| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Mystart incredibar EntfernenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
06.08.2012, 02:37
| #16 |
| /// Helfer-Team  |  Mystart incredibar Entfernen Versuche: In die Adressleiste des Browsers den Befehl "about:config" einfügen. Rechtsklick auf "browser.newtab.url" und auf bearbeiten klicken. Diese in "about:newtab" umbenennen. dann: Bitte neu Laden! Downloade Dir bitte AdwCleaner auf deinen Desktop.
|
|
06.08.2012, 10:02
| #17 |
 | Mystart incredibar Entfernen AdwCleaner Logfile
__________________Code:
ATTFilter # AdwCleaner v1.800 - Logfile created 08/06/2012 at 10:51:43
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Max - MAX-PC
# Running from : C:\Users\Max\Desktop\adwcleaner.exe
# Option [Search]
***** [Services] *****
***** [Files / Folders] *****
Folder Found : C:\Users\Max\AppData\LocalLow\boost_interprocess
***** [Registry] *****
[x64] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
***** [Registre - GUID] *****
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v14.0.1 (de)
Profile name : default
File : C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\xzbo2qco.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [31921 octets] - [03/08/2012 15:47:22]
AdwCleaner[S1].txt - [31164 octets] - [03/08/2012 17:05:22]
AdwCleaner[R2].txt - [988 octets] - [06/08/2012 10:51:43]
########## EOF - C:\AdwCleaner[R2].txt - [1115 octets] ##########
|
|
06.08.2012, 14:56
| #18 |
| /// Helfer-Team | Mystart incredibar Entfernen
Immer noch da?
__________________ |
|
06.08.2012, 16:02
| #19 |
| | Mystart incredibar Entfernen AdwCleaner-Log Code:
ATTFilter # AdwCleaner v1.800 - Logfile created 08/06/2012 at 16:55:22
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Max - MAX-PC
# Running from : C:\Users\Max\Desktop\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
Folder Deleted : C:\Users\Max\AppData\LocalLow\boost_interprocess
***** [Registry] *****
***** [Registre - GUID] *****
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v14.0.1 (de)
Profile name : default
File : C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\xzbo2qco.default\prefs.js
Deleted : user_pref("browser.newtab.url", "hxxp://mystart.incredibar.com/mb139?a=6R8AK0dKNr&loc=FF_NT");
*************************
AdwCleaner[R1].txt - [31921 octets] - [03/08/2012 15:47:22]
AdwCleaner[S1].txt - [31164 octets] - [03/08/2012 17:05:22]
AdwCleaner[R2].txt - [1114 octets] - [06/08/2012 10:51:43]
AdwCleaner[S2].txt - [1030 octets] - [06/08/2012 16:55:22]
########## EOF - C:\AdwCleaner[S2].txt - [1158 octets] ##########
|
|
06.08.2012, 16:04
| #20 |
| /// Helfer-Team | Mystart incredibar Entfernen |
|
07.08.2012, 00:17
| #21 |
| | Mystart incredibar Entfernen Der SuperAntiSpyware-Log Code:
ATTFilter SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 08/06/2012 at 11:24 PM
Application Version : 5.5.1012
Core Rules Database Version : 9017
Trace Rules Database Version: 6829
Scan type : Complete Scan
Total Scan Time : 00:36:37
Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator
Memory items scanned : 627
Memory threats detected : 0
Registry items scanned : 66191
Registry threats detected : 0
File items scanned : 46795
File threats detected : 89
Adware.Tracking Cookie
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@ad.adition[2].txt [ /ad.adition ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@ad.zanox[1].txt [ /ad.zanox ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@adcentriconline[1].txt [ /adcentriconline ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@adform[1].txt [ /adform ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@ads.adk2[1].txt [ /ads.adk2 ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@ads.adk2[3].txt [ /ads.adk2 ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@adx.chip[1].txt [ /adx.chip ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@aim4media[1].txt [ /aim4media ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@apmebf[1].txt [ /apmebf ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@at.atwola[1].txt [ /at.atwola ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@content.yieldmanager[1].txt [ /content.yieldmanager ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@content.yieldmanager[3].txt [ /content.yieldmanager ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@dyntracker[2].txt [ /dyntracker ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@eas.apm.emediate[2].txt [ /eas.apm.emediate ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@harrenmedianetwork[1].txt [ /harrenmedianetwork ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@imrworldwide[2].txt [ /imrworldwide ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@imrworldwide[3].txt [ /imrworldwide ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@invitemedia[1].txt [ /invitemedia ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@invitemedia[2].txt [ /invitemedia ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@lucidmedia[1].txt [ /lucidmedia ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@media6degrees[1].txt [ /media6degrees ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@media6degrees[2].txt [ /media6degrees ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@revsci[2].txt [ /revsci ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@revsci[3].txt [ /revsci ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@ru4[1].txt [ /ru4 ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@ru4[2].txt [ /ru4 ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@tracking.quisma[1].txt [ /tracking.quisma ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@www.active-tracking[2].txt [ /www.active-tracking ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@www.zanox-affiliate[2].txt [ /www.zanox-affiliate ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@yieldmanager[2].txt [ /yieldmanager ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\max@zanox-affiliate[2].txt [ /zanox-affiliate ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\RAYX9175.txt [ /mediaplex.com ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\JEPG8G8K.txt [ /zanox.com ]
C:\Users\Max\AppData\Roaming\Microsoft\Windows\Cookies\8IY6DUIB.txt [ /ad.zanox.com ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\max@clkads[4].txt [ Cookie:max@clkads.com/adServe ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\max@clkads[6].txt [ Cookie:max@clkads.com/adServe/banners ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@zanox-affiliate[1].txt [ Cookie:max@zanox-affiliate.de/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@adxpose[1].txt [ Cookie:max@adxpose.com/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@stats.ilivid[1].txt [ Cookie:max@stats.ilivid.com/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@webmasterplan[1].txt [ Cookie:max@webmasterplan.com/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@server.lon.liveperson[2].txt [ Cookie:max@server.lon.liveperson.net/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@revsci[2].txt [ Cookie:max@revsci.net/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@yadro[1].txt [ Cookie:max@yadro.ru/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@traffictrack[1].txt [ Cookie:max@traffictrack.de/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@ad2.clickhype[1].txt [ Cookie:max@ad2.clickhype.com/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@adsrv1.admediate[1].txt [ Cookie:max@adsrv1.admediate.com/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@www.zanox-affiliate[1].txt [ Cookie:max@www.zanox-affiliate.de/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@banner.electronic-arts[1].txt [ Cookie:max@banner.electronic-arts.de/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@clkads[1].txt [ Cookie:max@clkads.com/adServe/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@server.lon.liveperson[1].txt [ Cookie:max@server.lon.liveperson.net/hc/86867628 ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@tracking.adtraffic[1].txt [ Cookie:max@tracking.adtraffic.de/tracker/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@tracking.quisma[1].txt [ Cookie:max@tracking.quisma.com/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@im.banner.t-online[1].txt [ Cookie:max@im.banner.t-online.de/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@adform[2].txt [ Cookie:max@adform.net/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@himedia.individuad[1].txt [ Cookie:max@himedia.individuad.net/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@clkads[3].txt [ Cookie:max@clkads.com/adServe/static/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@ad.zanox[2].txt [ Cookie:max@ad.zanox.com/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@track.webtrekk[1].txt [ Cookie:max@track.webtrekk.net/523478367474333/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@tracking.mindshare[1].txt [ Cookie:max@tracking.mindshare.de/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@track.effiliation[1].txt [ Cookie:max@track.effiliation.com/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@invitemedia[1].txt [ Cookie:max@invitemedia.com/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@ad.dyntracker[2].txt [ Cookie:max@ad.dyntracker.de/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@content.yieldmanager[1].txt [ Cookie:max@content.yieldmanager.com/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@adx.chip[1].txt [ Cookie:max@adx.chip.de/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@unitymedia[1].txt [ Cookie:max@unitymedia.de/ ]
C:\USERS\MAX\AppData\Roaming\Microsoft\Windows\Cookies\Low\max@www.usenext[2].txt [ Cookie:max@www.usenext.de/ ]
C:\USERS\MAX\Cookies\max@ru4[2].txt [ Cookie:max@ru4.com/ ]
C:\USERS\MAX\Cookies\RAYX9175.txt [ Cookie:max@mediaplex.com/ ]
C:\USERS\MAX\Cookies\max@zanox-affiliate[2].txt [ Cookie:max@zanox-affiliate.de/ ]
C:\USERS\MAX\Cookies\max@media6degrees[1].txt [ Cookie:max@media6degrees.com/ ]
C:\USERS\MAX\Cookies\max@revsci[3].txt [ Cookie:max@revsci.net/ ]
C:\USERS\MAX\Cookies\max@aim4media[1].txt [ Cookie:max@aim4media.com/ ]
C:\USERS\MAX\Cookies\max@www.zanox-affiliate[2].txt [ Cookie:max@www.zanox-affiliate.de/ ]
C:\USERS\MAX\Cookies\max@dyntracker[2].txt [ Cookie:max@dyntracker.com/ ]
C:\USERS\MAX\Cookies\max@yieldmanager[2].txt [ Cookie:max@yieldmanager.net/ ]
C:\USERS\MAX\Cookies\max@clkads[4].txt [ Cookie:max@clkads.com/adServe ]
C:\USERS\MAX\Cookies\max@tracking.quisma[1].txt [ Cookie:max@tracking.quisma.com/ ]
C:\USERS\MAX\Cookies\max@adform[1].txt [ Cookie:max@adform.net/ ]
C:\USERS\MAX\Cookies\max@at.atwola[1].txt [ Cookie:max@at.atwola.com/ ]
C:\USERS\MAX\Cookies\max@lucidmedia[1].txt [ Cookie:max@lucidmedia.com/ ]
C:\USERS\MAX\Cookies\max@clkads[6].txt [ Cookie:max@clkads.com/adServe/banners ]
C:\USERS\MAX\Cookies\8IY6DUIB.txt [ Cookie:max@ad.zanox.com/ ]
C:\USERS\MAX\Cookies\max@apmebf[1].txt [ Cookie:max@apmebf.com/ ]
C:\USERS\MAX\Cookies\max@invitemedia[2].txt [ Cookie:max@invitemedia.com/ ]
C:\USERS\MAX\Cookies\max@harrenmedianetwork[1].txt [ Cookie:max@harrenmedianetwork.com/ ]
C:\USERS\MAX\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MAX@AD2.DOUBLEPIMP[1].TXT [ /AD2.DOUBLEPIMP ]
C:\USERS\MAX\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MAX@EAS.APM.EMEDIATE[2].TXT [ /EAS.APM.EMEDIATE ]
C:\USERS\MAX\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MAX@IMRWORLDWIDE[2].TXT [ /IMRWORLDWIDE ]
C:\USERS\MAX\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MAX@ZANOX[2].TXT [ /ZANOX ]
|
|
07.08.2012, 13:28
| #22 |
| /// Helfer-Team | Mystart incredibar Entfernen Lasse alle Funde loeschen. Ist es noch da? Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten. |
|
07.08.2012, 18:47
| #23 |
| | Mystart incredibar Entfernen Ich hab alles gelöscht und es ist leider immer noch da. Code:
ATTFilter Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.07.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Max :: MAX-PC [Administrator] 07.08.2012 18:33:55 mbam-log-2012-08-07 (18-33-55).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 398817 Laufzeit: 50 Minute(n), 3 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
07.08.2012, 19:13
| #24 |
| /// Helfer-Team | Mystart incredibar Entfernen Firefox - Reste von Toolbars über about:config entfernen Firefox starten In die Adresszeile eingeben => about:config => Enter drücken Bestätige, dass Du vorsichtig sein wirst. Folgende Einstellungen sind nicht korrekt und müssen geändert werden: Gib incredi unter Filter ein. Es erscheinen alle Zeilen, die das Suchwort enthalten. Um die Einträge zurückzusetzen, einfach rechte Maustaste auf die einzelnen Zeilen und zurücksetzen wählen. Wenn alle Zeilen zurückgesetzt sind, schließe den Tab von about:config. Schaue auch unter Extras => Addons => Erweiterungen Wenn da noch etwas von IncrediBar zu finden ist, bitte entfernen. Ebenfalls unter Suchmaschinen verwalten schauen, ob Du da noch etwas von IncrediBar findest, ebenfalls dort entfernen und z. B. Google als Standard-Suchmaschine einstellen. |
|
07.08.2012, 21:20
| #25 |
| | Mystart incredibar Entfernen Bei der Suche von "incredi" wurde nur "browser.newtab.url" angezeigt. Und unter Erweiterungen war auch nichts von "incrediBar" zu finden. Unter Suchmaschinen verwalten war nur Google in der Liste. |
|
07.08.2012, 23:34
| #26 |
| /// Helfer-Team | Mystart incredibar Entfernen Ist es immer noch da? |
|
08.08.2012, 15:07
| #27 |
| | Mystart incredibar Entfernen Ja es ist immer noch da. |
|
08.08.2012, 15:27
| #28 |
| /// Helfer-Team | Mystart incredibar Entfernen Malware mit Combofix beseitigen Lade Combofix von einem der folgenden Download-Spiegel herunter: BleepingComputer.com - ForoSpyware.com und speichere das Programm auf den Desktop, nicht woanders hin, das ist wichtig! Beachte die ausführliche Original-Anleitung. Zurzeit ist Combofix auf folgenden Windows-Versionen lauffähig:
Vorbereitung und wichtige Hinweise
Combofix nicht auf eigene Faust einsetzen. Wenn keine entsprechende Infektion vorliegt, kann das den Rechner lahmlegen und/oder nachhaltig schädigen! |
|
08.08.2012, 21:15
| #29 |
| | Mystart incredibar Entfernen ComboFix.txt Code:
ATTFilter ComboFix 12-08-08.01 - Max 08.08.2012 21:31:36.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4095.2533 [GMT 2:00]
ausgeführt von:: c:\users\Max\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Lavasoft Ad-Watch Live! Virenschutz *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Max\AppData\Local\lame_enc.dll
c:\users\Max\AppData\Local\no23xwrapper.dll
c:\users\Max\AppData\Local\ogg.dll
c:\users\Max\AppData\Local\vorbis.dll
c:\users\Max\AppData\Local\vorbisenc.dll
c:\users\Max\AppData\Local\vorbisfile.dll
c:\users\Max\AppData\Roaming\Local
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\10.ddi
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\11.ddi
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\12.ddi
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\13.ddi
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\14.ddi
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Bones.s06e03.avi.ddr
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\BroCode.S05E09.German.Subbed.HDTV.XviD.avi.ddr
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\HIMYMS06E10en_gersub.avi.ddr
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\How.I.Met.Your.Mother.S05E08.The.Playbook.HDTV.XviD_FQM_neu.avi.ddr
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\How.I.Met.Your.Mother.S06E09.GERMAN.SUBBED.HDTV.XViD.avi.ddr
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Bones.S05E19.German.Custom.Subbed..avi.ddp
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Bones.s06e03.avi.ddp
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\bt_bones_S05E21_ger_sub_xvid.avi(2).ddp
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\bt_bones_S05E21_ger_sub_xvid.avi(3).ddp
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\bt_bones_S05E21_ger_sub_xvid.avi(4).ddp
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\bt_bones_S05E21_ger_sub_xvid.avi.ddp
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\f7370335087567m47C97Sz6c4FfsNVA52iM.avi.ddp
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\How.I.Met.Your.Mother.S05E06.gersub.avi.ddp
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\How.I.Met.Your.Mother.S05E08.The.Playbook.HDTV.XviD_FQM_neu.avi
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\isd_allehassenchris_s04e05.avi.ddp
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\itg_himym_s04e01.avi(2).ddp
c:\users\Max\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\itg_himym_s04e01.avi.ddp
c:\windows\IsUn0407.exe
c:\windows\msxml4-KB954430-enu.LOG
c:\windows\TEMP\logishrd\LVPrcInj01.dll . . . . Nicht in der Lage zu löschen
c:\windows\TEMP\logishrd\LVPrcInj02.dll . . . . Nicht in der Lage zu löschen
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-07-08 bis 2012-08-08 ))))))))))))))))))))))))))))))
.
.
2012-08-08 19:36 . 2012-08-08 19:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-05 10:54 . 2012-08-05 10:54 -------- d-----w- c:\program files (x86)\Oracle
2012-08-04 15:22 . 2012-08-04 15:22 -------- d-----w- c:\windows\system32\SPReview
2012-08-04 15:22 . 2012-08-04 15:22 -------- d-----w- c:\windows\system32\EventProviders
2012-08-04 15:19 . 2010-11-05 01:57 48976 ----a-w- c:\windows\system32\netfxperf.dll
2012-08-04 15:19 . 2010-11-05 01:57 1942856 ----a-w- c:\windows\system32\dfshim.dll
2012-08-04 15:19 . 2010-11-05 01:58 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
2012-08-04 15:19 . 2010-11-20 13:27 12288 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2012-08-04 15:19 . 2010-11-20 13:27 14967808 ----a-w- c:\program files\DVD Maker\OmdBase.dll
2012-08-04 15:19 . 2010-11-20 13:27 3715584 ----a-w- c:\windows\system32\mstscax.dll
2012-08-04 15:19 . 2010-11-20 13:26 1838080 ----a-w- c:\windows\system32\d3d10warp.dll
2012-08-04 15:19 . 2010-11-20 11:07 59392 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys
2012-08-04 15:19 . 2010-11-20 12:19 3215872 ----a-w- c:\windows\SysWow64\mstscax.dll
2012-08-04 15:17 . 2010-11-20 13:27 611840 ----a-w- c:\windows\system32\wpd_ci.dll
2012-08-04 15:16 . 2010-11-20 12:21 363008 ----a-w- c:\windows\SysWow64\wbemcomn.dll
2012-08-04 15:16 . 2010-11-20 12:21 189952 ----a-w- c:\program files (x86)\Windows Portable Devices\sqmapi.dll
2012-08-04 15:16 . 2010-11-20 12:19 606208 ----a-w- c:\windows\SysWow64\wbem\fastprox.dll
2012-08-04 15:16 . 2010-11-20 13:27 529408 ----a-w- c:\windows\system32\wbemcomn.dll
2012-08-04 15:16 . 2010-11-20 13:27 244736 ----a-w- c:\program files\Windows Portable Devices\sqmapi.dll
2012-08-04 15:16 . 2010-11-20 13:27 244736 ----a-w- c:\windows\system32\sqmapi.dll
2012-08-04 14:48 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll
2012-08-04 14:48 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll
2012-08-04 14:48 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2012-08-04 14:39 . 2012-08-04 14:39 -------- d-----w- c:\windows\SysWow64\wbem\en-US
2012-08-04 14:39 . 2012-08-04 14:39 -------- d-----w- c:\windows\system32\wbem\en-US
2012-08-04 14:29 . 2012-08-04 14:29 -------- d-----w- c:\program files (x86)\Microsoft
2012-08-04 14:21 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-08-04 14:07 . 2012-07-16 00:40 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1F555576-9E2F-478D-9A99-F3CFDFF1AC6E}\mpengine.dll
2012-08-04 13:54 . 2012-08-04 13:54 -------- d-----w- c:\program files (x86)\Microsoft CAPICOM 2.1.0.2
2012-08-04 13:49 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2012-08-04 13:40 . 2012-07-03 01:19 59701280 ----a-w- c:\windows\system32\MRT.exe
2012-08-04 13:29 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-08-04 13:29 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-08-04 13:29 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-08-04 13:29 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-08-04 13:29 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-08-04 13:29 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-08-04 13:29 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-08-04 13:18 . 2011-11-17 06:35 395776 ----a-w- c:\windows\system32\webio.dll
2012-08-04 13:18 . 2011-11-17 05:35 314880 ----a-w- c:\windows\SysWow64\webio.dll
2012-08-04 13:17 . 2011-05-03 05:29 976896 ----a-w- c:\windows\system32\inetcomm.dll
2012-08-04 13:17 . 2011-05-03 04:30 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
2012-08-04 13:17 . 2011-02-18 10:51 31232 ----a-w- c:\windows\system32\prevhost.exe
2012-08-04 13:17 . 2011-02-18 05:39 31232 ----a-w- c:\windows\SysWow64\prevhost.exe
2012-08-04 13:17 . 2011-11-05 05:32 2048 ----a-w- c:\windows\system32\tzres.dll
2012-08-04 13:17 . 2011-11-05 04:26 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2012-08-04 13:17 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
2012-08-04 13:17 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2012-08-04 09:01 . 2011-03-12 12:08 1465344 ----a-w- c:\windows\system32\XpsPrint.dll
2012-08-04 09:01 . 2011-03-12 11:23 870912 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2012-08-04 08:59 . 2011-03-11 06:34 1359872 ----a-w- c:\windows\system32\mfc42u.dll
2012-08-04 08:56 . 2012-04-28 03:55 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-08-04 08:56 . 2012-05-04 11:06 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-04 08:56 . 2012-05-04 10:03 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-08-04 08:55 . 2012-05-04 10:03 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-08-04 08:55 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-08-04 08:55 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-08-04 08:55 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-08-04 08:55 . 2011-12-28 03:59 498688 ----a-w- c:\windows\system32\drivers\afd.sys
2012-08-04 08:55 . 2012-04-07 12:31 3216384 ----a-w- c:\windows\system32\msi.dll
2012-08-04 08:55 . 2012-04-07 11:26 2342400 ----a-w- c:\windows\SysWow64\msi.dll
2012-08-04 08:54 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-08-04 08:54 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-08-04 08:54 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-08-04 08:54 . 2011-04-29 03:06 467456 ----a-w- c:\windows\system32\drivers\srv.sys
2012-08-04 08:54 . 2011-04-29 03:05 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-08-04 08:54 . 2011-04-29 03:05 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-08-04 08:54 . 2012-04-24 05:37 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2012-08-04 08:54 . 2012-04-24 05:37 140288 ----a-w- c:\windows\system32\cryptnet.dll
2012-08-04 08:54 . 2012-04-24 05:37 1462272 ----a-w- c:\windows\system32\crypt32.dll
2012-08-04 08:54 . 2012-04-24 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2012-08-04 08:54 . 2012-04-24 04:36 1158656 ----a-w- c:\windows\SysWow64\crypt32.dll
2012-08-04 08:54 . 2012-04-24 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2012-08-04 08:49 . 2011-03-03 06:24 183296 ----a-w- c:\windows\system32\dnsrslvr.dll
2012-08-04 08:49 . 2011-03-03 06:24 357888 ----a-w- c:\windows\system32\dnsapi.dll
2012-08-04 08:49 . 2011-03-03 06:21 30208 ----a-w- c:\windows\system32\dnscacheugc.exe
2012-08-04 08:49 . 2011-03-03 05:36 28672 ----a-w- c:\windows\SysWow64\dnscacheugc.exe
2012-08-04 08:49 . 2012-05-01 05:40 209920 ----a-w- c:\windows\system32\profsvc.dll
2012-08-04 08:49 . 2010-11-20 13:27 33792 ----a-w- c:\windows\system32\profprov.dll
2012-08-04 08:48 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll
2012-08-04 08:48 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2012-08-04 08:48 . 2011-12-16 08:46 634880 ----a-w- c:\windows\system32\msvcrt.dll
2012-08-04 08:48 . 2011-12-16 07:52 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll
2012-08-04 08:48 . 2011-08-27 05:37 861696 ----a-w- c:\windows\system32\oleaut32.dll
2012-08-04 08:48 . 2011-08-27 05:37 331776 ----a-w- c:\windows\system32\oleacc.dll
2012-08-04 08:48 . 2011-08-27 04:26 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2012-08-04 08:48 . 2011-08-27 04:26 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
2012-08-04 08:48 . 2011-02-23 04:55 90624 ----a-w- c:\windows\system32\drivers\bowser.sys
2012-08-04 08:48 . 2011-02-12 11:34 267776 ----a-w- c:\windows\system32\FXSCOVER.exe
2012-08-04 08:48 . 2010-11-20 13:25 974336 ----a-w- c:\windows\system32\WFS.exe
2012-08-04 08:47 . 2012-03-30 11:35 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-08-04 08:47 . 2010-11-20 13:33 288640 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-08-02 12:28 . 2012-08-02 12:28 -------- d-----w- C:\_OTL
2012-08-02 12:10 . 2012-08-02 12:10 -------- d-----w- c:\programdata\ZA_PreservedFiles
2012-08-01 21:32 . 2012-08-01 21:32 -------- d-----w- c:\users\Max\AppData\Roaming\Malwarebytes
2012-08-01 21:32 . 2012-08-01 21:32 -------- d-----w- c:\programdata\Malwarebytes
2012-08-01 21:32 . 2012-08-01 21:32 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-08-01 21:32 . 2012-07-03 11:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-08-01 08:36 . 2012-08-01 08:36 -------- d-----w- c:\programdata\Premium
2012-08-01 08:29 . 2012-08-01 08:29 -------- d-----w- c:\users\Max\AppData\Roaming\SendSpace
2012-08-01 08:28 . 2012-08-01 08:28 453 ----a-w- C:\user.js
2012-08-01 08:25 . 2012-08-01 09:05 -------- d-----w- c:\program files (x86)\Optimizer Pro
2012-07-12 13:19 . 2012-07-21 01:53 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2012-07-12 13:19 . 2012-07-20 19:24 68576 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-07-12 13:19 . 2012-07-20 19:24 573920 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-07-12 13:19 . 2012-07-20 19:24 157608 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2012-07-12 13:19 . 2012-07-20 19:24 113120 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe
2012-07-12 13:19 . 2012-07-12 13:19 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-07-12 13:19 . 2012-07-12 13:19 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-04 15:35 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2012-08-04 15:35 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2012-07-05 20:06 . 2012-06-05 10:48 772544 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-07-05 20:06 . 2011-02-17 21:28 687544 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-06-18 23:12 . 2011-03-28 16:36 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-06-07 11:48 . 2012-06-07 11:49 955848 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-06-07 11:48 . 2012-06-07 11:49 839112 ----a-w- c:\windows\system32\deployJava1.dll
2012-06-02 22:19 . 2012-06-23 07:36 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-23 07:37 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-23 07:37 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-23 07:37 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-23 07:36 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-23 07:37 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-23 07:36 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-23 07:36 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 13:15 . 2012-06-23 07:36 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-05-31 10:25 . 2010-01-14 19:13 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Vid"="c:\program files (x86)\Logitech webcam\Logitech Vid\vid.exe" [2009-04-30 5472016]
"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 44544]
"AutoStartNPSAgent"="c:\program files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-04-02 102400]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LogitechQuickCamRibbon"="c:\program files\Logitech webcam\Logitech WebCam Software\LWS.exe" [2009-05-08 2780432]
"TkBellExe"="c:\program files (x86)\Common Files\Real\Update_OB\realsched.exe" [2010-06-26 202256]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"DivX Download Manager"="c:\program files (x86)\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files (x86)\itunes\iTunesHelper.exe" [2012-01-16 421736]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
.
c:\users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files (x86)\Logitech Mx518\SetPoint\SETPOINT.EXE [2010-1-16 1148944]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-10-29 2152152]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [2011-10-19 17152]
R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [2009-04-30 271640]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-20 113120]
R3 MSICDSetup;MSICDSetup;E:\CDriver64.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-02 51712]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2011-08-18 69376]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-11 27760]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-08 86224]
S2 LVPrcS64;Process Monitor;c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-04-30 190488]
S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [2009-04-30 30232]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2009-04-30 327576]
S3 LVUVC64;Logitech Webcam 200(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [2009-04-30 6377496]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-22 215040]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-08-08 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-08-18 13:53]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 134160]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\xzbo2qco.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-Herrscher des Olymp - Zeus - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.9"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9f.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-08-08 21:41:33 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-08-08 19:41
.
Vor Suchlauf: 2.639.634.432 Bytes frei
Nach Suchlauf: 2.508.926.976 Bytes frei
.
- - End Of File - - 77A8EEB545996BF29AB4D6E2AE7F590F
Code:
ATTFilter Ad-Aware Adobe Flash Player ActiveX Adobe Reader 9.2 - Deutsch Adobe Shockwave Player 11.6 Apple Application Support Apple Software Update Avira Free Antivirus Battlefield Vietnam(TM) Black & White® 2 Chinese Simplified Fonts Support For Adobe Reader 9 D3DX10 DC Universe Online Live Diablo II DivX-Setup DivX Converter DivX Player DivX Plus DirectShow Filters erLT Herrscher des Olymp - Zeus Java Auto Updater Java(TM) 7 Update 5 JavaFX 2.1.1 Logitech SetPoint Logitech Vid Malwarebytes Anti-Malware Version 1.62.0.1300 Messenger Plus! Live Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (German) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (German) 2007 Microsoft Office Groove MUI (German) 2007 Microsoft Office Home and Student 2007 Microsoft Office InfoPath MUI (German) 2007 Microsoft Office Live Add-in 1.5 Microsoft Office OneNote MUI (German) 2007 Microsoft Office Outlook MUI (German) 2007 Microsoft Office PowerPoint MUI (German) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (German) 2007 Microsoft Office Proof (Italian) 2007 Microsoft Office Proofing (German) 2007 Microsoft Office Publisher MUI (German) 2007 Microsoft Office Shared MUI (German) 2007 Microsoft Office Word MUI (German) 2007 Microsoft Silverlight Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Mozilla Firefox 14.0.1 (x86 de) Mozilla Maintenance Service MSVCRT No23 Recorder NVIDIA PhysX ODF Add-In für Microsoft Office PC Connectivity Solution PDF2Word 1.0 PhotoScape PunkBuster für Battlefield Vietnam QuickTime RealPlayer Realtek High Definition Audio Driver RealUpgrade 1.0 Samsung New PC Studio Samsung New PC Studio USB Driver Installer SamsungConnectivityCableDriver Security Update for CAPICOM (KB931906) Skype Toolbars Skype™ 4.2 SopCast 3.3.2 SpongeBob SquarePants Employee of the Month Spybot - Search & Destroy swMSM TuneUp Utilities 2008 Update für Microsoft Office Excel 2007 Help (KB963678) Update für Microsoft Office Outlook 2007 Help (KB963677) Update für Microsoft Office Powerpoint 2007 Help (KB963669) Update für Microsoft Office Word 2007 Help (KB963665) Update for 2007 Microsoft Office System (KB967642) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687310) 32-Bit Edition VC80CRTRedist - 8.0.50727.4053 Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Messenger Windows Live Photo Common Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack |
|
09.08.2012, 08:37
| #30 |
| /// Helfer-Team | Mystart incredibar Entfernen Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
:Commands
incredi /RS
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! |
|
| Themen zu Mystart incredibar Entfernen |
| about, ad-aware, adressleiste, anti-malware, assistant, bearbeiten, befehl, config, dateien, download, durchführen, entferne, entfernen, incredibar, klicke, kurzem, lösung, malwarebytes, malwarebytes anti-malware, nervige, problem, quarantäne, schonmal, suchlauf, web |
Linear-Darstellung
