| |
| |||||||
Log-Analyse und Auswertung: GUV Trojaner mit webcam infeziertWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
13.08.2012, 20:28
| #1 |
 |  GUV Trojaner mit webcam infeziert habe seit ein paar stunden den guv trojaner mit webcam auf meinem computer mit windows xp wenn nicht im internet, kann ich den pc nutzen, mit dem internet verbunden, kommt sofort wieder der guv screen bitte um hilfe. vielen dank im voraus otl:OTL Logfile: Code:
ATTFilter OTL logfile created on: 13.08.2012 19:10:02 - Run 1 OTL by OldTimer - Version 3.2.57.0 Folder = C:\Dokumente und Einstellungen\f.schwaiger\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 1,95 Gb Total Physical Memory | 1,07 Gb Available Physical Memory | 55,12% Memory free 3,79 Gb Paging File | 3,05 Gb Available in Paging File | 80,34% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 226,73 Gb Total Space | 43,01 Gb Free Space | 18,97% Space Free | Partition Type: NTFS Drive F: | 7,31 Gb Total Space | 7,04 Gb Free Space | 96,31% Space Free | Partition Type: FAT32 Computer Name: NEUTORNB07 | User Name: f.schwaiger | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Dokumente und Einstellungen\***\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Programme\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - c:\Programme\Lenovo\System Update\SUService.exe (Lenovo Group Limited) PRC - C:\Programme\T-Mobile\web'n'walk Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.) PRC - C:\Programme\Mobile Partner Manager\UIExec.exe () PRC - C:\Programme\Mobile Partner Manager\AssistantServices.exe () PRC - C:\Programme\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks) PRC - C:\Programme\3DataManager\WTGService.exe () PRC - C:\Programme\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe (Lenovo ) PRC - C:\Programme\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo ) PRC - C:\Programme\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo ) PRC - C:\Programme\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo ) PRC - C:\Programme\ThinkPad\ConnectUtilities\ACWLIcon.exe (Lenovo ) PRC - C:\Programme\McAfee\VirusScan Enterprise\mcshield.exe (McAfee, Inc.) PRC - C:\Programme\McAfee\VirusScan Enterprise\shstat.exe (McAfee, Inc.) PRC - C:\Programme\McAfee\VirusScan Enterprise\vstskmgr.exe (McAfee, Inc.) PRC - C:\Programme\ThinkPad\Utilities\PWMUIAux.EXE (Lenovo Group Limited) PRC - C:\Programme\ThinkPad\Utilities\PWMDBSVC.exe () PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation) PRC - C:\Programme\Intel\WiFi\bin\S24EvMon.exe (Intel(R) Corporation) PRC - C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation) PRC - C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited) PRC - c:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited) PRC - C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe () PRC - C:\WINDOWS\system32\DTS.exe () PRC - C:\WINDOWS\system32\AtService.exe (AuthenTec, Inc.) PRC - C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) PRC - C:\Programme\ThinkVantage\PrdCtr\LPMLCHK.EXE (Lenovo Group Limited) PRC - C:\Programme\Lenovo\Camera Center\bin\LenovoCameraCenter.exe (Lenovo) PRC - C:\Programme\Lenovo\NPDIRECT\tpfnf7sp.exe (Lenovo Group Limited) PRC - c:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Programme\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.) PRC - C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.) PRC - C:\Programme\Symantec\pcAnywhere\awhost32.exe (Symantec Corporation) PRC - C:\WINDOWS\vsnp2uvc.exe (Sonix) PRC - C:\Programme\McAfee\Common Framework\naPrdMgr.exe (McAfee, Inc.) PRC - C:\Programme\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.) PRC - C:\Programme\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.) PRC - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG) PRC - C:\WINDOWS\system32\lxcicoms.exe ( ) PRC - C:\Programme\Lexmark 7300 Series\lxcimon.exe () PRC - C:\Programme\Lexmark 7300 Series\ezprint.exe (Lexmark International Inc.) PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) ========== Modules (No Company Name) ========== MOD - C:\Dokumente und Einstellungen\f.schwaiger\Lokale Einstellungen\Temp\install_0_msi.exe () MOD - C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_de_b03f5f7f11d50a3a\System.ServiceProcess.resources.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\9080c8e8e7b6dfb502c1328673d636f8\System.Management.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8b873631a0855fb6aa0ad25f1d9de7fe\PresentationFramework.Luna.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\7416fe825e6e49a87fa8ff60c8971813\PresentationFramework.Classic.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8dc4a28c456f81ee7399da21bd9d55aa\System.ServiceProcess.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\5b8ff47c1db373a2a4c638ca31988bd2\PresentationFramework.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\995fcf39ead2c2a53e084505c2c67d49\System.Windows.Forms.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\8ca00132a08c69697adf1cda32ebd835\System.Drawing.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationCore\4eb3cd1f1d5a83617524a9dfb96a657d\PresentationCore.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\6d8bef0d008389874e55c0308f0c18e5\WindowsBase.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d5b7368bde0f65aa15d9f46b498cc89\System.Configuration.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll () MOD - C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll () MOD - C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll () MOD - C:\Programme\Mobile Partner Manager\UIExec.exe () MOD - C:\Programme\Mobile Partner Manager\AssistantServices.exe () MOD - C:\Programme\Veoh Networks\VeohWebPlayer\QtWebKit4.dll () MOD - C:\Programme\Veoh Networks\VeohWebPlayer\QtGui4.dll () MOD - C:\Programme\Veoh Networks\VeohWebPlayer\QtXmlPatterns4.dll () MOD - C:\Programme\Veoh Networks\VeohWebPlayer\QtCore4.dll () MOD - C:\Programme\Veoh Networks\VeohWebPlayer\QtScript4.dll () MOD - C:\Programme\Veoh Networks\VeohWebPlayer\QtNetwork4.dll () MOD - C:\Programme\Veoh Networks\VeohWebPlayer\phonon4.dll () MOD - C:\Programme\Veoh Networks\VeohWebPlayer\imageformats\qjpeg4.dll () MOD - C:\Programme\Veoh Networks\VeohWebPlayer\imageformats\qgif4.dll () MOD - C:\Programme\3DataManager\WTGService.exe () MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU () MOD - C:\Programme\Adobe\Acrobat 9.0\Acrobat\AcroTray.DEU () MOD - C:\Programme\Adobe\Acrobat 9.0\Acrobat\AcroTray.FRA () MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.DEU () MOD - C:\Programme\ThinkPad\ConnectUtilities\Res\GR\GUIHlprRes.dll () MOD - C:\Programme\ThinkPad\ConnectUtilities\Res\GR\IconRes.dll () MOD - C:\Programme\ThinkPad\ConnectUtilities\Res\GR\SvcHlprRes.dll () MOD - C:\Programme\ThinkPad\Utilities\PWRMGRIF.DLL () MOD - C:\Programme\ThinkPad\Utilities\DE-DE\PWMUIAux.resources.dll () MOD - C:\Programme\ThinkPad\Utilities\GR\PWRMGRRO.DLL () MOD - C:\Programme\ThinkPad\Utilities\PWMDBSVC.exe () MOD - C:\Programme\ThinkPad\Utilities\GR\PWRMGRRT.DLL () MOD - C:\Programme\Intel\WiFi\bin\iWMSProv.dll () MOD - C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe () MOD - C:\Programme\Lenovo\Rescue and Recovery\CDRecord.dll () MOD - c:\Programme\Gemeinsame Dateien\Lenovo\CDRecord.dll () MOD - C:\WINDOWS\system32\DTS.exe () MOD - C:\Programme\Lenovo Fingerprint Software\SharedResources.dll () MOD - C:\Programme\Lenovo\Camera Center\bin\LocalizationWrapper.dll () MOD - C:\Programme\Lenovo\Camera Center\bin\de\LocalizationWrapper.resources.dll () MOD - C:\Programme\Lenovo\Camera Center\bin\CameraApplicationLaunchPadLibrary.dll () MOD - C:\Programme\Lenovo\Camera Center\bin\CameraApplicationLaunchPadDataObjects.dll () MOD - C:\WINDOWS\system32\btwicons.dll () MOD - C:\Programme\ThinkPad\Bluetooth Software\BTKeyInd.dll () MOD - C:\WINDOWS\system32\cpwmon2k.dll () MOD - C:\WINDOWS\system32\DLAAPI_W.DLL () MOD - C:\Programme\McAfee\VirusScan Enterprise\vsevntui.dll () MOD - C:\Programme\McAfee\Common Framework\naXML71.dll () MOD - C:\Programme\McAfee\Common Framework\naisign.dll () MOD - C:\Programme\Lexmark 7300 Series\lxcimon.exe () MOD - C:\Programme\Lexmark 7300 Series\iptk.dll () MOD - C:\Programme\Lexmark 7300 Series\lxcidrec.dll () MOD - C:\WINDOWS\system32\HPBHEALR.DLL () ========== Win32 Services (SafeList) ========== SRV - (Ranmgsa) -- File not found SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies) SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (SUService) -- c:\Programme\Lenovo\System Update\SUService.exe (Lenovo Group Limited) SRV - (UI Assistant Service) -- C:\Programme\Mobile Partner Manager\AssistantServices.exe () SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia) SRV - (WTGService) -- C:\Programme\3DataManager\WTGService.exe () SRV - (Lavasoft Ad-Aware Service) -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (Adobe LM Service) -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe () SRV - (AcSvc) -- C:\Programme\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo ) SRV - (AcPrfMgrSvc) -- C:\Programme\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo ) SRV - (McShield) -- C:\Programme\McAfee\VirusScan Enterprise\mcshield.exe (McAfee, Inc.) SRV - (McTaskManager) -- C:\Programme\McAfee\VirusScan Enterprise\vstskmgr.exe (McAfee, Inc.) SRV - (Power Manager DBC Service) -- C:\Programme\ThinkPad\Utilities\PWMDBSVC.exe () SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation) SRV - (S24EventMonitor) -- C:\Programme\Intel\WiFi\bin\S24EvMon.exe (Intel(R) Corporation) SRV - (RegSrvc) -- C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation) SRV - (TVT Scheduler) -- c:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited) SRV - (TVT Backup Protection Service) -- C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe () SRV - (FingerprintServer) -- C:\WINDOWS\system32\FpLogonServ.exe (AuthenTec,Inc) SRV - (dtsvc) -- C:\WINDOWS\system32\DTS.exe () SRV - (ADMonitor) -- C:\WINDOWS\system32\ADMonitor.exe () SRV - (ATService) -- C:\WINDOWS\system32\AtService.exe (AuthenTec, Inc.) SRV - (TVT_UpdateMonitor) -- C:\Programme\Lenovo\Rescue and Recovery\UpdateMonitor.exe (Lenovo Group Limited) SRV - (Adobe Version Cue CS4) -- C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe (Adobe Systems Incorporated) SRV - (ThinkVantage Registry Monitor Service) -- c:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited) SRV - (RoxMediaDB10) -- C:\Programme\Gemeinsame Dateien\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe (Sonic Solutions) SRV - (btwdins) -- C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.) SRV - (stllssvr) -- C:\Programme\Gemeinsame Dateien\SureThing Shared\stllssvr.exe (MicroVision Development, Inc.) SRV - (awhost32) -- C:\Programme\Symantec\pcAnywhere\awhost32.exe (Symantec Corporation) SRV - (LiveUpdate) -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation) SRV - (McAfeeFramework) -- C:\Programme\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.) SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (lxci_device) -- C:\WINDOWS\system32\lxcicoms.exe ( ) SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (WDICA) -- File not found DRV - (UsbserFilt) -- system32\DRIVERS\usbser_lowerfltj.sys File not found DRV - (upperdev) -- system32\DRIVERS\usbser_lowerflt.sys File not found DRV - (Sony_EricssonWWSC) -- system32\DRIVERS\lnvoscard.sys File not found DRV - (PDRFRAME) -- File not found DRV - (PDRELI) -- File not found DRV - (PDFRAME) -- File not found DRV - (PDCOMP) -- File not found DRV - (PCIDump) -- File not found DRV - (nmwcdnsuc) -- system32\drivers\nmwcdnsuc.sys File not found DRV - (nmwcdnsu) -- system32\drivers\nmwcdnsu.sys File not found DRV - (nmwcdc) -- system32\drivers\ccdcmbo.sys File not found DRV - (nmwcd) -- system32\drivers\ccdcmb.sys File not found DRV - (lnvounic) -- system32\DRIVERS\lnvounic.sys File not found DRV - (lnvond5) -- system32\DRIVERS\lnvond5.sys File not found DRV - (lnvomdm2) -- system32\DRIVERS\lnvomdm2.sys File not found DRV - (lnvomdm) -- system32\DRIVERS\lnvomdm.sys File not found DRV - (lnvomdfl2) -- system32\DRIVERS\lnvomdfl2.sys File not found DRV - (lnvomdfl) -- system32\DRIVERS\lnvomdfl.sys File not found DRV - (lnvogps) -- system32\DRIVERS\lnvogps.sys File not found DRV - (lnvocard) -- system32\DRIVERS\lnvocard.sys File not found DRV - (lnvobus) -- system32\DRIVERS\lnvobus.sys File not found DRV - (lbrtfdc) -- File not found DRV - (Changer) -- File not found DRV - (hwusbdev) -- C:\WINDOWS\system32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.) DRV - (Netaapl) -- C:\WINDOWS\system32\drivers\netaapl.sys (Apple Inc.) DRV - (ACEDRV07) -- C:\WINDOWS\system32\drivers\ACEDRV07.sys (Protect Software GmbH) DRV - (ZTEusbser6k) -- C:\WINDOWS\system32\drivers\ZTEusbser6k.sys (ZTE Incorporated) DRV - (ZTEusbnmea) -- C:\WINDOWS\system32\drivers\ZTEusbnmea.sys (ZTE Incorporated) DRV - (ZTEusbmdm6k) -- C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated) DRV - (massfilter) -- C:\WINDOWS\system32\drivers\massfilter.sys (ZTE Incorporated) DRV - (Ndisprot) -- C:\WINDOWS\system32\drivers\Ndisprot.sys (Windows (R) 2000 DDK provider) DRV - (Lbd) -- C:\WINDOWS\system32\drivers\Lbd.sys (Lavasoft AB) DRV - (IBMTPCHK) -- C:\WINDOWS\system32\drivers\IBMBLDID.sys () DRV - (ANC) -- C:\WINDOWS\system32\drivers\ANC.sys (IBM Corp.) DRV - (tcpipBM) -- C:\WINDOWS\System32\drivers\tcpipBM.sys (Bytemobile, Inc.) DRV - (BMLoad) -- C:\WINDOWS\system32\drivers\BMLoad.sys (Bytemobile, Inc.) DRV - (mfehidk) -- C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.) DRV - (mfeavfk) -- C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.) DRV - (mfeapfk) -- C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.) DRV - (mfetdik) -- C:\WINDOWS\system32\drivers\mfetdik.sys (McAfee, Inc.) DRV - (mfebopk) -- C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.) DRV - (mferkdk) -- C:\Programme\McAfee\VirusScan Enterprise\mferkdk.sys (McAfee, Inc.) DRV - (TPPWRIF) -- C:\WINDOWS\system32\drivers\TPPWRIF.SYS () DRV - (NETw5x32) -- C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation) DRV - (ATSwpWDF) -- C:\WINDOWS\system32\drivers\ATSwpWDF.sys (AuthenTec, Inc.) DRV - (psadd) -- C:\WINDOWS\system32\drivers\psadd.sys (Lenovo (United States) Inc.) DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia) DRV - (e1yexpress) -- C:\WINDOWS\system32\drivers\e1y5132.sys (Intel Corporation) DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation) DRV - (TSMAPIP) -- C:\WINDOWS\system32\drivers\TSMAPIP.SYS () DRV - (CnxtHdAudService) -- C:\WINDOWS\system32\drivers\CHDAU32.sys (Conexant Systems Inc.) DRV - (Shockprf) -- C:\WINDOWS\system32\drivers\ApsX86.sys (Lenovo.) DRV - (TPDIGIMN) -- C:\WINDOWS\system32\drivers\ApsHM86.sys (Lenovo.) DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.) DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.) DRV - (HSFHWAZL) -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.) DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.) DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.) DRV - (tpm) -- C:\WINDOWS\system32\drivers\tpm.sys (Intel Corporation) DRV - (HECI) -- C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation) DRV - (btaudio) -- C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.) DRV - (TVTI2C) -- C:\WINDOWS\system32\drivers\tvti2c.sys (Lenovo (United States) Inc.) DRV - (rimmptsk) -- C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC) DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.) DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.) DRV - (rismxdp) -- C:\WINDOWS\system32\drivers\rixdptsk.sys (REDC) DRV - (rimsptsk) -- C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC) DRV - (DLADResM) -- C:\WINDOWS\system32\DLA\DLADResM.SYS (Roxio) DRV - (DLABMFSM) -- C:\WINDOWS\system32\DLA\DLABMFSM.SYS (Roxio) DRV - (DLAUDFAM) -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Roxio) DRV - (DLAUDF_M) -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Roxio) DRV - (DLAOPIOM) -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Roxio) DRV - (DLABOIOM) -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Roxio) DRV - (DLAPoolM) -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Roxio) DRV - (DLAIFS_M) -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Roxio) DRV - (AW_HOST) -- C:\WINDOWS\system32\drivers\AW_HOST5.sys (Symantec Corporation) DRV - (awlegacy) -- C:\WINDOWS\system32\drivers\AWLEGACY.sys (Symantec Corporation) DRV - (awecho) -- C:\WINDOWS\system32\drivers\awechomd.sys (Symantec Corporation) DRV - (Gernuwa) -- C:\WINDOWS\System32\drivers\GERNUWA.sys (Symantec Corporation) DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (SNP2UVC) -- C:\WINDOWS\system32\drivers\snp2uvc.sys () DRV - (DLARTL_M) -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS (Roxio) DRV - (DLACDBHM) -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Roxio) DRV - (G400) -- C:\WINDOWS\system32\drivers\G400m.sys (Matrox Graphics Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&FORM=LENIE IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=050412_30b&babsrc=SP_ss&mntrId=7c016f7300000000000000242cbb3d9f IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)" FF - prefs.js..browser.search.order.1: "Search the web (Babylon)" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "google.com" FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732 FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {EB132DB0-A4CA-11DF-9732-0E29E0D72085}:1.3 FF - prefs.js..extensions.enabledItems: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.17 FF - prefs.js..extensions.enabledItems: {35379F86-8CCB-4724-AE33-4278DE266C70}:1.0.7 FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=110819&tt=050412_30b&babsrc=KW_ss&mntrId=7c016f7300000000000000242cbb3d9f&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.448: C:\Programme\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Programme\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Programme\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\Facebook\npfbplugin_1_0_3.dll File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\ff-bmboc@bytemobile.com: C:\Programme\3-addons\addon [2011.05.22 17:40:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.07.19 20:14:36 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.06.08 18:02:02 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Programme\Object\facetheme [2009.06.04 11:57:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions [2012.05.02 06:29:16 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\7nl3pvnb.default\extensions [2011.07.29 12:22:13 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\7nl3pvnb.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a} [2011.07.06 23:37:24 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\7nl3pvnb.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.04.29 20:03:51 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.06.08 16:23:03 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2012.07.19 20:14:36 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2012.04.16 08:46:00 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll [2012.01.17 22:40:33 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.04.12 15:05:12 | 000,002,353 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml [2012.01.17 22:40:33 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2012.01.17 22:40:33 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2012.01.17 22:40:33 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2012.01.17 22:40:33 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2012.01.17 22:40:33 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.10.05 17:20:03 | 000,437,921 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 15061 more lines... O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com) O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Programme\Adobe\/Adobe Contribute CS4/contributeieplugin.dll () O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan Enterprise\scriptcl.dll (McAfee, Inc.) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.) O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O2 - BHO: (IePasswordManagerHelper Class) - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Programme\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited) O2 - BHO: (no name) - {cbc5b60a-aa4d-45f6-84c2-d086f320299a} - No CLSID value found. O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Programme\Adobe\/Adobe Contribute CS4/contributeieplugin.dll () O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll () O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [ACTray] C:\Programme\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo ) O4 - HKLM..\Run: [ACWLIcon] C:\Programme\ThinkPad\ConnectUtilities\ACWLIcon.exe (Lenovo ) O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Ad-Watch] C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft) O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AutoRun] C:\Programme\BEWERBUNGS-MASTER\UpdateCheck_BEWERBUNGSMASTER.exe File not found O4 - HKLM..\Run: [BLOG] C:\Programme\ThinkPad\Utilities\BATLOGEX.DLL () O4 - HKLM..\Run: [CameraApplicationLauncher] C:\Programme\Lenovo\Camera Center\bin\CameraApplicationLaunchPadLauncher.exe () O4 - HKLM..\Run: [CreateLMBCShortCut] C:\Programme\Lenovo\Mobile Broadband Connect\UserShortcutCreator.exe () O4 - HKLM..\Run: [DataCardMonitor] C:\Programme\T-Mobile\web'n'walk Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.) O4 - HKLM..\Run: [EzPrint] C:\Programme\Lexmark 7300 Series\ezprint.exe (Lexmark International Inc.) O4 - HKLM..\Run: [FingerPrintSoftware] C:\Programme\Lenovo Fingerprint Software\fpapp.exe (Authentec,Inc) O4 - HKLM..\Run: [Google Updater] C:\Programme\Google\Google Updater\GoogleUpdater.exe (Google) O4 - HKLM..\Run: [LPMailChecker] C:\Programme\ThinkVantage\PrdCtr\LPMLCHK.EXE (Lenovo Group Limited) O4 - HKLM..\Run: [LXCICATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCItime.DLL () O4 - HKLM..\Run: [lxcimon.exe] C:\Programme\Lexmark 7300 Series\lxcimon.exe () O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Programme\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [PWRMGRTR] C:\Programme\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited) O4 - HKLM..\Run: [ShStatEXE] C:\Programme\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.) O4 - HKLM..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe (Sonix) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TPFNF7] C:\Programme\Lenovo\NPDIRECT\TPFNF7SP.exe (Lenovo Group Limited) O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited) O4 - HKLM..\Run: [UIExec] C:\Programme\Mobile Partner Manager\UIExec.exe () O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKCU..\Run: [VeohPlugin] C:\Programme\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.) O4 - Startup: C:\Dokumente und Einstellungen\f.schwaiger\Startmenü\Programme\Autostart\Dropbox.lnk = C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O8 - Extra context menu item: &Download by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: &Grab video by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: &Windows Live Search - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Down&load all by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Lenovo Password Manager... - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - C:\Programme\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1339148963603 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = agenturneutor.local O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9ADBDEDF-6B9A-4879-8E87-5DC55AA404AC}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: GinaDLL - (ATGinaHook.dll) - C:\WINDOWS\System32\ATGinaHook.dll (AuthenTec, Inc.) O20 - Winlogon\Notify\ACNotify: DllName - (ACNotify.dll) - C:\Programme\ThinkPad\ConnectUtilities\ACNotify.dll (Lenovo ) O20 - Winlogon\Notify\ATFUS: DllName - (C:\WINDOWS\system32\FpWinLogonNp.dll) - C:\WINDOWS\system32\FpWinlogonNp.dll (AuthenTec,Inc) O20 - Winlogon\Notify\PCANotify: DllName - (PCANotify.dll) - C:\WINDOWS\System32\PCANotify.dll (Symantec Corporation) O24 - Desktop Components:0 () - file:///C:/DOKUME~1/F3859~1.SCH/LOKALE~1/Temp/msohtml1/03/clip_image002.jpg O24 - Desktop Components:1 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\1920x1200-Swoosh.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\1920x1200-Swoosh.bmp O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.01.27 04:18:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\Shell - "" = AutoRun O33 - MountPoints2\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{192e648a-848b-11e0-baf3-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{192e648a-848b-11e0-baf3-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{192e648a-848b-11e0-baf3-028037ec0200}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\Shell - "" = AutoRun O33 - MountPoints2\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{21a64b61-a8d9-11de-ba6e-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{21a64b61-a8d9-11de-ba6e-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{21a64b61-a8d9-11de-ba6e-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{2b76201c-60d4-11de-ba5a-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{2b76201c-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{2b76201c-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun\command - "" = D:\AutoRun.exe O33 - MountPoints2\{2b762020-60d4-11de-ba5a-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{2b762020-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{2b762020-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{2b762022-60d4-11de-ba5a-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{2b762022-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{2b762022-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun\command - "" = D:\AutoRun.exe O33 - MountPoints2\{301eec44-32fd-11e0-bad5-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{301eec44-32fd-11e0-bad5-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{301eec44-32fd-11e0-bad5-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{35cb610f-09a1-11df-ba89-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{35cb610f-09a1-11df-ba89-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{35cb610f-09a1-11df-ba89-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{495e0b0c-51b0-11de-ba55-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{495e0b0c-51b0-11de-ba55-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{495e0b0c-51b0-11de-ba55-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\Shell - "" = AutoRun O33 - MountPoints2\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\Shell - "" = AutoRun O33 - MountPoints2\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\Shell - "" = AutoRun O33 - MountPoints2\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\Shell - "" = AutoRun O33 - MountPoints2\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{575d872b-81c8-11df-baa8-00242cbb3d9f}\Shell - "" = AutoRun O33 - MountPoints2\{575d872b-81c8-11df-baa8-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{575d872b-81c8-11df-baa8-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{575d872c-81c8-11df-baa8-00242cbb3d9f}\Shell - "" = AutoRun O33 - MountPoints2\{575d872c-81c8-11df-baa8-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{575d872c-81c8-11df-baa8-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{65331b0a-7a0f-11df-baa6-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{65331b0a-7a0f-11df-baa6-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{65331b0a-7a0f-11df-baa6-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{66a4d8d0-711b-11e0-baea-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{66a4d8d0-711b-11e0-baea-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{66a4d8d0-711b-11e0-baea-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{66a4d8d2-711b-11e0-baea-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{66a4d8d2-711b-11e0-baea-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{66a4d8d2-711b-11e0-baea-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{6e6dc99e-e420-11de-ba7e-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{6e6dc99e-e420-11de-ba7e-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6e6dc99e-e420-11de-ba7e-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{71f44c34-3772-11e0-bad9-0022facb1292}\Shell - "" = AutoRun O33 - MountPoints2\{71f44c34-3772-11e0-bad9-0022facb1292}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{71f44c34-3772-11e0-bad9-0022facb1292}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{7a8d9aec-c01a-11df-babe-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{7a8d9aec-c01a-11df-babe-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{7a8d9aec-c01a-11df-babe-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{7a8d9af0-c01a-11df-babe-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{7a8d9af0-c01a-11df-babe-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{7a8d9af0-c01a-11df-babe-028037ec0200}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{7dd57220-5607-11de-ba58-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{7dd57220-5607-11de-ba58-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{7dd57220-5607-11de-ba58-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{8ed15d73-a751-11de-ba6d-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{8ed15d73-a751-11de-ba6d-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{8ed15d73-a751-11de-ba6d-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{92fcc0e0-9e04-11df-bab5-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{92fcc0e0-9e04-11df-bab5-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{92fcc0e0-9e04-11df-bab5-028037ec0200}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{a3e62c9f-5926-11de-ba59-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{a3e62c9f-5926-11de-ba59-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{a3e62c9f-5926-11de-ba59-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{a547b745-770d-11df-baa5-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{a547b745-770d-11df-baa5-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{a547b745-770d-11df-baa5-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{a547b747-770d-11df-baa5-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{a547b747-770d-11df-baa5-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{a547b747-770d-11df-baa5-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\Shell - "" = AutoRun O33 - MountPoints2\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\Shell - "" = AutoRun O33 - MountPoints2\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{abb1182e-ef10-11de-ba81-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{abb1182e-ef10-11de-ba81-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{abb1182e-ef10-11de-ba81-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{abb11830-ef10-11de-ba81-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{abb11830-ef10-11de-ba81-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{abb11830-ef10-11de-ba81-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{bfdef501-d1fb-11de-ba79-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{bfdef501-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{bfdef501-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\Shell - "" = AutoRun O33 - MountPoints2\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{bfdef523-d1fb-11de-ba79-b609d5197065}\Shell - "" = AutoRun O33 - MountPoints2\{bfdef523-d1fb-11de-ba79-b609d5197065}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{bfdef523-d1fb-11de-ba79-b609d5197065}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{bfdef527-d1fb-11de-ba79-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{bfdef527-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{bfdef527-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{bfdef529-d1fb-11de-ba79-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{bfdef529-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{bfdef529-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\Shell\AutoRun\command - "" = F:\NokiaPCIA_Autorun.exe O33 - MountPoints2\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\Shell - "" = AutoRun O33 - MountPoints2\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{d63f1336-2d32-11e0-bad4-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{d63f1336-2d32-11e0-bad4-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{d63f1336-2d32-11e0-bad4-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\Shell - "" = AutoRun O33 - MountPoints2\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f6dc08d1-988f-11df-bab3-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{f6dc08d1-988f-11df-bab3-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{f6dc08d1-988f-11df-bab3-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f9a2404c-9e02-11df-bab4-028037ec0200}\Shell - "" = AutoRun O33 - MountPoints2\{f9a2404c-9e02-11df-bab4-028037ec0200}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{f9a2404c-9e02-11df-bab4-028037ec0200}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{fdcf16fe-50ea-11de-ba53-028037ec0200}\Shell\AutoRun\command - "" = C:\WINDOWS\System32\setup.exe -- [2008.04.14 07:53:02 | 000,023,040 | ---- | M] (Microsoft Corporation) O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.08.13 19:08:59 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\f.schwaiger\Desktop\OTL.exe [2011.09.29 19:24:01 | 000,047,360 | ---- | C] (VSO Software) -- C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\pcouffin.sys [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.08.13 19:08:00 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\f.schwaiger\Desktop\OTL.exe [2012.08.13 19:05:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012.08.13 18:52:16 | 210,292,736 | ---- | M] () -- C:\Dokumente und Einstellungen\f.schwaiger\Desktop\KWU_1.0.3.upd.iso [2012.08.13 18:50:00 | 000,000,252 | ---- | M] () -- C:\WINDOWS\tasks\Auf Updates für Windows Live Toolbar prüfen.job [2012.08.13 18:45:15 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2012.08.13 18:33:36 | 000,000,316 | ---- | M] () -- C:\WINDOWS\tasks\PMTask.job [2012.08.13 18:32:24 | 000,001,024 | ---- | M] () -- C:\Dokumente und Einstellungen\f.schwaiger\.rnd [2012.08.13 18:32:08 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012.08.13 18:32:05 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012.08.13 18:31:56 | 000,001,024 | ---- | M] () -- C:\.rnd [2012.08.13 18:31:51 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.08.13 18:31:48 | 2088,792,064 | -HS- | M] () -- C:\hiberfil.sys [2012.08.13 18:29:51 | 004,503,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ism_0_llatsni.pad [2012.08.13 18:22:49 | 000,488,168 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2012.08.13 18:22:49 | 000,444,810 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2012.08.13 18:22:49 | 000,095,994 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2012.08.13 18:22:49 | 000,072,686 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2012.08.13 18:20:45 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2012.08.13 18:15:12 | 000,001,639 | ---- | M] () -- C:\Dokumente und Einstellungen\f.schwaiger\Startmenü\Programme\Autostart\ctfmon.lnk [2012.08.13 14:22:00 | 000,001,014 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job [2012.08.10 09:28:00 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2012.08.09 23:59:30 | 000,000,186 | ---- | M] () -- C:\WINDOWS\hpbafd.ini [2012.08.07 21:29:00 | 000,000,458 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2012.08.05 18:45:23 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe [2012.08.05 18:45:23 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2012.07.26 10:37:35 | 001,401,828 | ---- | M] () -- C:\Dokumente und Einstellungen\f.schwaiger\Desktop\clip_image001.jpg [2012.07.24 15:59:33 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [2012.07.18 19:39:10 | 000,099,747 | ---- | M] () -- C:\Dokumente und Einstellungen\f.schwaiger\Desktop\000 - Karte Klagenfurter Jubiläumsweg.jpg [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.08.13 18:54:01 | 210,292,736 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Desktop\KWU_1.0.3.upd.iso [2012.08.13 18:31:53 | 000,001,024 | ---- | C] () -- C:\.rnd [2012.08.13 18:15:12 | 004,503,728 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ism_0_llatsni.pad [2012.08.13 18:15:12 | 000,001,639 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Startmenü\Programme\Autostart\ctfmon.lnk [2012.07.26 10:37:43 | 001,401,828 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Desktop\clip_image001.jpg [2012.07.18 19:39:09 | 000,099,747 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Desktop\000 - Karte Klagenfurter Jubiläumsweg.jpg [2012.06.17 17:12:58 | 000,419,256 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat [2012.06.08 15:19:29 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2012.05.24 13:54:17 | 000,000,762 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\.recently-used.xbel [2011.09.29 19:24:39 | 000,001,057 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\vso_ts_preview.xml [2011.09.29 19:24:01 | 000,087,608 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\inst.exe [2011.09.29 19:24:01 | 000,007,887 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\pcouffin.cat [2011.09.29 19:24:01 | 000,001,144 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\pcouffin.inf [2011.09.14 08:30:32 | 000,038,527 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\Kommagetrennte Werte (Windows).ADR [2011.04.14 08:33:58 | 000,011,507 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\Kommagetrennte Werte (DOS).TSK [2011.04.14 08:13:11 | 000,013,059 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\Kommagetrennte Werte (Windows).CAL [2009.06.15 17:52:06 | 000,095,744 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.06.02 21:58:30 | 000,001,024 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\.rnd [2009.06.02 21:58:30 | 000,000,144 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2009.06.02 21:57:01 | 000,013,092 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\ntuser.pol ========== Alternate Data Streams ========== @Alternate Data Stream - 60 bytes -> C:\Dokumente und Einstellungen\f.schwaiger\Desktop\Preisliste neu 2010.pdf:AFP_AfpInfo @Alternate Data Stream - 60 bytes -> C:\Dokumente und Einstellungen\f.schwaiger\Desktop\JACOBS-Logo_ohneFond_M.jpg:AFP_AfpInfo < End of report > extras:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 13.08.2012 19:10:02 - Run 1
OTL by OldTimer - Version 3.2.57.0 Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
1,95 Gb Total Physical Memory | 1,07 Gb Available Physical Memory | 55,12% Memory free
3,79 Gb Paging File | 3,05 Gb Available in Paging File | 80,34% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 226,73 Gb Total Space | 43,01 Gb Free Space | 18,97% Space Free | Partition Type: NTFS
Drive F: | 7,31 Gb Total Space | 7,04 Gb Free Space | 96,31% Space Free | Partition Type: FAT32
Computer Name: NEUTORNB07 | User Name: f.schwaiger | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [BUDNI Fotowelt] -- "C:\Programme\BUDNI Fotowelt\BUDNI Fotowelt\BUDNI Fotowelt.exe" "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Programme\BUDNI Fotowelt\BUDNI Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications]
"Enabled" = 1
"AllowUserPrefMerge" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts]
"Enabled" = 1
"AllowUserPrefMerge" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts\List]
"135:TCP:*:Enabled:Offer Remote Assistance - Port" = 135:TCP:*:Enabled:Offer Remote Assistance - Port
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\FileAndPrint]
"Enabled" = 1
"RemoteAddresses" = LocalSubnet
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\RemoteDesktop]
"Enabled" = 1
"RemoteAddresses" = *
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications]
"AllowUserPrefMerge" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\GloballyOpenPorts]
"AllowUserPrefMerge" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\McAfee\Common Framework\FrameworkService.exe" = C:\Programme\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service -- (McAfee, Inc.)
"C:\Programme\Symantec\pcAnywhere\awhost32.exe" = C:\Programme\Symantec\pcAnywhere\awhost32.exe:*:Enabled:pcAnywhere Host -- (Symantec Corporation)
"C:\Programme\Orbitdownloader\orbitdm.exe" = C:\Programme\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Programme\Orbitdownloader\orbitnet.exe" = C:\Programme\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{05860BD6-2B3C-4B16-A300-964403ACF13C}" = ThinkVantage GPS
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Central Data
"{098122AB-C605-4853-B441-C0A4EB359B75}" = DirectXInstallService
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0C262D84-FFA4-4621-8ED7-41F8287369F5}" = Google Apps Migration For Microsoft Outlook® 2.3.12.34
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1007F41F-7D69-468E-8017-3849A5A973C2}" = ThinkVantage Technologies Welcome Message
"{10DDCDDD-9A59-4496-9371-C17F1668D433}" = Windows Live Toolbar
"{1189955B-C6E8-4606-AE6C-CD64791DB544}" = Mobile Broadband Connect
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4300" = Canon iP4300
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4500_series" = Canon iP4500 series
"{12118183-866A-11D3-97DF-0000F8D8F2E9}" = Symantec pcAnywhere
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{1297C681-92D7-40EF-93BF-03F66EC5105C}" = ThinkPad-Dienstprogramm 'EasyEject'
"{14F70205-1940-4000-88C7-BE799A6B2CAD}" = Adobe Soundbooth CS4
"{15BF7AAF-846C-4A6D-80E1-5D1FC7FB461B}" = Adobe SGM CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{17CBC505-D1AE-459D-B445-3D2000A85842}" = Dienstprogramm "ThinkPad UltraNav"
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{1B7C06E1-4888-47A6-992A-0990B9683486}" = Adobe Version Cue CS4 Server
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{1DCA3EAA-6EB5-4563-A970-EA14D75037BA}" = Adobe InDesign CS4
"{1E04CB54-AF4E-4AC3-B4B7-C0A160BE57F1}" = Adobe InDesign CS4 Icon Handler
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Central Tools
"{2168245A-B5AD-40D8-A641-48E3E070B5B6}" = Adobe Flash CS4 STI-en
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{297190A1-4B0D-4CD6-8B9F-3907F15C3FD8}" = Adobe CS4 American English Speech Analysis Models
"{2BAF2B96-7560-48B4-87D4-10178DDBE217}" = Adobe InDesign CS4 Application Feature Set Files (Roman)
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Drag-to-Disc
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35C03C04-3F1F-42C2-A989-A757EE691F65}" = McAfee VirusScan Enterprise
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Integrated Camera
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3D8994A3-02A8-45B5-B955-53E608BC69ED}" = Lenovo Fingerprint Software
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3EAAC5FD-E209-4856-8C49-D4EA40F85032}" = Mobile Connect
"{3F963A06-7C18-4039-9789-9644B3266AE7}" = Verizon Wireless BroadbandAccess Self Activation
"{428FDF9F-E010-4C4C-A8BB-156960AFCA1C}" = Adobe Fireworks CS4
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{44E240EC-2224-4078-A88B-2CEE0D3016EF}" = Adobe After Effects CS4 Presets
"{44E9D4C2-946C-4378-9354-558803C47A68}" = Client Security - Password Manager
"{45DF6D99-666D-41FA-8D62-0E183B6240F3}" = PC Connectivity Solution
"{45EC816C-0771-4C14-AE6D-72D1B578F4C8}" = Adobe After Effects CS4
"{46A84694-59EC-48F0-964C-7E76E9F8A2ED}" = ThinkVantage System für aktiven Festplattenschutz
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A52555C-032A-4083-BDD9-6A85ABFB39A8}" = Adobe SING CS4
"{4BA6784F-3B10-473A-B9F5-33A36AC354D5}" = Google SketchUp 8
"{52232EF4-CC12-4C21-ABCF-ADB79618302D}" = Adobe Soundbooth CS4 Codecs
"{537BF16E-7412-448C-95D8-846E85A1D817}" = Roxio Creator Business Edition
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{561968FD-56A1-49FD-9ED0-F55482C7C5BC}" = Adobe Media Encoder CS4 Exporter
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.02
"{5EAD5443-7194-46CC-A055-428E6ABB1BAF}" = Adobe Encore CS4
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{61D6891E-E822-4448-9F9A-0AAAAEB6AF6C}" = Adobe Creative Suite 4 Master Collection
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{65706020-7B6F-41F2-8047-FC69579E386A}" = Präsentationsdirektor
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{668ACF05-E455-4932-A2D2-5822A8206FEB}" = Camera Center
"{67A9747A-E1F5-4E9A-81CC-12B5D5B81B6E}" = Adobe After Effects CS4 Third Party Content
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Central Audio
"{7406DF60-016D-476B-A2C7-55D997592047}" = Adobe OnLocation CS4
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{793D1D88-6141-43DE-BE58-59BCE31B4090}" = Adobe Flash CS4 Extension - Flash Lite STI en
"{7CC7BDD5-6F10-4724-96A1-EAC7D9F2831C}" = Adobe InDesign CS4 Common Base Files
"{7EB114D8-207F-45AE-BABD-1669715F2630}" = ThinkVantage Access Connections
"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = ThinkPad Bluetooth with Enhanced Data Rate Software
"{8675339C-128C-44DD-83BF-0A5D6ABD8297}" = System Update
"{87532CAB-7932-4F84-8937-823337622807}" = Adobe Illustrator CS4
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{986F64DC-FF15-449D-998F-EE3BCEC6666A}" = Help Center
"{A0E64EBA-8BF0-49FB-90C0-BB3D781A2016}" = ThinkPad Energie-Manager
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A6EC82A0-1414-475D-8AFD-469089F3080D}" = Adobe Contribute CS4
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = Mobile Partner Manager
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}_951" = Adobe Acrobat 9.5.1 - CPSID_83708
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B05B22B8-72AE-4DC3-8D6F-FBC2233CAF41}" = Roxio Creator Business Edition
"{B05DE7B7-0B40-4411-BD4B-222CAE2D8F15}" = Adobe MotionPicture Color Files CS4
"{B15381DD-FF97-4FCD-A881-ED4DB0975500}" = Adobe Color Video Profiles AE CS4
"{B169BC97-B8AA-4ACA-9CF2-9D0FF5BABDF7}" = Adobe Premiere Pro CS4 Functional Content
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B334D9AE-1393-423E-97C0-3BDC3360E692}" = Sonic Icons for Lenovo
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Central Copy
"{B9F4561A-924D-4510-A85A-BB0960C338CB}" = Adobe Asset Services CS4
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BE9CEAAA-F069-4331-BF2F-8D350F6504F4}" = Adobe Media Encoder CS4 Additional Exporter
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C54ED2B6-1AF2-416F-BBA8-5E2B8CDCB5C4}" = XP Themes
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{C6FA39A7-26B1-480A-BC74-6D17531AC222}" = Access Help
"{C86E7C99-E4AD-79C7-375B-1AEF9A91EC2B}" = Acrobat.com
"{C938BE91-3BB5-4B84-9EF6-88F0505D0038}" = Adobe Premiere Pro CS4 Third Party Content
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CD83CB2B-B00E-4DED-8CC6-220CD4015AA1}" = Illustrate! 5.4
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF5737AF-8550-4546-A69B-0EA9EF5A9B55}" = ThinkVantage Productivity Center
"{D499F8DE-3F31-4900-9157-61061613704B}" = Adobe Premiere Pro CS4
"{D4D94DB1-EBC3-4E64-8D96-C4FDB1B51031}" = Nero 7 Premium
"{D728E945-256D-4477-B377-6BBA693714AC}" = Ergänzung zu Productivity Center für ThinkPad
"{D7ADFB4C-9794-472F-9C1B-432C10DCBA92}" = Intel(R) PROSet/Wireless WiFi-Software
"{DB71210F-8314-4AE3-B7A7-EBAF85BD30E9}" = Wallpapers
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E7E836B8-4BDD-454F-82E6-5FEA17C83AD4}" = Message Center
"{E8EE9410-8AC4-4F43-A626-DDECA75C79F3}" = Adobe Setup
"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Central Core
"{EE353798-E875-42E0-B58D-7E6696182EA8}" = Adobe Media Encoder CS4 Dolby
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F151F2B3-0C32-44D3-90E2-E639B8024622}" = Rescue and Recovery
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FB2A5FCC-B81B-48C2-A009-7804694D83E9}" = Adobe Encore CS4 Codecs
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"3DataManager" = 3DataManager
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"7-Zip" = 7-Zip 4.65
"A4680BD43717441189C52EBF2C4FD6B182EE1101" = Windows-Treiberpaket - AuthenTec Inc. (ATSwpWDF) Biometric (10/02/2008 8.1.2.37)
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_b2d6abde968e6f277ddbfd501383e02" = Adobe Creative Suite 4 Master Collection
"Allway Sync_is1" = Allway Sync version 9.2.15
"Any Video Converter_is1" = Any Video Converter 3.2.5
"BUDNI Fotowelt" = BUDNI Fotowelt
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDA_HSF" = ThinkPad Modem Adapter
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"CutePDF Writer Installation" = CutePDF Writer 2.7
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.40.602
"FTP Commander" = FTP Commander
"Google Updater" = Google Updater
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HECI" = Intel(R) Management Engine Interface
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Inkscape" = Inkscape 0.48.2
"ITPM" = Intel® Trusted Platform Module
"Lenovo Registration" = Lenovo Registration
"Lexmark 7300 Series" = Lexmark 7300 Series
"LiveReg" = LiveReg (Symantec Corporation)
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP3 Voice Recorder_is1" = MP3 Voice Recorder 1.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OE2003" = OE2003 V.10.3
"OESpeaker2003" = OESpeaker2003 V.10.3
"OpenAL" = OpenAL
"Orbit_is1" = Orbit Downloader
"PC-Doctor for Windows" = Lenovo System Toolbox
"PCMCIAPW" = ThinkPad PC Card Power Policy
"Photo Resize Magic" = Photo Resize Magic 1.0
"Picasa 3" = Picasa 3
"Power Management Driver" = ThinkPad Power Management Driver
"ProInst" = Intel PROSet Wireless
"PROR" = Microsoft Office Professional 2007
"PROSet" = Intel(R) Network Connections Drivers
"ST6UNST #1" = BlueShot 1.1.0
"Switch" = Switch Sound File Converter
"SynTPDeinstKey" = ThinkPad UltraNav Driver
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"TreeSize Free_is1" = TreeSize Free V2.3.1
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 1.0.0
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WIC" = Windows Imaging Component
"Windows Live Toolbar" = Windows Live Toolbar
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"Winmail Opener" = Winmail Opener 1.4
"WMCSetup" = Windows Media Connect
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"FoxTab FLV Player" = FoxTab FLV Player
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 13.08.2012 12:18:09 | Computer Name = NEUTORNB07 | Source = AutoEnrollment | ID = 15
Description = Die automatische Zertifikatregistrierung für "lokaler Computer" konnte
keine Verbindung zum Active Directory (0x8007054b) herstellen. Die angegebene Domäne
ist nicht vorhanden oder es konnte keine Verbindung hergestellt werden. Die Registrierung
wird nicht durchgeführt.
Error - 13.08.2012 12:18:16 | Computer Name = NEUTORNB07 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 13.08.2012 12:19:04 | Computer Name = NEUTORNB07 | Source = UserInit | ID = 1000
Description = Folgendes Skript konnte nicht ausgeführt werden: \\agenturneutor.local\SysVol\agenturneutor.local\scripts\RenameWorkplace.vbs.
Das Netzlaufwerk ist nicht erreichbar. Weitere Informationen über die Behebung
von Netzwerkproblemen finden Sie in der Windows-Hilfe.
Error - 13.08.2012 12:31:53 | Computer Name = NEUTORNB07 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 13.08.2012 12:31:53 | Computer Name = NEUTORNB07 | Source = AutoEnrollment | ID = 15
Description = Die automatische Zertifikatregistrierung für "lokaler Computer" konnte
keine Verbindung zum Active Directory (0x8007054b) herstellen. Die angegebene Domäne
ist nicht vorhanden oder es konnte keine Verbindung hergestellt werden. Die Registrierung
wird nicht durchgeführt.
Error - 13.08.2012 12:32:04 | Computer Name = NEUTORNB07 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 13.08.2012 12:33:17 | Computer Name = NEUTORNB07 | Source = UserInit | ID = 1000
Description = Folgendes Skript konnte nicht ausgeführt werden: \\agenturneutor.local\SysVol\agenturneutor.local\scripts\RenameWorkplace.vbs.
Das Netzlaufwerk ist nicht erreichbar. Weitere Informationen über die Behebung
von Netzwerkproblemen finden Sie in der Windows-Hilfe.
Error - 13.08.2012 12:33:56 | Computer Name = NEUTORNB07 | Source = UserInit | ID = 1000
Description = Folgendes Skript konnte nicht ausgeführt werden: \\agenturneutor.local\SysVol\agenturneutor.local\scripts\outlook_elemente_herstellen.vbs.
Das Netzlaufwerk ist nicht erreichbar. Weitere Informationen über die Behebung
von Netzwerkproblemen finden Sie in der Windows-Hilfe.
Error - 13.08.2012 12:34:02 | Computer Name = NEUTORNB07 | Source = UserInit | ID = 1000
Description = Folgendes Skript konnte nicht ausgeführt werden: \\agenturneutor.local\SysVol\agenturneutor.local\scripts\Drucker.vbs.
Das Netzlaufwerk ist nicht erreichbar. Weitere Informationen über die Behebung
von Netzwerkproblemen finden Sie in der Windows-Hilfe.
Error - 13.08.2012 12:34:09 | Computer Name = NEUTORNB07 | Source = UserInit | ID = 1000
Description = Folgendes Skript konnte nicht ausgeführt werden: \\agenturneutor.local\SysVol\agenturneutor.local\scripts\Laufwerke.bat.
Das Netzlaufwerk ist nicht erreichbar. Weitere Informationen über die Behebung
von Netzwerkproblemen finden Sie in der Windows-Hilfe.
[ OSession Events ]
Error - 29.05.2012 04:34:47 | Computer Name = NEUTORNB07 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.6021.5000. This session lasted 6641
seconds with 2100 seconds of active time. This session ended with a crash.
Error - 11.06.2012 03:11:49 | Computer Name = NEUTORNB07 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 6886
seconds with 1920 seconds of active time. This session ended with a crash.
Error - 28.06.2012 04:48:07 | Computer Name = NEUTORNB07 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session
lasted 433 seconds with 240 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 13.08.2012 01:46:12 | Computer Name = NEUTORNB07 | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.178.25 für die Netzwerkkarte mit der Netzwerkadresse
0022FACB1292 wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
Error - 13.08.2012 01:46:22 | Computer Name = NEUTORNB07 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 13.08.2012 05:21:25 | Computer Name = NEUTORNB07 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 13.08.2012 05:36:42 | Computer Name = NEUTORNB07 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 29 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 13.08.2012 06:06:42 | Computer Name = NEUTORNB07 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 59 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 13.08.2012 07:06:47 | Computer Name = NEUTORNB07 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 119 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 13.08.2012 09:06:43 | Computer Name = NEUTORNB07 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 239 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 13.08.2012 12:18:09 | Computer Name = NEUTORNB07 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne AGENTURNEUTOR aus folgendem
Grund zur Verfügung: %%1311. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
Error - 13.08.2012 12:19:51 | Computer Name = NEUTORNB07 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 13.08.2012 12:31:53 | Computer Name = NEUTORNB07 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne AGENTURNEUTOR aus folgendem
Grund zur Verfügung: %%1311. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
< End of report >
|
|
13.08.2012, 23:51
| #2 |
| /// Helfer-Team  | GUV Trojaner mit webcam infeziert Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen. Diese Nacheinander abarbeiten und die 4 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen. 1. Schritt Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
MOD - C:\Dokumente und Einstellungen\f.schwaiger\Lokale Einstellungen\Temp\install_0_msi.exe ()
SRV - (Ranmgsa) -- File not found
DRV - (WDICA) -- File not found
DRV - (UsbserFilt) -- system32\DRIVERS\usbser_lowerfltj.sys File not found
DRV - (upperdev) -- system32\DRIVERS\usbser_lowerflt.sys File not found
DRV - (Sony_EricssonWWSC) -- system32\DRIVERS\lnvoscard.sys File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (nmwcdnsuc) -- system32\drivers\nmwcdnsuc.sys File not found
DRV - (nmwcdnsu) -- system32\drivers\nmwcdnsu.sys File not found
DRV - (nmwcdc) -- system32\drivers\ccdcmbo.sys File not found
DRV - (nmwcd) -- system32\drivers\ccdcmb.sys File not found
DRV - (lnvounic) -- system32\DRIVERS\lnvounic.sys File not found
DRV - (lnvond5) -- system32\DRIVERS\lnvond5.sys File not found
DRV - (lnvomdm2) -- system32\DRIVERS\lnvomdm2.sys File not found
DRV - (lnvomdm) -- system32\DRIVERS\lnvomdm.sys File not found
DRV - (lnvomdfl2) -- system32\DRIVERS\lnvomdfl2.sys File not found
DRV - (lnvomdfl) -- system32\DRIVERS\lnvomdfl.sys File not found
DRV - (lnvogps) -- system32\DRIVERS\lnvogps.sys File not found
DRV - (lnvocard) -- system32\DRIVERS\lnvocard.sys File not found
DRV - (lnvobus) -- system32\DRIVERS\lnvobus.sys File not found
DRV - (lbrtfdc) -- File not found
DRV - (Changer) -- File not found
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&FORM=LENIE
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=110819&tt=050412_30b&babsrc=SP_ss&mntrId=7c016f7300000000000000242cbb3d9f
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=110819&tt=050412_30b&babsrc=KW_ss&mntrId=7c016f7300000000000000242cbb3d9f&q="
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\Facebook\npfbplugin_1_0_3.dll File not found
O2 - BHO: (no name) - {cbc5b60a-aa4d-45f6-84c2-d086f320299a} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.01.27 04:18:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\Shell - "" = AutoRun
O33 - MountPoints2\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{192e648a-848b-11e0-baf3-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{192e648a-848b-11e0-baf3-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{192e648a-848b-11e0-baf3-028037ec0200}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\Shell - "" = AutoRun
O33 - MountPoints2\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{21a64b61-a8d9-11de-ba6e-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{21a64b61-a8d9-11de-ba6e-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{21a64b61-a8d9-11de-ba6e-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{2b76201c-60d4-11de-ba5a-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{2b76201c-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2b76201c-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{2b762020-60d4-11de-ba5a-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{2b762020-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2b762020-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{2b762022-60d4-11de-ba5a-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{2b762022-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2b762022-60d4-11de-ba5a-028037ec0200}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{301eec44-32fd-11e0-bad5-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{301eec44-32fd-11e0-bad5-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{301eec44-32fd-11e0-bad5-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{35cb610f-09a1-11df-ba89-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{35cb610f-09a1-11df-ba89-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{35cb610f-09a1-11df-ba89-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{495e0b0c-51b0-11de-ba55-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{495e0b0c-51b0-11de-ba55-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{495e0b0c-51b0-11de-ba55-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\Shell - "" = AutoRun
O33 - MountPoints2\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\Shell - "" = AutoRun
O33 - MountPoints2\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\Shell - "" = AutoRun
O33 - MountPoints2\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\Shell - "" = AutoRun
O33 - MountPoints2\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{575d872b-81c8-11df-baa8-00242cbb3d9f}\Shell - "" = AutoRun
O33 - MountPoints2\{575d872b-81c8-11df-baa8-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{575d872b-81c8-11df-baa8-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{575d872c-81c8-11df-baa8-00242cbb3d9f}\Shell - "" = AutoRun
O33 - MountPoints2\{575d872c-81c8-11df-baa8-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{575d872c-81c8-11df-baa8-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{65331b0a-7a0f-11df-baa6-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{65331b0a-7a0f-11df-baa6-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{65331b0a-7a0f-11df-baa6-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{66a4d8d0-711b-11e0-baea-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{66a4d8d0-711b-11e0-baea-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{66a4d8d0-711b-11e0-baea-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{66a4d8d2-711b-11e0-baea-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{66a4d8d2-711b-11e0-baea-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{66a4d8d2-711b-11e0-baea-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{6e6dc99e-e420-11de-ba7e-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{6e6dc99e-e420-11de-ba7e-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6e6dc99e-e420-11de-ba7e-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{71f44c34-3772-11e0-bad9-0022facb1292}\Shell - "" = AutoRun
O33 - MountPoints2\{71f44c34-3772-11e0-bad9-0022facb1292}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{71f44c34-3772-11e0-bad9-0022facb1292}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{7a8d9aec-c01a-11df-babe-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{7a8d9aec-c01a-11df-babe-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7a8d9aec-c01a-11df-babe-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{7a8d9af0-c01a-11df-babe-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{7a8d9af0-c01a-11df-babe-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7a8d9af0-c01a-11df-babe-028037ec0200}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{7dd57220-5607-11de-ba58-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{7dd57220-5607-11de-ba58-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7dd57220-5607-11de-ba58-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{8ed15d73-a751-11de-ba6d-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{8ed15d73-a751-11de-ba6d-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8ed15d73-a751-11de-ba6d-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{92fcc0e0-9e04-11df-bab5-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{92fcc0e0-9e04-11df-bab5-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{92fcc0e0-9e04-11df-bab5-028037ec0200}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{a3e62c9f-5926-11de-ba59-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{a3e62c9f-5926-11de-ba59-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a3e62c9f-5926-11de-ba59-028037ec0200}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{a547b745-770d-11df-baa5-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{a547b745-770d-11df-baa5-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a547b745-770d-11df-baa5-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{a547b747-770d-11df-baa5-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{a547b747-770d-11df-baa5-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a547b747-770d-11df-baa5-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\Shell - "" = AutoRun
O33 - MountPoints2\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\Shell - "" = AutoRun
O33 - MountPoints2\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{abb1182e-ef10-11de-ba81-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{abb1182e-ef10-11de-ba81-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{abb1182e-ef10-11de-ba81-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{abb11830-ef10-11de-ba81-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{abb11830-ef10-11de-ba81-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{abb11830-ef10-11de-ba81-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{bfdef501-d1fb-11de-ba79-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{bfdef501-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bfdef501-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\Shell - "" = AutoRun
O33 - MountPoints2\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{bfdef523-d1fb-11de-ba79-b609d5197065}\Shell - "" = AutoRun
O33 - MountPoints2\{bfdef523-d1fb-11de-ba79-b609d5197065}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bfdef523-d1fb-11de-ba79-b609d5197065}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{bfdef527-d1fb-11de-ba79-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{bfdef527-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bfdef527-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{bfdef529-d1fb-11de-ba79-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{bfdef529-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bfdef529-d1fb-11de-ba79-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\Shell\AutoRun\command - "" = F:\NokiaPCIA_Autorun.exe
O33 - MountPoints2\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\Shell - "" = AutoRun
O33 - MountPoints2\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{d63f1336-2d32-11e0-bad4-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{d63f1336-2d32-11e0-bad4-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d63f1336-2d32-11e0-bad4-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\Shell - "" = AutoRun
O33 - MountPoints2\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{f6dc08d1-988f-11df-bab3-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{f6dc08d1-988f-11df-bab3-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f6dc08d1-988f-11df-bab3-028037ec0200}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{f9a2404c-9e02-11df-bab4-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{f9a2404c-9e02-11df-bab4-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f9a2404c-9e02-11df-bab4-028037ec0200}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2011.09.29 19:24:01 | 000,087,608 | ---- | C] () -- C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\inst.exe
@Alternate Data Stream - 60 bytes -> C:\Dokumente und Einstellungen\f.schwaiger\Desktop\Preisliste neu 2010.pdf:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Dokumente und Einstellungen\f.schwaiger\Desktop\JACOBS-Logo_ohneFond_M.jpg:AFP_AfpInfo
[2012.08.13 19:05:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.13 18:50:00 | 000,000,252 | ---- | M] () -- C:\WINDOWS\tasks\Auf Updates für Windows Live Toolbar prüfen.job
[2012.08.13 18:45:15 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.08.13 18:33:36 | 000,000,316 | ---- | M] () -- C:\WINDOWS\tasks\PMTask.job
[2012.08.13 18:32:24 | 000,001,024 | ---- | M] () -- C:\Dokumente und Einstellungen\f.schwaiger\.rnd
[2012.08.13 18:32:05 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.13 18:29:51 | 004,503,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ism_0_llatsni.pad
[2012.08.13 18:15:12 | 000,001,639 | ---- | M] () -- C:\Dokumente und Einstellungen\f.schwaiger\Startmenü\Programme\Autostart\ctfmon.lnk
[2012.08.13 14:22:00 | 000,001,014 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2012.08.10 09:28:00 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012.08.07 21:29:00 | 000,000,458 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! 2. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 3. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
4. Schritt
__________________ |
|
14.08.2012, 09:18
| #3 |
| | GUV Trojaner mit webcam infeziert Danke!!
__________________Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.14.01 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 f.schwaiger :: NEUTORNB07 [Administrator] Schutz: Aktiviert 14.08.2012 08:07:27 mbam-log-2012-08-14 (10-01-56).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 514771 Laufzeit: 1 Stunde(n), 50 Minute(n), 15 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FoxTab FLV Player (PUP.Adware.InstallCore) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Google\Chrome\Extensions\kincjchfokkeneeofpeefomkikfkiedl (PUP.FCTPlugin) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 3 C:\Programme\Object (PUP.FCTPlugin) -> Keine Aktion durchgeführt. C:\Programme\RelevantKnowledge (PUP.Spyware.MarketScore) -> Keine Aktion durchgeführt. C:\Programme\RelevantKnowledge\components (PUP.Spyware.MarketScore) -> Keine Aktion durchgeführt. Infizierte Dateien: 6 C:\Dokumente und Einstellungen\f.schwaiger\Eigene Dateien\Downloads\FLVPlayerSetup.exe (PUP.Adware.InstallCore) -> Keine Aktion durchgeführt. C:\Programme\FoxTabFLVPlayer\Uninstall\Uninstall.exe (PUP.Adware.InstallCore) -> Keine Aktion durchgeführt. C:\Programme\Object\status.txt (PUP.FCTPlugin) -> Keine Aktion durchgeführt. C:\Programme\Object\config.ini (PUP.FCTPlugin) -> Keine Aktion durchgeführt. C:\Programme\Object\enable.txt (PUP.FCTPlugin) -> Keine Aktion durchgeführt. C:\Programme\Object\status2.txt (PUP.FCTPlugin) -> Keine Aktion durchgeführt. (Ende) Code:
ATTFilter # AdwCleaner v1.801 - Logfile created 08/14/2012 at 10:09:35
# Updated 14/08/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : f.schwaiger - NEUTORNB07
# Boot Mode : Normal
# Running from : C:\Dokumente und Einstellungen\f.schwaiger\Desktop\adwcleaner.exe
# Option [Search]
***** [Services] *****
***** [Files / Folders] *****
Folder Found : C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\Babylon
Folder Found : C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\OpenCandy
Folder Found : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
Folder Found : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trymedia
File Found : C:\Programme\Mozilla Firefox\searchplugins\babylon.xml
File Found : C:\user.js
***** [Registry] *****
Key Found : HKCU\Software\Conduit
Key Found : HKLM\SOFTWARE\Babylon
Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Found : HKLM\SOFTWARE\Classes\S
Key Found : HKLM\SOFTWARE\Conduit
Value Found : HKCU\Software\Mozilla\Firefox\Extensions [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}]
***** [Registre - GUID] *****
Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.6001.18702
[OK] Registry is clean.
*************************
AdwCleaner[R1].txt - [2171 octets] - [14/08/2012 10:09:35]
########## EOF - C:\AdwCleaner[R1].txt - [2299 octets] ##########
Code:
ATTFilter # AdwCleaner v1.801 - Logfile created 08/14/2012 at 10:10:36
# Updated 14/08/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : f.schwaiger - NEUTORNB07
# Boot Mode : Normal
# Running from : C:\Dokumente und Einstellungen\f.schwaiger\Desktop\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
Folder Deleted : C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\Babylon
Folder Deleted : C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\OpenCandy
Folder Deleted : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
Folder Deleted : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trymedia
File Deleted : C:\Programme\Mozilla Firefox\searchplugins\babylon.xml
File Deleted : C:\user.js
***** [Registry] *****
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Conduit
Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}]
***** [Registre - GUID] *****
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.6001.18702
[OK] Registry is clean.
*************************
AdwCleaner[R1].txt - [2300 octets] - [14/08/2012 10:09:35]
AdwCleaner[S1].txt - [2273 octets] - [14/08/2012 10:10:36]
########## EOF - C:\AdwCleaner[S1].txt - [2401 octets] ##########
|
|
14.08.2012, 12:01
| #4 |
| /// Helfer-Team | GUV Trojaner mit webcam infeziert Wo ist das Log vom Fix? Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log> |
|
14.08.2012, 12:28
| #5 |
| | GUV Trojaner mit webcam infeziertCode:
ATTFilter All processes killed
========== OTL ==========
Service Ranmgsa stopped successfully!
Service Ranmgsa deleted successfully!
File File not found not found.
Service WDICA stopped successfully!
Service WDICA deleted successfully!
File File not found not found.
Service UsbserFilt stopped successfully!
Service UsbserFilt deleted successfully!
File system32\DRIVERS\usbser_lowerfltj.sys File not found not found.
Service upperdev stopped successfully!
Service upperdev deleted successfully!
File system32\DRIVERS\usbser_lowerflt.sys File not found not found.
Service Sony_EricssonWWSC stopped successfully!
Service Sony_EricssonWWSC deleted successfully!
File system32\DRIVERS\lnvoscard.sys File not found not found.
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
File File not found not found.
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
File File not found not found.
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
File File not found not found.
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
File File not found not found.
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
File File not found not found.
Service nmwcdnsuc stopped successfully!
Service nmwcdnsuc deleted successfully!
File system32\drivers\nmwcdnsuc.sys File not found not found.
Service nmwcdnsu stopped successfully!
Service nmwcdnsu deleted successfully!
File system32\drivers\nmwcdnsu.sys File not found not found.
Service nmwcdc stopped successfully!
Service nmwcdc deleted successfully!
File system32\drivers\ccdcmbo.sys File not found not found.
Service nmwcd stopped successfully!
Service nmwcd deleted successfully!
File system32\drivers\ccdcmb.sys File not found not found.
Service lnvounic stopped successfully!
Service lnvounic deleted successfully!
File system32\DRIVERS\lnvounic.sys File not found not found.
Service lnvond5 stopped successfully!
Service lnvond5 deleted successfully!
File system32\DRIVERS\lnvond5.sys File not found not found.
Service lnvomdm2 stopped successfully!
Service lnvomdm2 deleted successfully!
File system32\DRIVERS\lnvomdm2.sys File not found not found.
Service lnvomdm stopped successfully!
Service lnvomdm deleted successfully!
File system32\DRIVERS\lnvomdm.sys File not found not found.
Service lnvomdfl2 stopped successfully!
Service lnvomdfl2 deleted successfully!
File system32\DRIVERS\lnvomdfl2.sys File not found not found.
Service lnvomdfl stopped successfully!
Service lnvomdfl deleted successfully!
File system32\DRIVERS\lnvomdfl.sys File not found not found.
Service lnvogps stopped successfully!
Service lnvogps deleted successfully!
File system32\DRIVERS\lnvogps.sys File not found not found.
Service lnvocard stopped successfully!
Service lnvocard deleted successfully!
File system32\DRIVERS\lnvocard.sys File not found not found.
Service lnvobus stopped successfully!
Service lnvobus deleted successfully!
File system32\DRIVERS\lnvobus.sys File not found not found.
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
File File not found not found.
Service Changer stopped successfully!
Service Changer deleted successfully!
File File not found not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "Search the web (Babylon)" removed from browser.search.defaultenginename
Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1
Prefs.js: false removed from browser.search.suggest.enabled
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "google.com" removed from browser.startup.homepage
Prefs.js: jqs@sun.com:1.0 removed from extensions.enabledItems
Prefs.js: "hxxp://search.babylon.com/?affID=110819&tt=050412_30b&babsrc=KW_ss&mntrId=7c016f7300000000000000242cbb3d9f&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cbc5b60a-aa4d-45f6-84c2-d086f320299a}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cbc5b60a-aa4d-45f6-84c2-d086f320299a}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ deleted successfully.
C:\Programme\Windows Live Toolbar\msntb.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7}\ deleted successfully.
C:\Programme\Orbitdownloader\GrabPro.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoCDBurning deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoCDBurning deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0b13e4a6-8b1d-11de-ba68-028037ec0200}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0eb5feaf-ce68-11e0-bb04-00242cbb3d9f}\ not found.
File F:\.\Autorun.exe AUTORUN=1 not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{192e648a-848b-11e0-baf3-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{192e648a-848b-11e0-baf3-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{192e648a-848b-11e0-baf3-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{192e648a-848b-11e0-baf3-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{192e648a-848b-11e0-baf3-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{192e648a-848b-11e0-baf3-028037ec0200}\ not found.
File F:\.\Autorun.exe AUTORUN=1 not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21a64b0e-a8d9-11de-ba6e-f45f7e37612d}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{21a64b61-a8d9-11de-ba6e-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21a64b61-a8d9-11de-ba6e-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{21a64b61-a8d9-11de-ba6e-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21a64b61-a8d9-11de-ba6e-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{21a64b61-a8d9-11de-ba6e-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21a64b61-a8d9-11de-ba6e-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2b76201c-60d4-11de-ba5a-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2b76201c-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2b76201c-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2b76201c-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2b76201c-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2b76201c-60d4-11de-ba5a-028037ec0200}\ not found.
File D:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2b762020-60d4-11de-ba5a-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2b762020-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2b762020-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2b762020-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2b762020-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2b762020-60d4-11de-ba5a-028037ec0200}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2b762022-60d4-11de-ba5a-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2b762022-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2b762022-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2b762022-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2b762022-60d4-11de-ba5a-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2b762022-60d4-11de-ba5a-028037ec0200}\ not found.
File D:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{301eec44-32fd-11e0-bad5-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{301eec44-32fd-11e0-bad5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{301eec44-32fd-11e0-bad5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{301eec44-32fd-11e0-bad5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{301eec44-32fd-11e0-bad5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{301eec44-32fd-11e0-bad5-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{35cb610f-09a1-11df-ba89-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35cb610f-09a1-11df-ba89-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{35cb610f-09a1-11df-ba89-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35cb610f-09a1-11df-ba89-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{35cb610f-09a1-11df-ba89-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35cb610f-09a1-11df-ba89-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{495e0b0c-51b0-11de-ba55-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{495e0b0c-51b0-11de-ba55-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{495e0b0c-51b0-11de-ba55-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{495e0b0c-51b0-11de-ba55-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{495e0b0c-51b0-11de-ba55-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{495e0b0c-51b0-11de-ba55-028037ec0200}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52c51312-7c74-11e0-baf2-00242cbb3d9f}\ not found.
File F:\.\Autorun.exe AUTORUN=1 not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53b061eb-052c-11e1-bb1a-00242cbb3d9f}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53b061ec-052c-11e1-bb1a-00242cbb3d9f}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5642bbea-921e-11de-ba6a-907cb8fd73ae}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575d872b-81c8-11df-baa8-00242cbb3d9f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{575d872b-81c8-11df-baa8-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575d872b-81c8-11df-baa8-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{575d872b-81c8-11df-baa8-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575d872b-81c8-11df-baa8-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{575d872b-81c8-11df-baa8-00242cbb3d9f}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575d872c-81c8-11df-baa8-00242cbb3d9f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{575d872c-81c8-11df-baa8-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575d872c-81c8-11df-baa8-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{575d872c-81c8-11df-baa8-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575d872c-81c8-11df-baa8-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{575d872c-81c8-11df-baa8-00242cbb3d9f}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5cd9a48e-a1d8-11de-ba6c-028037ec0200}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{65331b0a-7a0f-11df-baa6-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65331b0a-7a0f-11df-baa6-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{65331b0a-7a0f-11df-baa6-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65331b0a-7a0f-11df-baa6-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{65331b0a-7a0f-11df-baa6-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65331b0a-7a0f-11df-baa6-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66a4d8d0-711b-11e0-baea-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66a4d8d0-711b-11e0-baea-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66a4d8d0-711b-11e0-baea-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66a4d8d0-711b-11e0-baea-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66a4d8d0-711b-11e0-baea-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66a4d8d0-711b-11e0-baea-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66a4d8d2-711b-11e0-baea-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66a4d8d2-711b-11e0-baea-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66a4d8d2-711b-11e0-baea-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66a4d8d2-711b-11e0-baea-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66a4d8d2-711b-11e0-baea-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66a4d8d2-711b-11e0-baea-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6e6dc99e-e420-11de-ba7e-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6e6dc99e-e420-11de-ba7e-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6e6dc99e-e420-11de-ba7e-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6e6dc99e-e420-11de-ba7e-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6e6dc99e-e420-11de-ba7e-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6e6dc99e-e420-11de-ba7e-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{71f44c34-3772-11e0-bad9-0022facb1292}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71f44c34-3772-11e0-bad9-0022facb1292}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{71f44c34-3772-11e0-bad9-0022facb1292}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71f44c34-3772-11e0-bad9-0022facb1292}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{71f44c34-3772-11e0-bad9-0022facb1292}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71f44c34-3772-11e0-bad9-0022facb1292}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7a8d9aec-c01a-11df-babe-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7a8d9aec-c01a-11df-babe-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7a8d9aec-c01a-11df-babe-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7a8d9aec-c01a-11df-babe-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7a8d9aec-c01a-11df-babe-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7a8d9aec-c01a-11df-babe-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7a8d9af0-c01a-11df-babe-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7a8d9af0-c01a-11df-babe-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7a8d9af0-c01a-11df-babe-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7a8d9af0-c01a-11df-babe-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7a8d9af0-c01a-11df-babe-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7a8d9af0-c01a-11df-babe-028037ec0200}\ not found.
File F:\.\Autorun.exe AUTORUN=1 not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7dd57220-5607-11de-ba58-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7dd57220-5607-11de-ba58-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7dd57220-5607-11de-ba58-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7dd57220-5607-11de-ba58-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7dd57220-5607-11de-ba58-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7dd57220-5607-11de-ba58-028037ec0200}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8ed15d73-a751-11de-ba6d-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8ed15d73-a751-11de-ba6d-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8ed15d73-a751-11de-ba6d-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8ed15d73-a751-11de-ba6d-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8ed15d73-a751-11de-ba6d-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8ed15d73-a751-11de-ba6d-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{902d1ef1-dd7e-11de-ba7b-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92fcc0e0-9e04-11df-bab5-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92fcc0e0-9e04-11df-bab5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92fcc0e0-9e04-11df-bab5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92fcc0e0-9e04-11df-bab5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92fcc0e0-9e04-11df-bab5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92fcc0e0-9e04-11df-bab5-028037ec0200}\ not found.
File F:\.\Autorun.exe AUTORUN=1 not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3e62c9f-5926-11de-ba59-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a3e62c9f-5926-11de-ba59-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3e62c9f-5926-11de-ba59-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a3e62c9f-5926-11de-ba59-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3e62c9f-5926-11de-ba59-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a3e62c9f-5926-11de-ba59-028037ec0200}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a547b745-770d-11df-baa5-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a547b745-770d-11df-baa5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a547b745-770d-11df-baa5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a547b745-770d-11df-baa5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a547b745-770d-11df-baa5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a547b745-770d-11df-baa5-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a547b747-770d-11df-baa5-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a547b747-770d-11df-baa5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a547b747-770d-11df-baa5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a547b747-770d-11df-baa5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a547b747-770d-11df-baa5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a547b747-770d-11df-baa5-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5b60b43-e9d5-11e0-bb0c-00242cbb3d9f}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5b60b45-e9d5-11e0-bb0c-00242cbb3d9f}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{abb1182e-ef10-11de-ba81-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abb1182e-ef10-11de-ba81-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{abb1182e-ef10-11de-ba81-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abb1182e-ef10-11de-ba81-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{abb1182e-ef10-11de-ba81-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abb1182e-ef10-11de-ba81-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{abb11830-ef10-11de-ba81-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abb11830-ef10-11de-ba81-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{abb11830-ef10-11de-ba81-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abb11830-ef10-11de-ba81-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{abb11830-ef10-11de-ba81-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abb11830-ef10-11de-ba81-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef501-d1fb-11de-ba79-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef501-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef501-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef501-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef501-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef501-d1fb-11de-ba79-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef50f-d1fb-11de-ba79-b180852bb6a0}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef523-d1fb-11de-ba79-b609d5197065}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef523-d1fb-11de-ba79-b609d5197065}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef523-d1fb-11de-ba79-b609d5197065}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef523-d1fb-11de-ba79-b609d5197065}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef523-d1fb-11de-ba79-b609d5197065}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef523-d1fb-11de-ba79-b609d5197065}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef527-d1fb-11de-ba79-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef527-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef527-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef527-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef527-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef527-d1fb-11de-ba79-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef529-d1fb-11de-ba79-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef529-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef529-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef529-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bfdef529-d1fb-11de-ba79-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bfdef529-d1fb-11de-ba79-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d4145bb2-6fd4-11e0-bae8-028037ec0200}\ not found.
File F:\NokiaPCIA_Autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d4145bb5-6fd4-11e0-bae8-00242cbb3d9f}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d63f1336-2d32-11e0-bad4-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d63f1336-2d32-11e0-bad4-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d63f1336-2d32-11e0-bad4-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d63f1336-2d32-11e0-bad4-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d63f1336-2d32-11e0-bad4-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d63f1336-2d32-11e0-bad4-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f6dc08c7-988f-11df-bab3-00242cbb3d9f}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f6dc08d1-988f-11df-bab3-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f6dc08d1-988f-11df-bab3-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f6dc08d1-988f-11df-bab3-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f6dc08d1-988f-11df-bab3-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f6dc08d1-988f-11df-bab3-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f6dc08d1-988f-11df-bab3-028037ec0200}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f9a2404c-9e02-11df-bab4-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f9a2404c-9e02-11df-bab4-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f9a2404c-9e02-11df-bab4-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f9a2404c-9e02-11df-bab4-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f9a2404c-9e02-11df-bab4-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f9a2404c-9e02-11df-bab4-028037ec0200}\ not found.
File F:\.\Autorun.exe AUTORUN=1 not found.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\Dokumente und Einstellungen\f.schwaiger\Anwendungsdaten\inst.exe moved successfully.
ADS C:\Dokumente und Einstellungen\f.schwaiger\Desktop\Preisliste neu 2010.pdf:AFP_AfpInfo deleted successfully.
ADS C:\Dokumente und Einstellungen\f.schwaiger\Desktop\JACOBS-Logo_ohneFond_M.jpg:AFP_AfpInfo deleted successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\WINDOWS\tasks\Auf Updates für Windows Live Toolbar prüfen.job moved successfully.
C:\WINDOWS\tasks\Adobe Flash Player Updater.job moved successfully.
C:\WINDOWS\tasks\PMTask.job moved successfully.
C:\Dokumente und Einstellungen\f.schwaiger\.rnd moved successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ism_0_llatsni.pad moved successfully.
C:\Dokumente und Einstellungen\f.schwaiger\Startmenü\Programme\Autostart\ctfmon.lnk moved successfully.
C:\WINDOWS\tasks\Google Software Updater.job moved successfully.
C:\WINDOWS\tasks\AppleSoftwareUpdate.job moved successfully.
C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Auflösungscache wurde geleert.
C:\Dokumente und Einstellungen\***\Desktop\cmd.bat deleted successfully.
C:\Dokumente und Einstellungen\***\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 41 bytes
User: f.schwaiger
->Temp folder emptied: 780102262 bytes
->Temporary Internet Files folder emptied: 1287803826 bytes
->Java cache emptied: 160156845 bytes
->FireFox cache emptied: 894120286 bytes
->Flash cache emptied: 2161787 bytes
User: F3859~1
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 70785 bytes
User: loeschen
->Temp folder emptied: 599667853 bytes
->Temporary Internet Files folder emptied: 867648 bytes
->Java cache emptied: 7617538 bytes
->FireFox cache emptied: 5516807 bytes
->Flash cache emptied: 405 bytes
User: NetworkService
->Temp folder emptied: 66264 bytes
->Temporary Internet Files folder emptied: 40890530 bytes
User: service
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 39893 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2668588 bytes
RecycleBin emptied: 1465149110 bytes
Total Files Cleaned = 5.004,00 mb
[EMPTYFLASH]
User: Administrator
User: All Users
User: Default User
->Flash cache emptied: 0 bytes
User: f.schwaiger
->Flash cache emptied: 0 bytes
User: F3859~1
User: LocalService
User: loeschen
->Flash cache emptied: 0 bytes
User: NetworkService
User: service
Total Flash Files Cleaned = 0,00 mb
OTL by OldTimer - Version 3.2.57.0 log created on 08142012_075714
Files\Folders moved on Reboot...
C:\WINDOWS\temp\Perflib_Perfdata_d88.dat moved successfully.
PendingFileRenameOperations files...
File C:\WINDOWS\temp\Perflib_Perfdata_d88.dat not found!
Registry entries deleted on Reboot...
|
|
14.08.2012, 16:04
| #6 |
| /// Helfer-Team | GUV Trojaner mit webcam infeziert Sehr gut!  Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________ --> GUV Trojaner mit webcam infeziert |
|
14.08.2012, 20:02
| #7 |
| | GUV Trojaner mit webcam infeziertCode:
ATTFilter Emsisoft Anti-Malware - Version 6.6
Letztes Update: 14.08.2012 17:44:44
Scan Einstellungen:
Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
Archiv Scan: An
ADS Scan: An
Scan Beginn: 14.08.2012 17:45:23
Key: hkey_local_machine\software\trymedia systems gefunden: Trace.Registry.trymedia!E1
Key: hkey_local_machine\software\trymedia systems\activemark software gefunden: Trace.Registry.trymedia!E1
C:\Programme\Nero7\Nero7Keygen.zip -> Nero7Keygen.exe gefunden: not-a-virus.Keygen.Nero!E2
C:\Programme\Nero7\Nero7Keygen.exe gefunden: Riskware.Keygen.Nero!E2
Gescannt 725479
Gefunden 4
Scan Ende: 14.08.2012 19:19:34
Scan Zeit: 1:34:11
C:\Programme\Nero7\Nero7Keygen.exe Quarantäne Riskware.Keygen.Nero!E2
C:\Programme\Nero7\Nero7Keygen.zip -> Nero7Keygen.exe Quarantäne not-a-virus.Keygen.Nero!E2
Key: hkey_local_machine\software\trymedia systems Quarantäne Trace.Registry.trymedia!E1
Key: hkey_local_machine\software\trymedia systems\activemark software Quarantäne Trace.Registry.trymedia!E1
Quarantäne 4
|
|
14.08.2012, 20:24
| #8 |
| /// Helfer-Team | GUV Trojaner mit webcam infeziert Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
|
|
15.08.2012, 08:31
| #9 |
| | GUV Trojaner mit webcam infeziertCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=583759f0c06e5840b7186d1749cedf23
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-15 06:59:50
# local_time=2012-08-15 08:59:50 (+0100, Westeuropäische Sommerzeit)
# country="Austria"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 103 103 0 0
# scanned=210574
# found=2
# cleaned=2
# scan_time=3959
C:\Dokumente und Einstellungen\f.schwaiger\Eigene Dateien\Eigene Videos\Veoh\VeohWebPlayerSetup_other_upgrade.exe Win32/Toolbar.Zugo application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Programme\FoxTabFLVPlayer\FLVPlayer.exe a variant of Win32/InstallCore.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
|
|
15.08.2012, 08:43
| #10 |
| /// Helfer-Team | GUV Trojaner mit webcam infeziert Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck |
|
15.08.2012, 09:30
| #11 |
| | GUV Trojaner mit webcam infeziert PluginCheck Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen. Überprüft wird: Browser, Flash, Java und Adobe Reader Version. Firefox 14.0.1 ist aktuell Flash (11,3,300,270) ist aktuell. Java (1,7,0,6) ist aktuell. Adobe Reader 10,1,4,38 ist aktuell. Zurück Tools: StartSeite PluginCheck Secunia Online Scan Weiterführendes: Java Updaten und Einstellen Secunia Personal Software Inspector (PSI) Family: TR/Agent |
|
15.08.2012, 10:34
| #12 |
| /// Helfer-Team | GUV Trojaner mit webcam infeziert Sehr gut! damit bist Du sauber und entlassen!  adwCleaner entfernen
Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Zurücksetzen der Sicherheitszonen Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen. Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html Systemwiederherstellungen leeren Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein: Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7 Danach wieder aktivieren. Aufräumen mit CCleaner Lasse mit CCleaner (Download) (Anleitung) Fehler in der
Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html PC wird immer langsamer - was tun? |
|
15.08.2012, 21:16
| #13 |
| | GUV Trojaner mit webcam infeziert Vielen vielen Dank. Top Sache dieses Forum. Geniale Hilfe.  Danke |
|
| Themen zu GUV Trojaner mit webcam infeziert |
| 32 bit, 7-zip, ad-aware, adobe after effects, any video converter, bho, bonjour, canon, computer, computernetzwerk, converter, cs4/contributeieplugin.dll, downloader, error, excel, festplatte, firefox, flash player, fontcache, google earth, gruppe, helper, hängen, install_0_msi.exe, lenovo, logfile, mp3, pixel, plug-in, registry, richtlinie, scan, search the web, security, senden, server, sketchup, software, symantec, t-mobile, third party, trojaner, windows, windows internet |
Linear-Darstellung
