Sidewiki... - Reg Error: Value error. File not found O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Markierung ubersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\translat.htm () O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - File not found O8:64bit: - Extra context menu item: Suchanfrage ubersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\search.htm () O8:64bit: - Extra context menu item: Thema automatisch bestimmen - C:\Program Files (x86)\PRMT9\PRMTIE\aot.htm () O8:64bit: - Extra context menu item: Translate this web page with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O8:64bit: - Extra context menu item: Translate with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O8:64bit: - Extra context menu item: Übersetzungsoptionen anpassen - C:\Program Files (x86)\PRMT9\PRMTIE\options.htm () O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: &Suche im Duden - res://C:\Program Files (x86)\Duden-Suche Toolbar\toolbar.dll/SEARCH.HTML File not found O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Boss\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Ganze Seite übersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\page.htm () O8 - Extra context menu item: Google Sidewiki... - Reg Error: Value error. File not found O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Markierung ubersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\translat.htm () O8 - Extra context menu item: Nach Microsoft &Excel exportieren - File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - File not found O8 - Extra context menu item: Suchanfrage ubersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\search.htm () O8 - Extra context menu item: Thema automatisch bestimmen - C:\Program Files (x86)\PRMT9\PRMTIE\aot.htm () O8 - Extra context menu item: Translate this web page with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O8 - Extra context menu item: Translate with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O8 - Extra context menu item: Übersetzungsoptionen anpassen - C:\Program Files (x86)\PRMT9\PRMTIE\options.htm () O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O9 - Extra Button: PokerStars.eu - {07BA1DA9-F501-4796-8728-74D1B91A6CD5} - C:\Program Files (x86)\PokerStars.EU\PokerStarsUpdate.exe (PokerStars) O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars) O9 - Extra Button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - File not found O9 - Extra 'Tools' menuitem : PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - File not found O9 - Extra 'Tools' menuitem : Übersetzen - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - File not found O9 - Extra 'Tools' menuitem : Übersetzungsoptionen anpassen - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - File not found O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000021 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: com ([www.msi] http in Trusted sites) O15 - HKCU\..Trusted Domains: com.tw ([asia.msi] http in Trusted sites) O15 - HKCU\..Trusted Domains: com.tw ([global.msi] http in Trusted sites) O15 - HKCU\..Trusted Domains: imageshack.us ([toolbar] http in Trusted sites) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab (Office Genuine Advantage Validation Tool) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab (System Requirements Lab Class) O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab (CDownloadCtrl Object) O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab (EPUImageControl Class) O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab (Reg Error: Key error.) O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan) O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab (WebSDev Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab (EPUImageControl Class) O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Java Plug-in 1.5.0_04) O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (RealPlayer G2 Control) O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://recordedfuture.webex.com/client/T27LB/webex/ieatgpc1.cab (GpcContainer Class) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15109/CTPID.cab (Creative Software AutoUpdate Support Package) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1DDCD9FF-A25E-4458-B97E-4BA005ADDDE9}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6719F06D-D845-4079-9EEF-82B9D9473F1D}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D381F183-DF0C-48DD-9951-CBEF842508E4}: NameServer = 10.92.64.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E11ED395-C5DC-4B77-8BB1-B837AD0E9A37}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\belarc - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation) O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - Deskscapes - C:\PROGRA~2\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll (Stardock Corporation) O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - Stardock Vista ControlPanel Extension - C:\PROGRA~2\Stardock\OBJECT~1\DESKSC~1\DesktopControlPanel.dll (Stardock) O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - StardockDreamController - C:\PROGRA~2\Stardock\OBJECT~1\DESKSC~1\DreamControl.dll (Stardock) O24 - Desktop WallPaper: C:\Wallpaper\f-15.jpg O24 - Desktop BackupWallPaper: C:\Wallpaper\f-15.jpg O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{3dfc4963-8894-11dd-8525-001a9261b457}\Shell - "" = AutoRun O33 - MountPoints2\{3dfc4963-8894-11dd-8525-001a9261b457}\Shell\AutoRun\command - "" = I:\pushinst.exe O33 - MountPoints2\{4c6ff34d-2854-11dc-86cd-001a9261b457}\Shell - "" = AutoRun O33 - MountPoints2\{4c6ff34d-2854-11dc-86cd-001a9261b457}\Shell\AutoRun\command - "" = I:\pushinst.exe O33 - MountPoints2\I\Shell - "" = AutoRun O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\pushinst.exe O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (OODBS) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.07.31 22:08:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.07.30 19:59:34 | 000,000,000 | ---D | C] -- C:\Users\Boss\Documents\ArmA 2 Other Profiles [2012.07.22 23:28:10 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Local\ArmA 2 OA [2012.07.22 23:23:31 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Local\ArmA 2 Free [2012.07.22 23:23:31 | 000,000,000 | ---D | C] -- C:\Users\Boss\Documents\ArmA 2 [2012.07.22 23:23:13 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive [2012.07.22 23:23:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive [2012.07.22 22:21:32 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Local\SIX_Projects [2012.07.22 22:17:11 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Roaming\six-updater [2012.07.22 22:17:09 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Roaming\six-zsync [2012.07.22 22:15:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Six Projects [2012.07.22 22:14:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SIX Projects [2012.07.19 23:09:00 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Hotspot Shield [2012.07.17 16:00:05 | 000,000,000 | ---D | C] -- C:\Users\Boss\Documents\Echt Einfach TV [2012.07.17 09:23:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DreamCalc DC4P [2012.07.17 09:23:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DreamCalc DC4P [2012.07.11 12:12:25 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView [2012.07.11 12:12:01 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Roaming\IrfanView [2012.07.11 12:12:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IrfanView [2012.07.11 11:43:22 | 000,000,000 | ---D | C] -- C:\Users\Boss\Documents\My Pictures [2012.07.10 04:48:18 | 000,041,704 | ---- | C] (AnchorFree Inc.) -- C:\Windows\SysNative\drivers\hssdrv6.sys [2012.07.05 23:49:14 | 000,000,000 | ---D | C] -- C:\Users\Boss\Documents\Maple 16 [2012.07.04 07:58:32 | 000,000,000 | ---D | C] -- C:\Users\Boss\.maplesoft [2012.07.04 07:56:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maple 16 [2012.07.04 07:51:18 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Zero G Registry [2012.07.04 07:51:18 | 000,000,000 | ---D | C] -- C:\Program Files\Maple 16 [2012.07.04 07:49:42 | 000,000,000 | -H-D | C] -- C:\Users\Boss\InstallAnywhere [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Users\Boss\AppData\Local\*.tmp files -> C:\Users\Boss\AppData\Local\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.31 22:21:08 | 000,004,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.31 22:21:07 | 000,004,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.31 22:20:33 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl [2012.07.31 22:20:30 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.07.31 22:20:26 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\Final Media Player Update Checker.job [2012.07.31 22:20:22 | 000,000,530 | ---- | M] () -- C:\Windows\tasks\Scheduled scanning task.job [2012.07.31 22:20:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.31 22:20:11 | 2138,169,343 | -HS- | M] () -- C:\hiberfil.sys [2012.07.31 22:20:09 | 003,840,856 | ---- | M] () -- C:\Windows\SysNative\OODBS.lor [2012.07.31 22:18:45 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2012.07.31 22:17:44 | 000,000,228 | ---- | M] () -- C:\Users\Boss\Desktop\Anleitung Malwarebytes Anti-Malware - Trojaner-Board.url [2012.07.31 22:08:56 | 000,000,952 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.31 22:07:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.07.31 21:20:11 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.07.31 20:34:25 | 001,606,382 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.31 20:34:25 | 000,687,592 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.07.31 20:34:25 | 000,646,644 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.31 20:34:25 | 000,151,726 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.07.31 20:34:25 | 000,125,390 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.07.31 14:45:40 | 004,503,728 | ---- | M] () -- C:\ProgramData\ras_0oed.pad [2012.07.31 14:41:10 | 000,002,032 | ---- | M] () -- C:\Users\Boss\AppData\Local\d3d9caps.dat [2012.07.30 14:42:00 | 000,000,986 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2012.07.27 17:15:00 | 000,000,414 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job [2012.07.25 08:05:49 | 000,001,852 | ---- | M] () -- C:\Users\Public\Desktop\Six Updater.lnk [2012.07.25 08:05:48 | 000,001,852 | ---- | M] () -- C:\Users\Public\Desktop\Six Launcher.lnk [2012.07.22 13:27:26 | 000,005,237 | ---- | M] () -- C:\Users\Boss\AppData\Roaming\DreamCalc DC4P.dat [2012.07.19 12:02:12 | 000,002,101 | ---- | M] () -- C:\Users\Boss\Desktop\TI-Nspire CAS Student Software.lnk [2012.07.13 16:35:41 | 000,000,823 | ---- | M] () -- C:\Users\Boss\Desktop\Maple 16.lnk [2012.07.11 16:47:49 | 000,588,592 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.10 04:48:18 | 000,041,704 | ---- | M] (AnchorFree Inc.) -- C:\Windows\SysNative\drivers\hssdrv6.sys [2012.07.04 07:56:14 | 000,281,088 | ---- | M] () -- C:\Windows\SysNative\WMIMPLEX.dll [2012.07.04 07:56:14 | 000,033,280 | ---- | M] () -- C:\Windows\SysNative\maplec.dll [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Users\Boss\AppData\Local\*.tmp files -> C:\Users\Boss\AppData\Local\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.31 22:17:44 | 000,000,228 | ---- | C] () -- C:\Users\Boss\Desktop\Anleitung Malwarebytes Anti-Malware - Trojaner-Board.url [2012.07.31 22:08:56 | 000,000,952 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.31 15:34:24 | 2138,169,343 | -HS- | C] () -- C:\hiberfil.sys [2012.07.31 14:28:11 | 004,503,728 | ---- | C] () -- C:\ProgramData\ras_0oed.pad [2012.07.22 22:15:09 | 000,001,852 | ---- | C] () -- C:\Users\Public\Desktop\Six Updater.lnk [2012.07.22 22:15:09 | 000,001,852 | ---- | C] () -- C:\Users\Public\Desktop\Six Launcher.lnk [2012.07.19 12:02:12 | 000,002,101 | ---- | C] () -- C:\Users\Boss\Desktop\TI-Nspire CAS Student Software.lnk [2012.07.17 09:24:29 | 000,005,237 | ---- | C] () -- C:\Users\Boss\AppData\Roaming\DreamCalc DC4P.dat [2012.07.13 16:35:41 | 000,000,823 | ---- | C] () -- C:\Users\Boss\Desktop\Maple 16.lnk [2012.07.04 07:56:14 | 000,281,088 | ---- | C] () -- C:\Windows\SysNative\WMIMPLEX.dll [2012.07.04 07:56:14 | 000,033,280 | ---- | C] () -- C:\Windows\SysNative\maplec.dll [2012.06.27 13:36:56 | 000,002,189 | ---- | C] () -- C:\Users\Boss\AppData\Local\TempfixPerms.vbs [2012.04.19 16:20:41 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\cd.dat [2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.12.10 22:49:02 | 003,123,272 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2011.11.03 10:28:01 | 000,000,203 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_Hawaiian Airports Volume 2.reg [2011.10.27 08:13:37 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe [2011.10.07 08:42:16 | 000,280,976 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.10.07 08:42:14 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.04.26 20:57:41 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2011.03.06 06:43:18 | 000,000,185 | ---- | C] () -- C:\Users\Boss\FlightBeam_San Francisco X.reg [2011.02.14 14:13:42 | 000,000,323 | ---- | C] () -- C:\Windows\wininit.ini [2011.02.12 12:25:38 | 010,977,280 | ---- | C] () -- C:\ProgramData\sandra.mda [2011.01.31 09:14:52 | 000,042,672 | ---- | C] () -- C:\Windows\SysWow64\drivers\fsbts.sys [2011.01.09 17:58:15 | 000,000,186 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_Honolulu.reg [2011.01.06 09:36:38 | 000,270,848 | ---- | C] () -- C:\Program Files (x86)\UNWISE.EXE [2011.01.05 15:00:41 | 000,000,171 | ---- | C] () -- C:\Users\Boss\Aerosoft_FlorenceX.reg [2011.01.05 15:00:21 | 000,000,181 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_JFK.reg [2011.01.05 15:00:01 | 000,000,180 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_ZurichX.reg [2010.12.10 17:40:34 | 000,000,183 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_Geneva.reg [2010.12.10 17:40:18 | 000,000,181 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_XPOI.reg [2010.12.10 17:39:58 | 000,000,191 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_Chicago Ohare.reg [2010.12.03 20:30:52 | 000,000,204 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_Hawaiian Airports Volume 1.reg [2010.12.03 19:57:07 | 000,000,179 | ---- | C] () -- C:\Users\Boss\Cloud9_Xcity Rome.reg [2010.12.03 19:56:47 | 000,000,175 | ---- | C] () -- C:\Users\Boss\Cloud9_Bergen.reg [2010.12.03 19:56:26 | 000,000,190 | ---- | C] () -- C:\Users\Boss\Cloud9_Orlando International.reg [2010.10.30 13:53:59 | 000,081,312 | ---- | C] () -- C:\ProgramData\dudenbib.wav [2010.10.28 10:20:15 | 000,075,040 | ---- | C] () -- C:\Program Files (x86)\Common Files\SpeechUninstall.exe [2008.10.01 10:59:35 | 000,004,553 | ---- | C] () -- C:\Users\Boss\.recently-used.xbel [2008.06.25 14:58:31 | 003,211,264 | ---- | C] () -- C:\Program Files (x86)\Common FilesDDBACSetup.msi [2008.01.11 14:14:08 | 000,000,092 | ---- | C] () -- C:\Users\Boss\AppData\Local\fusioncache.dat [2007.12.06 15:12:56 | 000,002,032 | ---- | C] () -- C:\Users\Boss\AppData\Local\d3d9caps.dat [2007.11.05 18:01:43 | 000,002,188 | ---- | C] () -- C:\Users\Boss\AppData\Local\d3d9caps64.dat [2007.10.26 05:16:52 | 000,055,808 | ---- | C] () -- C:\Users\Boss\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.08.10 06:45:43 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol ========== LOP Check ========== [2007.10.23 12:20:03 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\ACD Systems [2009.05.20 23:32:25 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Acreon [2007.10.23 12:20:03 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Aerosimulations [2011.07.02 12:51:58 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Amazon [2012.02.04 17:50:56 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Babylon [2010.11.20 13:48:50 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\BitTorrent [2009.05.11 15:48:27 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Buhl Data Service [2012.01.07 13:40:15 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Canon [2009.05.05 20:55:51 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\ChessBase [2009.12.18 09:31:11 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\com.adobe.example.avatarAirApplication.199ED43C2CFEB351CD0244628B93195D7C58F98C.1 [2012.02.14 21:19:52 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\com.nicolasprof.OTMEditor [2009.10.09 14:40:01 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\CoSoSys [2010.05.30 08:49:19 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DAEMON Tools Lite [2010.11.18 12:49:13 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DasTelefonbuch Gelbe Seiten Map&Route [2008.12.31 15:58:26 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DasTelefonbuch GelbeSeiten Map&Route [2007.10.23 12:20:04 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DataDesign [2007.10.26 23:41:01 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DelinvFile [2007.10.25 13:01:29 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Disposition [2010.10.30 13:37:31 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Duden [2012.05.11 18:22:15 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DVDVideoSoft [2012.05.11 18:18:38 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DVDVideoSoftIEHelpers [2011.10.04 08:00:29 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\elsterformular [2009.09.09 23:53:23 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\EVEMon [2011.01.31 18:13:28 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\f-secure [2007.12.16 14:53:58 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\FileZilla [2012.07.31 15:32:56 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\FinalMediaPlayer [2010.11.21 13:57:23 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Flight One Software [2011.11.30 19:13:41 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Flight1 [2008.11.28 13:19:21 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\fs_earth_x [2009.01.09 11:57:03 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\GetRightToGo [2008.10.01 10:59:35 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\gtk-2.0 [2011.11.30 22:41:22 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\HiFi [2011.05.21 10:48:05 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Imersatz GmbH [2012.07.11 12:12:01 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\IrfanView [2007.10.28 11:03:03 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Jürgen Treml [2012.05.05 16:52:44 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Kalypso Media [2010.11.08 15:32:20 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Leadertech [2010.10.28 10:18:34 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\LEC [2007.10.23 12:20:04 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Lexware [2011.08.31 12:02:20 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\LogoMaker [2010.11.20 13:24:36 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Mathsoft [2007.10.23 12:20:13 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\muvee Technologies [2009.03.20 18:34:33 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\MyOddWeb [2011.02.04 14:54:36 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\nHancer [2007.03.24 11:12:58 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Ordner HP Share-to-Web [2011.10.07 07:48:08 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Origin [2012.06.28 16:08:32 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Pdfsvg [2012.01.11 12:40:11 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\phonostar GmbH [2010.10.29 16:45:35 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\PRMT [2007.10.23 12:20:13 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Project MT [2010.10.26 15:54:46 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\PROMT [2012.01.11 12:40:22 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\QuickStoresToolbar [2011.11.30 21:31:26 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\RayV [2011.11.30 21:44:47 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\RIFT [2007.10.23 12:20:13 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\ScanSoft [2009.08.24 04:59:39 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\SecondLife [2012.07.25 15:17:40 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\six-updater [2012.07.22 22:17:09 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\six-zsync [2009.08.28 07:32:32 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\SpeedSim [2010.10.12 16:47:15 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\TeamViewer [2012.06.27 13:40:50 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Texas Instruments [2009.03.05 06:51:13 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\The Creative Assembly [2012.06.27 13:44:32 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\TI-Nspire [2007.03.30 09:19:05 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\TVG [2008.12.10 16:47:00 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\TweakNow PowerPack [2011.12.11 11:31:18 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Ubisoft [2010.12.03 19:57:48 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Virtuali [2011.06.08 19:39:34 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\wargaming.net [2010.08.12 16:59:42 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\webex [2010.06.01 16:58:23 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Winsome Technologies [2012.07.27 17:15:00 | 000,000,414 | ---- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job [2012.07.31 22:20:26 | 000,000,408 | ---- | M] () -- C:\Windows\Tasks\Final Media Player Update Checker.job [2012.07.31 22:18:46 | 000,032,538 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2012.07.31 22:20:22 | 000,000,530 | ---- | M] () -- C:\Windows\Tasks\Scheduled scanning task.job ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 173 bytes -> C:\ProgramData\TEMP:CBD3E4DE @Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:74603393 @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:D37053A2 < End of report > |
|
31.07.2012, 23:43
| #2 |
| /// Helfer-Team  | GVU-Trojaner auf Vista 64bit Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKLM\..\URLSearchHook: {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\..\URLSearchHook: {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {1A8E94C8-52E7-4732-81CD-BABBB2779A07}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
IE - HKCU\..\SearchScopes\{1A8E94C8-52E7-4732-81CD-BABBB2779A07}: "URL" = http://www.bing.com/search?FORM=VE3D01&q={searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGIT_de
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - prefs.js..browser.search.defaultenginename: "SearchTheWeb"
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=VE3D01&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://search.iminent.com/?appId=fb5587bd-5f10-45c2-a008-4b8c44eabea8&lcid=1031&ref=homepage"
FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: LECToolbar@lec.txt:1.1
FF - prefs.js..extensions.enabledItems: promtff9@promt9.ru:9.0
FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=VE3D01&q="
FF - prefs.js..network.proxy.autoconfig_url: "file:///C:/Users/Boss/Music/Temp/Tunebite/.downloading/profile/rrproxy_ffox_48fdf396.pac"
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 1
FF - prefs.js..browser.startup.homepage: "http://search.iminent.com/?appId=FB5587BD-5F10-45C2-A008-4B8C44EABEA8"
FF - prefs.js..browser.search.selectedEngine: "SearchTheWeb"
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: File not found
FF - HKLM\Software\MozillaPlugins\@funwebproducts.com/Plugin: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RadioHoops Toolbar) - {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.)
O2 - BHO: (Avanquest App'-Anwendungsleiste Toolbar) - {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O2 - BHO: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.)
O2 - BHO: (HotSpot Shield Elite Toolbar) - {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.)
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found
O3 - HKLM\..\Toolbar: (RadioHoops Toolbar) - {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Avanquest App'-Anwendungsleiste Toolbar) - {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (HotSpot Shield Elite Toolbar) - {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {FF284F5C-7CF9-4682-8701-D467C1DBB99F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (RadioHoops Toolbar) - {0C3110F6-A2E6-4B6F-9516-6DC345E1F7EF} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Avanquest App'-Anwendungsleiste Toolbar) - {1D8566BD-F06F-4029-A3BE-BA80AF5A09F3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (myBabylon English Toolbar) - {B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (PROMT-Übersetzer) - {C7DDDD27-F303-42A5-B979-51559F7DC0F0} - C:\Program Files (x86)\PRMT9\PRMTIE\prmtie.dll (PROMT Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (HotSpot Shield Elite Toolbar) - {F16708B8-D2DF-482D-9DFA-AA8D8894F0F4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [Windows Defender] %ProgramFiles(x86)%\Windows Defender\MSASCui.exe -hide File not found
O4 - HKCU..\Run: [POEngine5] File not found
O4 - Startup: C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O8:64bit: - Extra context menu item: &Suche im Duden - res://C:\Program Files (x86)\Duden-Suche Toolbar\toolbar.dll/SEARCH.HTML File not found
O8:64bit: - Extra context menu item: Google Sidewiki... - Reg Error: Value error. File not found
O8:64bit: - Extra context menu item: Markierung ubersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\translat.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - File not found
O8:64bit: - Extra context menu item: Translate this web page with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O8:64bit: - Extra context menu item: Translate with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O8 - Extra context menu item: &Suche im Duden - res://C:\Program Files (x86)\Duden-Suche Toolbar\toolbar.dll/SEARCH.HTML File not found
O8 - Extra context menu item: Google Sidewiki... - Reg Error: Value error. File not found
O8 - Extra context menu item: Markierung ubersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\translat.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - File not found
O8 - Extra context menu item: Translate this web page with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O8 - Extra context menu item: Translate with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra Button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - File not found
O9 - Extra 'Tools' menuitem : PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - File not found
O9 - Extra 'Tools' menuitem : Übersetzen - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - File not found
O9 - Extra 'Tools' menuitem : Übersetzungsoptionen anpassen - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - File not found
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found
O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - File not found
O15 - HKCU\..Trusted Domains: com ([www.msi] http in Trusted sites)
O15 - HKCU\..Trusted Domains: com.tw ([asia.msi] http in Trusted sites)
O15 - HKCU\..Trusted Domains: com.tw ([global.msi] http in Trusted sites)
O15 - HKCU\..Trusted Domains: imageshack.us ([toolbar] http in Trusted sites)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{3dfc4963-8894-11dd-8525-001a9261b457}\Shell - "" = AutoRun
O33 - MountPoints2\{3dfc4963-8894-11dd-8525-001a9261b457}\Shell\AutoRun\command - "" = I:\pushinst.exe
O33 - MountPoints2\{4c6ff34d-2854-11dc-86cd-001a9261b457}\Shell - "" = AutoRun
O33 - MountPoints2\{4c6ff34d-2854-11dc-86cd-001a9261b457}\Shell\AutoRun\command - "" = I:\pushinst.exe
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\pushinst.exe
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2012.07.31 14:45:40 | 004,503,728 | ---- | M] () -- C:\ProgramData\ras_0oed.pad
@Alternate Data Stream - 173 bytes -> C:\ProgramData\TEMP:CBD3E4DE
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:74603393
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:D37053A2
[2012.07.31 22:21:08 | 000,004,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.31 22:21:07 | 000,004,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.31 22:07:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.31 21:20:11 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.30 14:42:00 | 000,000,986 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2012.07.27 17:15:00 | 000,000,414 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2012.02.04 17:50:56 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Babylon
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ |
|
01.08.2012, 07:27
| #3 |
| | GVU-Trojaner auf Vista 64bit Fehler gemacht
__________________ Hallo t'john Mir wird erst jetzt bewusst, dass ich gestern vor lauter Virus-Schock beim Lesen eurer Anweisungen nicht genau aufgepasst habe und OTL.exe nicht vom Desktop gestartet habe und mein Antivirus nicht ausgeschaltet war bei der Erstellung des OTL-reports. Außerdem habe ich heute Morgen vorsichtshalber 2 Programme gelöscht, die verdächtig waren. Tut mir echt Leid - ich dachte nicht dass ihr so schnell seit und wollte mein Beitrag heute Morgen neu starten mit korrekte Log-Dateien. Soll ich jetzt erneut die Scans durchführen und die Logs posten? ...oder ist das trotzdem OK dein Script laufen zu lassen? Sorry...ist mir echt peinlich! Robert Geändert von earnorbust (01.08.2012 um 07:37 Uhr) |
|
01.08.2012, 12:40
| #4 |
| /// Helfer-Team | GVU-Trojaner auf Vista 64bit Ja, fuehre den Fix aus! |
|
01.08.2012, 16:11
| #5 |
| | GVU-Trojaner auf Vista 64bit Uaahh...mir ist richtig mulmig, wenn ich sehe was der Fix alles auf meinen PC inszeniert und wieviel Vertrauen ich in dir und deine Kunst habe!  Vorallem wurden einige *.dll's gemoved. Sind diese Anwendungen jetzt weg oder nur umgezogen??  OK - Hier ist das Ergebnis: Code:
ATTFilter All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef}\ deleted successfully.
C:\Program Files (x86)\RadioHoops\prxtbRadi.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{1d8566bd-f06f-4029-a3be-ba80af5a09f3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1d8566bd-f06f-4029-a3be-ba80af5a09f3}\ deleted successfully.
C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\ deleted successfully.
C:\Program Files (x86)\myBabylon_English\tbmyB1.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{f16708b8-d2df-482d-9dfa-aa8d8894f0f4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f16708b8-d2df-482d-9dfa-aa8d8894f0f4}\ deleted successfully.
C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef}\ not found.
File C:\Program Files (x86)\RadioHoops\prxtbRadi.dll not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{1d8566bd-f06f-4029-a3be-ba80af5a09f3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1d8566bd-f06f-4029-a3be-ba80af5a09f3}\ not found.
File C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\ not found.
File C:\Program Files (x86)\myBabylon_English\tbmyB1.dll not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{f16708b8-d2df-482d-9dfa-aa8d8894f0f4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f16708b8-d2df-482d-9dfa-aa8d8894f0f4}\ not found.
File C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1A8E94C8-52E7-4732-81CD-BABBB2779A07}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1A8E94C8-52E7-4732-81CD-BABBB2779A07}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "SearchTheWeb" removed from browser.search.defaultenginename
Prefs.js: "hxxp://www.bing.com/search?FORM=VE3D01&q=" removed from browser.search.defaulturl
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://search.iminent.com/?appId=fb5587bd-5f10-45c2-a008-4b8c44eabea8&lcid=1031&ref=homepage" removed from browser.startup.homepage
Prefs.js: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.2 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 removed from extensions.enabledItems
Prefs.js: LECToolbar@lec.txt:1.1 removed from extensions.enabledItems
Prefs.js: promtff9@promt9.ru:9.0 removed from extensions.enabledItems
Prefs.js: "hxxp://www.bing.com/search?FORM=VE3D01&q=" removed from keyword.URL
Prefs.js: "file:///C:/Users/Boss/Music/Temp/Tunebite/.downloading/profile/rrproxy_ffox_48fdf396.pac" removed from network.proxy.autoconfig_url
Prefs.js: "*.local" removed from network.proxy.no_proxies_on
Prefs.js: 1 removed from network.proxy.type
Prefs.js: "hxxp://search.iminent.com/?appId=FB5587BD-5F10-45C2-A008-4B8C44EABEA8" removed from browser.startup.homepage
Prefs.js: "SearchTheWeb" removed from browser.search.selectedEngine
Prefs.js: "" removed from browser.startup.homepage
Prefs.js: "" removed from browser.search.selectedEngine
Prefs.js: "" removed from browser.search.defaultenginename
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@funwebproducts.com/Plugin\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ not found.
C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef}\ not found.
File C:\Program Files (x86)\RadioHoops\prxtbRadi.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1d8566bd-f06f-4029-a3be-ba80af5a09f3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1d8566bd-f06f-4029-a3be-ba80af5a09f3}\ not found.
File C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ deleted successfully.
C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}\ deleted successfully.
C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\ not found.
File C:\Program Files (x86)\myBabylon_English\tbmyB1.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f16708b8-d2df-482d-9dfa-aa8d8894f0f4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f16708b8-d2df-482d-9dfa-aa8d8894f0f4}\ not found.
File C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef}\ not found.
File C:\Program Files (x86)\RadioHoops\prxtbRadi.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{1d8566bd-f06f-4029-a3be-ba80af5a09f3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1d8566bd-f06f-4029-a3be-ba80af5a09f3}\ not found.
File Anwendungsleiste\prxtbAvan.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{3041d03e-fd4b-44e0-b742-2d9b88305f98} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ deleted successfully.
File C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\ not found.
File C:\Program Files (x86)\myBabylon_English\tbmyB1.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{f16708b8-d2df-482d-9dfa-aa8d8894f0f4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f16708b8-d2df-482d-9dfa-aa8d8894f0f4}\ not found.
File C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{FF284F5C-7CF9-4682-8701-D467C1DBB99F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FF284F5C-7CF9-4682-8701-D467C1DBB99F}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0C3110F6-A2E6-4B6F-9516-6DC345E1F7EF} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0C3110F6-A2E6-4B6F-9516-6DC345E1F7EF}\ not found.
File C:\Program Files (x86)\RadioHoops\prxtbRadi.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1D8566BD-F06F-4029-A3BE-BA80AF5A09F3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D8566BD-F06F-4029-A3BE-BA80AF5A09F3}\ not found.
File Anwendungsleiste\prxtbAvan.dll not found.
64bit-Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ deleted successfully.
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3041D03E-FD4B-44E0-B742-2D9B88305F98} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041D03E-FD4B-44E0-B742-2D9B88305F98}\ not found.
File C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll not found.
64bit-Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7}\ not found.
File C:\Program Files (x86)\myBabylon_English\tbmyB1.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C7DDDD27-F303-42A5-B979-51559F7DC0F0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7DDDD27-F303-42A5-B979-51559F7DC0F0}\ deleted successfully.
C:\Program Files (x86)\PRMT9\PRMTIE\prmtie.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{F16708B8-D2DF-482D-9DFA-AA8D8894F0F4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F16708B8-D2DF-482D-9DFA-AA8D8894F0F4}\ not found.
File C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Windows Defender deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\POEngine5 deleted successfully.
C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Suche im Duden\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Markierung ubersetzen\ deleted successfully.
C:\Program Files (x86)\PRMT9\PRMTIE\translat.htm moved successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Translate this web page with Babylon\ deleted successfully.
File C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Translate with Babylon\ deleted successfully.
File C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Suche im Duden\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Markierung ubersetzen\ not found.
File C:\Program Files (x86)\PRMT9\PRMTIE\translat.htm not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Translate this web page with Babylon\ not found.
File C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Translate with Babylon\ not found.
File C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{59A861EE-32B3-42cd-8CCA-FC130EDF3A44}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A861EE-32B3-42cd-8CCA-FC130EDF3A44}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{59A861EE-32B3-42cd-8CCA-FC130EDF3A44}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A861EE-32B3-42cd-8CCA-FC130EDF3A44}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{7A2EFD41-E6B3-11D2-89E3-00E0292EE574}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A2EFD41-E6B3-11D2-89E3-00E0292EE574}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{7A2EFD41-E6B3-11D2-89E3-00E0292EE575}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A2EFD41-E6B3-11D2-89E3-00E0292EE575}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478}\ not found.
File C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478}\ not found.
File C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\com\www.msi\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\com.tw\asia.msi\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\com.tw\global.msi\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\imageshack.us\toolbar\ deleted successfully.
Starting removal of ActiveX control {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{67A5F8DC-1A4B-4D66-9F24-A704AD929EEE}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{67A5F8DC-1A4B-4D66-9F24-A704AD929EEE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67A5F8DC-1A4B-4D66-9F24-A704AD929EEE}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67A5F8DC-1A4B-4D66-9F24-A704AD929EEE}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67A5F8DC-1A4B-4D66-9F24-A704AD929EEE}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dfc4963-8894-11dd-8525-001a9261b457}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfc4963-8894-11dd-8525-001a9261b457}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dfc4963-8894-11dd-8525-001a9261b457}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfc4963-8894-11dd-8525-001a9261b457}\ not found.
File I:\pushinst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c6ff34d-2854-11dc-86cd-001a9261b457}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4c6ff34d-2854-11dc-86cd-001a9261b457}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c6ff34d-2854-11dc-86cd-001a9261b457}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4c6ff34d-2854-11dc-86cd-001a9261b457}\ not found.
File I:\pushinst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I\ not found.
File I:\pushinst.exe not found.
C:\Windows\SysWow64\tmp6934.tmp deleted successfully.
C:\ProgramData\ras_0oed.pad moved successfully.
ADS C:\ProgramData\TEMP:CBD3E4DE deleted successfully.
ADS C:\ProgramData\TEMP:74603393 deleted successfully.
ADS C:\ProgramData\TEMP:D37053A2 deleted successfully.
File move failed. C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 scheduled to be moved on reboot.
C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\Tasks\Google Software Updater.job moved successfully.
C:\Windows\Tasks\1-Klick-Wartung.job moved successfully.
C:\Users\Boss\AppData\Roaming\Babylon\updates folder moved successfully.
C:\Users\Boss\AppData\Roaming\Babylon\Content\manuals folder moved successfully.
C:\Users\Boss\AppData\Roaming\Babylon\Content\icons folder moved successfully.
C:\Users\Boss\AppData\Roaming\Babylon\Content folder moved successfully.
C:\Users\Boss\AppData\Roaming\Babylon\Babylon Glossary Builder\3.1.0.10 folder moved successfully.
C:\Users\Boss\AppData\Roaming\Babylon\Babylon Glossary Builder folder moved successfully.
C:\Users\Boss\AppData\Roaming\Babylon folder moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Boss\Desktop\TOOLS\Virus\cmd.bat deleted successfully.
C:\Users\Boss\Desktop\TOOLS\Virus\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: AppData
User: Boss
->Temp folder emptied: 462940369 bytes
->Temporary Internet Files folder emptied: 4987144901 bytes
->Java cache emptied: 54937 bytes
->FireFox cache emptied: 74166339 bytes
->Apple Safari cache emptied: 2103296 bytes
->Flash cache emptied: 16560702 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56519 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56516 bytes
User: UpdatusUser(113)
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 602112 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 11120 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 597504 bytes
Total Files Cleaned = 5.288,00 mb
[EMPTYFLASH]
User: All Users
User: AppData
User: Boss
->Flash cache emptied: 0 bytes
User: Default
->Flash cache emptied: 0 bytes
User: Default User
->Flash cache emptied: 0 bytes
User: Public
User: UpdatusUser
->Flash cache emptied: 0 bytes
User: UpdatusUser(113)
Total Flash Files Cleaned = 0,00 mb
OTL by OldTimer - Version 3.2.55.0 log created on 08012012_163847
Files\Folders moved on Reboot...
File move failed. C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 scheduled to be moved on reboot.
C:\Users\Boss\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Boss\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OOW1GAKY\120938-gvu-trojaner-vista-64bit[1].htm moved successfully.
C:\Users\Boss\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OOW1GAKY\topbuttons[1].xml moved successfully.
C:\Users\Boss\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Boss\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File\Folder C:\Windows\temp\FML5A56.tmp not found!
File\Folder C:\Windows\temp\FMLA3F.tmp not found!
PendingFileRenameOperations files...
[2012.08.01 16:47:51 | 000,004,208 | -H-- | M] () C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 : Unable to obtain MD5
[2012.08.01 16:47:51 | 000,004,208 | -H-- | M] () C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 : Unable to obtain MD5
File C:\Users\Boss\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File C:\Users\Boss\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OOW1GAKY\120938-gvu-trojaner-vista-64bit[1].htm not found!
File C:\Users\Boss\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OOW1GAKY\topbuttons[1].xml not found!
File C:\Users\Boss\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat not found!
File C:\Users\Boss\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT not found!
File C:\Windows\temp\FML5A56.tmp not found!
File C:\Windows\temp\FMLA3F.tmp not found!
Registry entries deleted on Reboot...
 |
|
01.08.2012, 16:48
| #6 |
| /// Helfer-Team | GVU-Trojaner auf Vista 64bit Sehr gut! Wie laeuft der Rechner? 1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 2. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
__________________ --> GVU-Trojaner auf Vista 64bit |
|
01.08.2012, 21:18
| #7 |
| | GVU-Trojaner auf Vista 64bit OK....hier ist der Malware-Report: Code:
ATTFilter Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.01.05 Windows Vista Service Pack 2 x64 NTFS Internet Explorer 9.0.8112.16421 Boss :: BOSS-PC [Administrator] 01.08.2012 18:43:18 mbam-log-2012-08-01 (18-43-18).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|G:\|K:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 959598 Laufzeit: 1 Stunde(n), 48 Minute(n), 48 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Ist trotzdem alles in Ordnung? ...hier die AdwCleaner[R1].txt : Code:
ATTFilter # AdwCleaner v1.800 - Logfile created 08/01/2012 at 21:56:56
# Updated 01/08/2012 by Xplode
# Operating system : Windows (TM) Vista Ultimate Service Pack 2 (64 bits)
# User : Boss - BOSS-PC
# Running from : C:\Users\Boss\Desktop\DOWNLOAD\adwcleaner.exe
# Option [Search]
***** [Services] *****
***** [Files / Folders] *****
Folder Found : C:\Users\Boss\AppData\Local\Babylon
Folder Found : C:\Users\Boss\AppData\Local\Conduit
Folder Found : C:\Users\Boss\AppData\LocalLow\Conduit
Folder Found : C:\Users\Boss\AppData\LocalLow\PriceGong
Folder Found : C:\Users\Boss\AppData\LocalLow\Toolbar4
Folder Found : C:\Users\Boss\AppData\Roaming\QuickStoresToolbar
Folder Found : C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\kax47dyn.default\extensions\{1d8566bd-f06f-4029-a3be-ba80af5a09f3}
Folder Found : C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\kax47dyn.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}
Folder Found : C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\kax47dyn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
Folder Found : C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\kax47dyn.default\extensions\{f16708b8-d2df-482d-9dfa-aa8d8894f0f4}
Folder Found : C:\ProgramData\Babylon
Folder Found : C:\Program Files (x86)\AskBarDis
Folder Found : C:\Program Files (x86)\Babylon
Folder Found : C:\Program Files (x86)\Conduit
Folder Found : C:\Program Files (x86)\DAEMON Tools Toolbar
Folder Found : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com
Folder Found : C:\Program Files (x86)\Mozilla Firefox\Extensions\quickstores@quickstores.de
Folder Found : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar
File Found : C:\Users\Boss\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url
File Found : C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url
File Found : C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\kax47dyn.default\searchplugins\daemon-search.xml
File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Babylon.lnk
***** [Registry] *****
[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT1460988[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2529008[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2707060[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3030623
Key Found : HKCU\Software\AppDataLow\AskBarDis
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\PriceGong
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\Babylon
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Headlight
Key Found : HKCU\Software\HotSpot_Shield_Elite
Key Found : HKCU\Software\myBabylon_English
Key Found : HKCU\Software\Softonic
Key Found : HKCU\Toolbar
Key Found : HKLM\SOFTWARE\Avanquest_App'-Anwendungsleiste
Key Found : HKLM\SOFTWARE\Babylon
Key Found : HKLM\SOFTWARE\Classes\BabyDict
Key Found : HKLM\SOFTWARE\Classes\BabyGloss
Key Found : HKLM\SOFTWARE\Classes\BabyOptFile
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\DT Soft
Key Found : HKLM\SOFTWARE\Freeze.com
Key Found : HKLM\SOFTWARE\HotSpot_Shield_Elite
Key Found : HKLM\SOFTWARE\Iminent
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Babylon.exe
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ask Toolbar_is1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avanquest_App'-Anwendungsleiste Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Babylon
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HotSpot_Shield_Elite Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\myBabylon_English Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickStores-Toolbar_is1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RadioHoops Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Key Found : HKLM\SOFTWARE\myBabylon_English
Key Found : HKLM\SOFTWARE\RadioHoops
Key Found : HKLM\SOFTWARE\Wise Solutions
[x64] Key Found : HKCU\Software\AppDataLow\AskBarDis
[x64] Key Found : HKCU\Software\AppDataLow\Software\Conduit
[x64] Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
[x64] Key Found : HKCU\Software\AppDataLow\Software\PriceGong
[x64] Key Found : HKCU\Software\AppDataLow\Software\SmartBar
[x64] Key Found : HKCU\Software\AppDataLow\Toolbar
[x64] Key Found : HKCU\Software\Babylon
[x64] Key Found : HKCU\Software\Conduit
[x64] Key Found : HKCU\Software\Headlight
[x64] Key Found : HKCU\Software\HotSpot_Shield_Elite
[x64] Key Found : HKCU\Software\myBabylon_English
[x64] Key Found : HKCU\Software\Softonic
[x64] Key Found : HKCU\Toolbar
[x64] Key Found : HKLM\SOFTWARE\Classes\BabyDict
[x64] Key Found : HKLM\SOFTWARE\Classes\BabyGloss
[x64] Key Found : HKLM\SOFTWARE\Classes\BabyOptFile
***** [Registre - GUID] *****
Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{0702A2B6-13AA-4090-9E01-BCDC85DD933F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{08993A7C-E764-4172-9627-BFB5EA6897B2}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{128A6C66-AC6A-4617-8268-AB7F47B7215E}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{571715D7-3395-4DF0-B43C-784836209E60}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{622FD888-4E91-4D68-84D4-7262FD0811BF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6AC0BB10-C922-45e2-857D-2A368FE749E5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B0DE3308-5D5A-470D-81B9-634FC078393B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2E449EBA-CCDD-4117-866D-D27ABA3B2490}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6AEB4731-E39F-46DD-8782-A34C365F2AEE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6406159F-993D-43A4-BB95-9CEE3F476887}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7C064CFF-2112-4120-ABB2-D50D7464D330}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4634804A-F0B0-4A74-A550-FC0EEF8A4362}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4C07EA4F-5F52-4222-B170-4CD9ED33BAEA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C44FEFF4-EF0C-4CF7-83D0-92B4266A32B9}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F131923C-381D-4E4C-A472-4A17118FD742}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D2E5FA06-DCC7-46F9-BEFF-BFD06F69B9B2}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B2045E9-D29C-4A85-BF8E-AB76BCC176B0}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FD1DEF82-611D-4FE9-99F5-C485A81351E4}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{32083A01-0597-4799-84A6-FCD4906B08DF}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7FB41B3-8024-47BA-AE57-568E85483540}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D724F562-40F6-4C94-93F5-062BAAE80BDE}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{22B226C1-312A-4E03-8DF6-99B3FFC40B9C}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2E449EBA-CCDD-4117-866D-D27ABA3B2490}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6AEB4731-E39F-46DD-8782-A34C365F2AEE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6406159F-993D-43A4-BB95-9CEE3F476887}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7C064CFF-2112-4120-ABB2-D50D7464D330}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B0DE3308-5D5A-470D-81B9-634FC078393B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1D8566BD-F06F-4029-A3BE-BA80AF5A09F3}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F16708B8-D2DF-482D-9DFA-AA8D8894F0F4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0C3110F6-A2E6-4B6F-9516-6DC345E1F7EF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D8566BD-F06F-4029-A3BE-BA80AF5A09F3}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F16708B8-D2DF-482D-9DFA-AA8D8894F0F4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0C3110F6-A2E6-4B6F-9516-6DC345E1F7EF}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{977AE9CC-AF83-45E8-9E03-E2798216E2D5}]
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
[x64] Key Found : HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{4634804A-F0B0-4A74-A550-FC0EEF8A4362}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{4C07EA4F-5F52-4222-B170-4CD9ED33BAEA}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{C44FEFF4-EF0C-4CF7-83D0-92B4266A32B9}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{F131923C-381D-4E4C-A472-4A17118FD742}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D2E5FA06-DCC7-46F9-BEFF-BFD06F69B9B2}
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{201F27D4-3704-41D6-89C1-AA35E39143ED}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B0DE3308-5D5A-470D-81B9-634FC078393B}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1D8566BD-F06F-4029-A3BE-BA80AF5A09F3}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F16708B8-D2DF-482D-9DFA-AA8D8894F0F4}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0C3110F6-A2E6-4B6F-9516-6DC345E1F7EF}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D8566BD-F06F-4029-A3BE-BA80AF5A09F3}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F16708B8-D2DF-482D-9DFA-AA8D8894F0F4}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0C3110F6-A2E6-4B6F-9516-6DC345E1F7EF}
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{977AE9CC-AF83-45E8-9E03-E2798216E2D5}]
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v3.5.7 (de)
Profile name : default
File : C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\kax47dyn.default\prefs.js
Found : user_pref("extensions.snipit.askTbInstalled", true);
*************************
AdwCleaner[R1].txt - [15232 octets] - [01/08/2012 21:56:56]
########## EOF - C:\AdwCleaner[R1].txt - [15361 octets] ##########
|
|
02.08.2012, 03:53
| #8 |
| /// Helfer-Team | GVU-Trojaner auf Vista 64bit Sehr gut! Keine Angst, da muss man nix kaufen 
danach: Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html |
|
02.08.2012, 15:41
| #9 |
| | GVU-Trojaner auf Vista 64bit PUHH - Ich hoffe, das nimmt irgendwann ein Ende  Im Anhang sind meine beiden Reports ACHTUNG: Im Emsisoft-Report sehe ich einige wichtige Dateien, die das Programm als potentiell gefährlich einschätzt. Sie sind es aber nicht! (z.B. 2x Punkbuster oder Flight1 -Dateien für den Flugsimulator) Ich glaube, wir haben eine Grenze erreicht, wo weitere Streichungen evtl. Schaden verursachen könnten! OK....jetzt du wieder |
|
02.08.2012, 17:05
| #10 |
| /// Helfer-Team | GVU-Trojaner auf Vista 64bit Bald sind wir durch  Sehr gut! Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
|
|
02.08.2012, 19:01
| #11 |
| | GVU-Trojaner auf Vista 64bit Lieber t'john Hier ist das Ergebnis: Code:
ATTFilter ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=8dccaa753950874a96e86654b00dd90c
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-02 06:02:10
# local_time=2012-08-02 08:02:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=2304 16777215 100 0 0 0 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 56 18213 181453874 0 0
# compatibility_mode=8192 67108863 100 0 93831 93831 0 0
# scanned=33906
# found=0
# cleaned=0
# scan_time=655
Ich würde gerne die Programme behalten! Herzlich  Robert Geändert von earnorbust (02.08.2012 um 19:11 Uhr) |
|
03.08.2012, 13:46
| #12 |
| /// Helfer-Team | GVU-Trojaner auf Vista 64bit Es lohnt nicht diese zu behalten. MBAM kannst du behalten. Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html |
|
03.08.2012, 20:28
| #13 |
| | GVU-Trojaner auf Vista 64bit Sorry... Aber in der Systemsteuerung/Programme gibt es kein Java-Symbol zum anklicken. ** Ahh es lag daran, dass ich auch das Java-Programm "J2SE Runtime Environment deinstalliert habe (ich dachte, es wäre auch ein altes Java-Programm) Jetzt habe ich die jre-7-windows-x64 geladen und installiert - ABER es hat kein Update-Reiter!! Du sagst oben: alle Häkchen setzten - auch die Programme und Applets???? Was ist, wenn andere Programme die Applets brauchen? Was jetzt? Geändert von earnorbust (03.08.2012 um 20:53 Uhr) |
|
04.08.2012, 08:04
| #14 |
| | GVU-Trojaner auf Vista 64bit Java Control Panel war unter 32bit Lösungen (habe ich nicht gesehen). Habe jetzt Java 7 update 5 installiert und Update-Management auf wöchentlich gesetzt. Alle Altversionen gelöscht und Applets gesäubert. Gibt es noch etwas zu tun? Gruß Robert |
|
04.08.2012, 15:06
| #15 |
| /// Helfer-Team | GVU-Trojaner auf Vista 64bit Sehr gut! damit bist Du sauber und entlassen! Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Zurücksetzen der Sicherheitszonen Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen. Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html Aufräumen mit CCleaner Lasse mit CCleaner (Download) (Anleitung) Fehler in der
Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html |
|
| Themen zu GVU-Trojaner auf Vista 64bit |
| askbar, bho, bingbar, bonjour, canon, cloud, conduit, converter, desktop, error, euro, excel, firefox, flash player, frage, google, google earth, helper, hotspot, hotspot shield, iminent toolbar, installation, launch, logfile, mp3, nvidia update, object, oneclickdownloader, plug-in, realtek, registry, safer networking, scan, software, system, trojaner, usb 3.0, virus, vista, wiso, zahlung |
Linear-Darstellung
