| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU 2.07 unter XP gefunden ... und entfernt ?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
15.08.2012, 12:46
| #1 |
| |  GVU 2.07 unter XP gefunden ... und entfernt ? Hallo, gestern habe ich mir den GVU 2.07 eingefangen - vermutlich über den Besuch eine Webseite. Mein System: WIN XP, SP3 Ich konnte offline normal arbeiten, nur beim Onlinegehen kam der GVU Fullscreen. In der Autostart war der folgende Eintrag zu finden ctfmon mit dem Ziel: %systemroot%\system32\rundll32.exe C:\DOKUME~1\xxx\LOKALE~1\Temp\install_0_msi.exe,FQ10 den ich entfernt habe. Im angegebenen Ordner konnte ich anhand des Timestamps folgende Dateien finden, die vermutlich den Virus enthalten. install_0_msi.exe V.class Nach umbenennen beider Dateien und Entfernen des Autostart-Eintrags läuft der Rechner wieder. Ausserdem hat mein Avira Premium folgendes gefunden und in Quarantäne gesperrt. Code:
ATTFilter C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\48\5d2b74f0-58687864
[0] Archivtyp: ZIP
--> a/A.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/12-0507.BD.1.C
--> a/b.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/12-0507.AZ.1
--> a/a.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/12-0507.AP.1.C
--> a/d.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/12-0507.AX.1
--> a/ref.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/11-3544.CH.1
Zur Info nochmal die Ergebnisse von OTL (VOR den obigen Schritten gescant!) OTL Logfile: Code:
ATTFilter OTL logfile created on: 15.08.2012 09:49:38 - Run 1 OTL by OldTimer - Version 3.2.57.0 Folder = C:\Dokumente und Einstellungen\xxx\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,04 Gb Available Physical Memory | 52,19% Memory free 3,85 Gb Paging File | 2,72 Gb Available in Paging File | 70,78% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 48,83 Gb Total Space | 25,34 Gb Free Space | 51,88% Space Free | Partition Type: NTFS Drive E: | 7,31 Gb Total Space | 7,09 Gb Free Space | 96,93% Space Free | Partition Type: FAT32 Drive I: | 97,65 Gb Total Space | 47,11 Gb Free Space | 48,25% Space Free | Partition Type: NTFS Drive J: | 195,31 Gb Total Space | 23,97 Gb Free Space | 12,27% Space Free | Partition Type: NTFS Drive P: | 97,65 Gb Total Space | 80,94 Gb Free Space | 82,88% Space Free | Partition Type: NTFS Drive S: | 439,45 Gb Total Space | 419,09 Gb Free Space | 95,37% Space Free | Partition Type: NTFS Drive Y: | 232,88 Gb Total Space | 16,89 Gb Free Space | 7,25% Space Free | Partition Type: NTFS Drive Z: | 52,61 Gb Total Space | 3,35 Gb Free Space | 6,37% Space Free | Partition Type: NTFS Computer Name: SILVERSTONE | User Name: xxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.15 09:26:00 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\xxx\desktop\OTL.exe PRC - [2012.08.12 11:19:42 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- P:\Tools\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.02 11:32:44 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- P:\Tools\Avira\AntiVir Desktop\sched.exe PRC - [2012.07.02 11:31:49 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- P:\Tools\Avira\AntiVir Desktop\avwebgrd.exe PRC - [2012.07.02 11:31:47 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- P:\Tools\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.07.02 11:31:35 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- P:\Tools\Avira\AntiVir Desktop\avmailc.exe PRC - [2012.07.02 11:31:32 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- P:\Tools\Avira\AntiVir Desktop\avguard.exe PRC - [2012.06.06 21:33:42 | 001,564,872 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe PRC - [2012.04.17 15:05:00 | 000,651,264 | ---- | M] () -- P:\Tools\HTC Sync\htcUPCTLoader.exe PRC - [2012.01.18 14:02:04 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2012.01.16 12:32:20 | 001,073,152 | ---- | M] () -- P:\CF9\db\slserver54\bin\swsoc.exe PRC - [2012.01.16 12:32:20 | 000,696,320 | ---- | M] () -- P:\CF9\db\slserver54\bin\swagent.exe PRC - [2012.01.16 12:32:20 | 000,114,688 | ---- | M] () -- P:\CF9\db\slserver54\bin\swstrtr.exe PRC - [2011.10.21 16:08:42 | 000,213,376 | ---- | M] (FileOpen Systems Inc.) -- C:\Programme\FileOpen\Services\FileOpenManagerSvc32.exe PRC - [2011.10.21 16:08:34 | 000,724,352 | ---- | M] (FileOpen Systems Inc.) -- C:\Programme\FileOpen\Services\FileOpenBroker32.exe PRC - [2011.10.07 11:40:42 | 001,387,288 | ---- | M] (Logitech, Inc.) -- P:\Tools\Logitech\SetPointP\SetPoint.exe PRC - [2011.09.27 21:05:24 | 000,149,784 | ---- | M] (Logitech, Inc.) -- C:\Programme\Gemeinsame Dateien\Logishrd\KHAL3\KHALMNPR.exe PRC - [2011.09.22 19:18:01 | 000,150,928 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Forefront UAG\Endpoint Components\3.1.0\uagqecsvc.exe PRC - [2011.09.15 13:06:04 | 000,088,576 | ---- | M] () -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe PRC - [2011.08.30 13:24:59 | 000,624,056 | ---- | M] (Adobe Systems Inc.) -- P:\Adobe\Acrobat 8.0\Acrobat\acrotray.exe PRC - [2011.02.18 19:38:24 | 000,793,200 | ---- | M] (VMware, Inc.) -- P:\Tools\VMWare\bin\wsnm_usbctrl.exe PRC - [2011.02.18 19:37:56 | 000,494,192 | ---- | M] (VMware, Inc.) -- P:\Tools\VMWare\bin\wsnm.exe PRC - [2009.10.09 17:07:20 | 000,493,248 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe PRC - [2009.09.10 14:17:10 | 000,058,880 | ---- | M] (Macromedia Inc.) -- P:\CF9\runtime\bin\jrunsvc.exe PRC - [2009.09.10 14:17:10 | 000,058,368 | ---- | M] (Macromedia Inc.) -- P:\CF9\runtime\bin\jrun.exe PRC - [2009.09.03 15:57:04 | 001,877,328 | ---- | M] (EMC) -- P:\Tools\Iomega StorCenter\sohoclient.exe PRC - [2009.06.04 10:34:41 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe PRC - [2008.12.11 16:39:42 | 000,255,256 | ---- | M] (EMC Corporation) -- C:\Programme\Retrospect\Retrospect Express HD 2.5\Retrospect.exe PRC - [2008.12.11 16:39:40 | 009,499,928 | ---- | M] (EMC Corporation) -- C:\Programme\Retrospect\Retrospect Express HD 2.5\RetroExpress.exe PRC - [2008.12.11 16:39:40 | 000,120,088 | ---- | M] (EMC Corporation) -- C:\Programme\Retrospect\Retrospect Express HD 2.5\retrorun.exe PRC - [2008.12.06 19:32:22 | 000,886,784 | ---- | M] () -- P:\Tools\AeroSnap\AeroSnap.exe PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.01.05 18:12:58 | 000,258,048 | ---- | M] (SONIX) -- C:\WINDOWS\tsnp2std.exe PRC - [2006.09.15 14:21:54 | 000,675,840 | ---- | M] (Sonix) -- C:\WINDOWS\vsnp2std.exe PRC - [2006.07.19 07:04:22 | 001,128,053 | ---- | M] (Acronis) -- P:\Tools\TrueImageMonitor.exe PRC - [2006.07.18 15:14:36 | 001,866,526 | ---- | M] (Acronis) -- P:\Tools\TimounterMonitor.exe PRC - [2006.07.17 18:38:52 | 000,126,976 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe PRC - [2006.07.17 18:38:50 | 000,204,800 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe PRC - [2005.10.06 10:22:52 | 000,172,032 | ---- | M] (Maxtor Corp) -- P:\Tools\Maxtorplatte\MaxBackService.exe PRC - [2005.10.06 09:22:50 | 000,057,344 | ---- | M] (Maxtor Corp.) -- C:\Programme\Maxtor\OneTouch Status\MaxMenuMgr.exe PRC - [2005.07.15 14:29:50 | 001,335,296 | ---- | M] (Maxtor) -- P:\Tools\Maxtorplatte\msssort.exe PRC - [2005.02.16 17:15:20 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe PRC - [2004.08.04 04:56:32 | 001,445,912 | ---- | M] (Cisco Systems, Inc.) -- P:\Tools\VPN Client BI\cvpnd.exe ========== Modules (No Company Name) ========== MOD - [2012.07.02 11:32:52 | 000,398,288 | ---- | M] () -- P:\Tools\Avira\AntiVir Desktop\sqlite3.dll MOD - [2012.06.13 18:20:38 | 012,433,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\01abbadafaf265d9f4ac9bbb247acb98\System.Windows.Forms.ni.dll MOD - [2012.06.13 18:20:27 | 001,592,320 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\d86f2038209a4cf0d0f5b30f6375c9b2\System.Drawing.ni.dll MOD - [2012.06.13 18:19:14 | 003,186,688 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll MOD - [2012.06.13 18:19:13 | 002,933,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll MOD - [2012.06.13 18:19:13 | 000,425,984 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll MOD - [2012.06.13 18:19:07 | 002,048,000 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll MOD - [2012.05.09 13:18:43 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d5b7368bde0f65aa15d9f46b498cc89\System.Configuration.ni.dll MOD - [2012.05.09 13:13:12 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll MOD - [2012.05.09 13:10:23 | 007,953,408 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll MOD - [2012.05.09 13:10:11 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll MOD - [2012.04.17 15:05:00 | 001,515,520 | ---- | M] () -- P:\Tools\HTC Sync\Maps\R66Api.dll MOD - [2012.04.17 15:05:00 | 000,651,264 | ---- | M] () -- P:\Tools\HTC Sync\htcUPCTLoader.exe MOD - [2012.04.17 15:05:00 | 000,559,244 | ---- | M] () -- P:\Tools\HTC Sync\sqlite3.7.dll MOD - [2012.04.17 15:05:00 | 000,516,599 | ---- | M] () -- P:\Tools\HTC Sync\sqlite3.dll MOD - [2012.04.17 15:05:00 | 000,389,120 | ---- | M] () -- P:\Tools\HTC Sync\htcDetect.dll MOD - [2012.04.17 15:05:00 | 000,172,032 | ---- | M] () -- P:\Tools\HTC Sync\htcDetectLegend.dll MOD - [2012.04.17 15:05:00 | 000,151,552 | ---- | M] () -- P:\Tools\HTC Sync\htcDisk.dll MOD - [2012.04.17 15:05:00 | 000,103,936 | ---- | M] () -- P:\Tools\HTC Sync\OutputLog.dll MOD - [2012.04.17 15:05:00 | 000,094,208 | ---- | M] () -- P:\Tools\HTC Sync\fdHttpd.dll MOD - [2012.01.16 12:32:20 | 001,073,152 | ---- | M] () -- P:\CF9\db\slserver54\bin\swsoc.exe MOD - [2012.01.16 12:32:20 | 000,696,320 | ---- | M] () -- P:\CF9\db\slserver54\bin\swagent.exe MOD - [2012.01.16 12:32:20 | 000,114,688 | ---- | M] () -- P:\CF9\db\slserver54\bin\swstrtr.exe MOD - [2011.10.07 11:41:16 | 000,879,896 | ---- | M] () -- P:\Tools\Logitech\SetPointP\Macros\MacroCore.dll MOD - [2011.09.15 13:06:04 | 000,088,576 | ---- | M] () -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe MOD - [2009.09.03 15:57:05 | 006,463,488 | ---- | M] () -- P:\Tools\Iomega StorCenter\wxmsw28u_vc_custom.dll MOD - [2009.08.05 11:34:44 | 000,048,640 | ---- | M] () -- P:\CF9\lib\PerfmonClient.dll MOD - [2009.08.05 11:15:30 | 000,123,392 | ---- | M] () -- P:\CF9\lib\CFXNeo.dll MOD - [2009.08.05 11:08:42 | 000,060,416 | ---- | M] () -- P:\CF9\lib\cfregistry.dll MOD - [2009.07.09 12:10:00 | 004,988,928 | R--- | M] () -- C:\Programme\Retrospect\Retrospect Express HD 2.5\de\RetroExpress.resources.dll MOD - [2009.02.27 16:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU MOD - [2008.12.06 19:32:22 | 000,886,784 | ---- | M] () -- P:\Tools\AeroSnap\AeroSnap.exe MOD - [2008.12.06 19:31:32 | 000,046,080 | ---- | M] () -- P:\Tools\AeroSnap\AeroSnap.Application.dll MOD - [2007.05.11 01:31:33 | 000,921,600 | ---- | M] () -- P:\Adobe\Acrobat 8.0\Acrobat\AdistRes.DEU MOD - [2006.07.17 18:38:14 | 000,045,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Acronis\Common\rpc_client.dll ========== Win32 Services (SafeList) ========== SRV - [2012.07.24 09:36:11 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.11 16:18:32 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\programme\gemeinsame dateien\akamai/netsession_win_4f7fccd.dll -- (Akamai) SRV - [2012.07.02 11:32:44 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- P:\Tools\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.07.02 11:31:49 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- P:\Tools\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService) SRV - [2012.07.02 11:31:35 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- P:\Tools\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService) SRV - [2012.07.02 11:31:32 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- P:\Tools\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.01.16 12:32:20 | 000,696,320 | ---- | M] () [Auto | Running] -- P:\CF9\db\slserver54\bin\swagent.exe -- (ColdFusion 9 ODBC Agent) SRV - [2012.01.16 12:32:20 | 000,114,688 | ---- | M] () [Auto | Running] -- P:\CF9\db\slserver54\bin\swstrtr.exe -- (ColdFusion 9 ODBC Server) SRV - [2012.01.16 12:28:35 | 000,115,712 | ---- | M] (Acresso) [On_Demand | Stopped] -- P:\CF9\solr\solr.exe -- (CF9Solr) SRV - [2011.12.16 15:08:57 | 000,487,312 | ---- | M] () [On_Demand | Stopped] -- C:\WINDOWS\DOWNLO~1\DMService.exe -- (DMService) SRV - [2011.10.21 16:08:42 | 000,213,376 | ---- | M] (FileOpen Systems Inc.) [Auto | Running] -- C:\Programme\FileOpen\Services\FileOpenManagerSvc32.exe -- (FileOpenManagerSvc) SRV - [2011.09.27 21:03:28 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2011.09.22 19:18:01 | 000,150,928 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Forefront UAG\Endpoint Components\3.1.0\uagqecsvc.exe -- (uagqecsvc) SRV - [2011.09.15 13:06:04 | 000,088,576 | ---- | M] () [Auto | Running] -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service) SRV - [2011.02.18 19:38:24 | 000,793,200 | ---- | M] (VMware, Inc.) [Auto | Running] -- P:\Tools\VMWare\bin\wsnm_usbctrl.exe -- (wsnm_usbctrl) SRV - [2011.02.18 19:37:56 | 000,494,192 | ---- | M] (VMware, Inc.) [Auto | Running] -- P:\Tools\VMWare\bin\wsnm.exe -- (wsnm) SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2009.10.09 17:07:20 | 000,493,248 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent) SRV - [2009.09.10 14:17:10 | 000,058,880 | ---- | M] (Macromedia Inc.) [Auto | Running] -- P:\CF9\runtime\bin\jrunsvc.exe -- (ColdFusion 9 Application Server) SRV - [2009.06.04 10:34:41 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2008.12.11 16:39:42 | 000,136,472 | ---- | M] (EMC Corporation) [Auto | Stopped] -- C:\Programme\Retrospect\Retrospect Express HD 2.5\rthlpsvc.exe -- (RetroExp Helper) SRV - [2008.12.11 16:39:40 | 000,120,088 | ---- | M] (EMC Corporation) [Auto | Running] -- C:\Programme\Retrospect\Retrospect Express HD 2.5\retrorun.exe -- (RetroExpLauncher) SRV - [2008.04.28 07:57:03 | 003,677,616 | ---- | M] (Verity, Inc.) [On_Demand | Stopped] -- P:\CF9\verity\k2\_nti40\bin\k2admin.exe -- (ColdFusion 9 Search Server) SRV - [2007.04.05 08:45:12 | 000,077,824 | ---- | M] () [On_Demand | Stopped] -- P:\CF9\jnbridge\CFDotNetsvc.exe -- (ColdFusion 9 .NET Service) SRV - [2006.07.17 18:38:50 | 000,204,800 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc) SRV - [2006.06.13 17:30:06 | 000,061,440 | ---- | M] (Macromedia Inc.) [On_Demand | Stopped] -- P:\ColdFusion\runtime\bin\jrunsvc.exe -- (ColdFusion MX 7 Application Server) SRV - [2006.01.05 00:06:02 | 000,163,840 | ---- | M] (Alex Feinman) [On_Demand | Stopped] -- P:\Tools\ISO-Recorder\ImapiHelper.exe -- (Imapi Helper) SRV - [2004.08.04 04:56:32 | 001,445,912 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- P:\Tools\VPN Client BI\cvpnd.exe -- (CVPND) SRV - [2003.10.02 21:37:26 | 000,118,853 | ---- | M] () [On_Demand | Stopped] -- P:\ColdFusion\db\slserver54\bin\swstrtr.exe -- (ColdFusion MX 7 ODBC Server) SRV - [2003.10.02 21:37:24 | 000,733,253 | ---- | M] () [On_Demand | Stopped] -- P:\ColdFusion\db\slserver54\bin\swagent.exe -- (ColdFusion MX 7 ODBC Agent) SRV - [2003.07.28 20:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PCAMPR5.SYS -- (PCAMPR5) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - [2012.07.02 11:33:25 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2012.05.08 16:06:40 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2012.05.08 16:06:40 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.09.02 08:31:28 | 000,039,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt) DRV - [2011.09.02 08:31:20 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2011.09.02 08:30:58 | 000,012,184 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE) DRV - [2011.02.18 19:38:24 | 000,039,984 | R--- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vmwvusb.sys -- (vmwvusb) DRV - [2010.07.28 04:45:30 | 001,756,384 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athuw.sys -- (AR9271) DRV - [2010.06.22 18:01:50 | 000,021,248 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\htcnprot.sys -- (htcnprot) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.04.06 20:31:38 | 000,278,728 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt) DRV - [2010.04.06 20:31:38 | 000,025,416 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt) DRV - [2009.10.09 16:50:48 | 000,020,152 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vpnva.sys -- (vpnva) DRV - [2009.06.10 00:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ANDROIDUSB.sys -- (HTCAND32) DRV - [2009.05.28 11:19:59 | 000,388,000 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\timntr.sys -- (timounter) DRV - [2009.05.28 11:19:59 | 000,032,288 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter) DRV - [2009.05.28 11:19:57 | 000,099,776 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\snapman.sys -- (snapman) DRV - [2008.07.30 07:51:30 | 000,277,736 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\acedrv11.sys -- (acedrv11) DRV - [2008.03.17 11:03:46 | 000,101,376 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2007.06.26 10:15:00 | 000,262,912 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp) DRV - [2007.06.14 11:41:58 | 004,429,312 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) DRV - [2007.04.09 12:38:06 | 012,039,552 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\snp2sxp.sys -- (SNP2STD) DRV - [2006.06.14 12:53:00 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbccid.sys -- (USBCCID) DRV - [2004.08.04 04:54:32 | 000,269,387 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA) DRV - [2003.08.28 21:40:26 | 000,189,792 | ---- | M] (Zone Labs Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant) DRV - [2003.07.24 18:55:50 | 000,139,604 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE) DRV - [2003.05.01 13:26:34 | 000,005,220 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig?hl=de&source=iglk|https://www.google.com/calendar/render?pli=1|hxxp://www.quoka.de/tiermarkt/fische-aquaristik/|hxxp://www.deine-tierwelt.de/kleinanzeigen/komplett-aquarium-351-l-c88556/?l=55452&r=200&so=51&i=50|hxxp://kleinanzeigen.ebay.de/anzeigen/s-fische/aquarium/55452/aquarium/k0c138l5108r200+fische.art_s:aquarium|hxxp://www.markt.de/landkreis-mainz-bingen/Tiere/Aquaristik/Aquaristik-Zubeh%C3%B6r/Aquarien/Komplett-Aquarien/categoryId,1201060104/radius,200/sorting,-date/suche.htm" FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0.2 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: OPIE@guid.customsoftwareconsult.com:1.2.3 FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9 FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7 FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.1.2 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2 FF - prefs.js..network.proxy.http: "188.93.20.179" FF - prefs.js..network.proxy.http_port: 8080 FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co" FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google) FF - HKLM\Software\MozillaPlugins\@reiner-sct.com/OWOK,version=2.0.0.4: C:\Programme\REINER SCT\OWOK\NPAPI-20\nprsct_owok_npapi-2004.dll (REINER Kartengeräte GmbH und Co. KG.) FF - HKLM\Software\MozillaPlugins\@sun.com/npsopluginmi;version=1.0: P:\Open Office\OpenOffice.org 3\program [2009.06.04 13:16:35 | 000,000,000 | ---D | M] FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: P:\Adobe\AcrobatReader\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: P:\Tools\Firefox\components [2012.07.24 09:36:13 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: P:\Tools\Firefox\plugins [2012.04.15 14:29:54 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: P:\Tools\Thunderbird\components [2011.10.18 12:48:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: P:\Tools\Thunderbird\plugins [2011.05.15 17:45:18 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Extensions [2011.05.15 17:45:18 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2012.08.14 08:22:55 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\extensions [2012.08.14 08:22:55 | 000,000,000 | ---D | M] (Flagfox) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2011.01.11 11:40:11 | 000,000,000 | ---D | M] (Web Developer) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12} [2011.01.11 11:40:11 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\extensions\de-DE@dictionaries.addons.mozilla.org [2012.06.22 12:00:15 | 000,000,000 | ---D | M] (Support.com Toolbar) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\extensions\toolbar@ask.com [2009.07.06 11:47:33 | 000,001,780 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\searchplugins\chordie.xml [2009.06.01 14:34:45 | 000,000,650 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\searchplugins\delicious-tag.xml [2009.06.01 15:33:39 | 000,000,894 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\searchplugins\geizhalsd.xml [2012.08.12 13:02:05 | 000,005,674 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\searchplugins\mister-wong.xml [2009.06.01 14:35:28 | 000,001,770 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\searchplugins\php-manual.xml [2009.06.01 15:33:50 | 000,002,043 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\searchplugins\preisroboter.xml [2009.06.01 15:34:04 | 000,003,450 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\searchplugins\selfhtml.xml [2009.06.01 15:35:21 | 000,001,144 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\searchplugins\wikipedia-en-google.xml [2009.06.01 14:36:06 | 000,002,198 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\searchplugins\wolfram-alpha.xml [2009.06.01 14:36:34 | 000,004,140 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\hph3idms.default\searchplugins\youtube.xml [2012.06.20 09:28:24 | 000,005,800 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\xxx\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HPH3IDMS.DEFAULT\EXTENSIONS\{05F6A7EA-896B-11DA-8BDE-F66BAD1E3F3A}.XPI [2012.02.29 16:19:23 | 000,258,567 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\xxx\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HPH3IDMS.DEFAULT\EXTENSIONS\{46551EC9-40F0-4E47-8E18-8E5CF550CFB8}.XPI [2011.08.22 17:11:07 | 000,044,481 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\xxx\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HPH3IDMS.DEFAULT\EXTENSIONS\ARTEM@DEMCHENKOV.COLORS.XPI [2011.12.23 11:04:51 | 000,345,230 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\xxx\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HPH3IDMS.DEFAULT\EXTENSIONS\OPIE@GUID.CUSTOMSOFTWARECONSULT.COM.XPI [2011.08.26 17:09:21 | 000,052,248 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\xxx\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HPH3IDMS.DEFAULT\EXTENSIONS\SELECTIONLINKS@FLORIANGILLES.COM.XPI [2012.05.08 16:13:32 | 000,074,258 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\xxx\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HPH3IDMS.DEFAULT\EXTENSIONS\SITEDELTA@SCHIERLA.DE.XPI [2012.07.27 14:51:51 | 000,184,864 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\xxx\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HPH3IDMS.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI [2011.08.26 10:45:47 | 000,011,510 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\xxx\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HPH3IDMS.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI [2012.04.15 15:07:12 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2010.05.24 09:59:05 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION ========== Chrome ========== CHR - homepage: hxxp://www.google.de/ig?hl=de&source=iglk CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: hxxp://www.google.de/ig?hl=de&source=iglk CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\21.0.1180.75\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\21.0.1180.75\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\21.0.1180.75\gcswf32.dll CHR - plugin: Shockwave Flash (Disabled) = C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll CHR - plugin: Adobe Acrobat (Disabled) = P:\Adobe\AcrobatReader\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = P:\Tools\Firefox\plugins\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Programme\Java\jre6\bin\plugin2\npjp2.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = P:\Tools\Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = P:\Tools\Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = P:\Tools\Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = P:\Tools\Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = P:\Tools\Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = P:\Tools\Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = P:\Tools\Firefox\plugins\npqtplugin7.dll CHR - plugin: Google Update (Enabled) = C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Google Updater (Enabled) = C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Programme\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Programme\Microsoft Silverlight\4.1.10111.0\npctrl.dll CHR - plugin: OWOK (Enabled) = C:\Programme\REINER SCT\OWOK\NPAPI-20\nprsct_owok_npapi-2004.dll CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll O1 HOSTS File: ([2009.10.09 07:39:30 | 000,001,344 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 148.188.4.63 ingweb12.ing.de.bic O1 - Hosts: 10.183.135.129 vip2.ing.de.bic O1 - Hosts: 10.183.135.129 ingvipedit.eu.boehringer.com O1 - Hosts: 10.183.135.129 ingedit.eu.boehringer.com O1 - Hosts: 10.183.136.163 inhas00298.eu.boehringer.com O1 - Hosts: 172.29.1.89 inhas00301.eu.boehringer.com O1 - Hosts: 172.29.1.90 inhas00302.eu.boehringer.com O1 - Hosts: 10.183.136.128 inhas00317.eu.boehringer.com O1 - Hosts: 10.183.136.128 bipublish O1 - Hosts: 10.183.136.128 ingaslb01_vip401 O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - P:\Adobe\/Adobe Contribute CS3/contributeieplugin.dll () O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD1.dll (Conduit Ltd.) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - P:\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.) O2 - BHO: (AusweisApp 1.7.0.0) - {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} - P:\Orga\AusweisApp\siqeCardClient.ols (OpenLimit SignCubes AG) O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Programme\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - P:\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - P:\Adobe\/Adobe Contribute CS3/contributeieplugin.dll () O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - P:\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\prxtbDVD1.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acrobat Assistant 8.0] P:\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis) O4 - HKLM..\Run: [AcronisTimounterMonitor] P:\Tools\TimounterMonitor.exe (Acronis) O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] P:\Adobe\AcrobatReader\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Programme\Gemeinsame Dateien\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [avgnt] P:\Tools\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [EvtMgr6] P:\Tools\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4 - HKLM..\Run: [FileOpenBroker] C:\Programme\FileOpen\Services\FileOpenBroker32.exe (FileOpen Systems Inc.) O4 - HKLM..\Run: [HTC Sync Loader] P:\Tools\HTC Sync\htcUPCTLoader.exe () O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [MaxBackSchedule] P:\Tools\Maxtorplatte\MaxBackService.exe (Maxtor Corp) O4 - HKLM..\Run: [mssSort] P:\Tools\Maxtorplatte\msssort.exe (Maxtor) O4 - HKLM..\Run: [mxomssmenu] C:\Programme\Maxtor\OneTouch Status\maxmenumgr.exe (Maxtor Corp.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [RetroExpress] C:\Programme\Retrospect\Retrospect Express HD 2.5\RetroExpress.exe (EMC Corporation) O4 - HKLM..\Run: [ScanSoft OmniPage SE 16-reminder] P:\Tools\Omnipage\Ereg\Ereg.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe (Sonix) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [TrueImageMonitor.exe] P:\Tools\TrueImageMonitor.exe (Acronis) O4 - HKLM..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe (SONIX) O4 - HKCU..\Run: [AeroSnap] P:\Tools\AeroSnap\AeroSnap.exe () O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe (Akamai Technologies, Inc) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Iomega StorCenter.lnk = P:\Tools\Iomega StorCenter\sohoclient.exe (EMC) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data] O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - P:\Tools\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - P:\Tools\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - P:\Tools\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O15 - HKCU\..Trusted Domains: boehringer-ingelheim.com ([ptp51] https in Trusted sites) O15 - HKCU\..Trusted Domains: nordsee.com ([portal] https in Trusted sites) O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} https://extranet.nordsee.com/CACHE/stc/1/binaries/vpnweb.cab (Cisco AnyConnect VPN Client Web Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} https://portal.nordsee.com/InternalSite/WhlCompMgr.cab (Forefront UAG client components) O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab (ScorchPlugin Class) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://ive.boehringer-ingelheim.com/dana-cached/setup/JuniperSetupSP1.cab (JuniperSetupControlXP Class) O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: S:\Desktop-Hintergrund.bmp O24 - Desktop BackupWallPaper: S:\Desktop-Hintergrund.bmp O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis) O30 - LSA: Security Packages - (wsauth) - C:\WINDOWS\System32\wsauth.dll (VMware, Inc.) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.05.28 10:58:20 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{33eee518-90af-11df-b003-00508dbad98e}\Shell - "" = AutoRun O33 - MountPoints2\{33eee518-90af-11df-b003-00508dbad98e}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{33eee518-90af-11df-b003-00508dbad98e}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{33eee51b-90af-11df-b003-00508dbad98e}\Shell - "" = AutoRun O33 - MountPoints2\{33eee51b-90af-11df-b003-00508dbad98e}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{33eee51b-90af-11df-b003-00508dbad98e}\Shell\AutoRun\command - "" = E:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.08.15 09:49:15 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe [2012.07.26 10:16:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Startmenü\Programme\Accessories [2012.07.26 10:13:04 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie7 [2012.07.24 12:11:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\PCHealth [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.08.15 09:55:00 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job [2012.08.15 09:47:58 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\defogger_reenable [2012.08.15 09:27:11 | 000,001,222 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-436374069-839522115-1003UA.job [2012.08.15 09:26:45 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012.08.15 09:26:00 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe [2012.08.15 09:22:25 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012.08.15 08:56:16 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\GlaryInitialize.job [2012.08.15 08:56:02 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012.08.15 08:55:40 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.08.15 08:54:37 | 004,503,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ism_0_llatsni.pad [2012.08.14 17:48:45 | 000,002,109 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Wunderlist.lnk [2012.08.14 17:42:20 | 000,001,626 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Startmenü\Programme\Autostart\ctfmon.lnk [2012.08.12 17:04:22 | 000,043,520 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.08.12 14:33:00 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job [2012.07.26 13:30:15 | 006,483,699 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\beautiful sight.mp3 [2012.07.26 10:14:11 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2012.07.24 09:31:19 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2012.07.17 14:47:29 | 000,000,040 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Mediaport.conf [2012.07.16 12:31:55 | 000,002,390 | ---- | M] () -- C:\WINDOWS\musi.ini [2012.07.16 12:16:46 | 000,746,669 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\DVD erstellen mit Mediaport-1.pdf [2012.07.16 12:16:04 | 010,407,228 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\borderline.mp3 [2012.07.16 12:04:10 | 000,000,678 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\Mediaport.lnk [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.08.15 09:47:58 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\defogger_reenable [2012.08.14 17:42:20 | 004,503,728 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ism_0_llatsni.pad [2012.08.14 17:42:20 | 000,001,626 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Startmenü\Programme\Autostart\ctfmon.lnk [2012.07.16 12:16:46 | 000,746,669 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\DVD erstellen mit Mediaport-1.pdf [2012.07.16 12:16:10 | 000,000,040 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Mediaport.conf [2012.07.16 12:04:10 | 000,000,678 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\Mediaport.lnk [2012.07.09 11:40:46 | 000,002,390 | ---- | C] () -- C:\WINDOWS\musi.ini [2012.02.22 14:57:19 | 000,000,008 | ---- | C] () -- C:\WINDOWS\System32\nvModes.dat [2012.02.16 10:13:11 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011.12.08 11:48:08 | 003,799,951 | ---- | C] () -- C:\WINDOWS\System32\erdmpg-6.dll [2011.12.07 15:55:27 | 000,060,304 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\g2mdlhlpx.exe [2011.11.09 15:19:22 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2std.ini [2011.11.09 15:19:21 | 012,039,552 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2sxp.sys [2011.11.09 15:19:21 | 000,025,472 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncamd.sys [2011.11.09 15:19:19 | 000,151,552 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2std.dll [2011.11.09 15:19:19 | 000,077,824 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2std.dll [2011.09.15 12:09:52 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\PUTTY.RND [2011.03.09 12:10:14 | 000,000,357 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI [2011.02.16 15:02:57 | 000,009,299 | ---- | C] () -- C:\WINDOWS\Studio7.ini [2011.02.16 15:02:30 | 000,196,096 | ---- | C] () -- C:\WINDOWS\System32\MACD32.DLL [2011.02.16 15:02:30 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\MASE32.DLL [2011.02.16 15:02:30 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\Mamc32d.dll [2011.02.16 15:02:30 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\MAMC32.DLL [2011.02.16 15:02:30 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\MASD32.DLL [2011.02.16 15:02:30 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\MA32.DLL [2010.03.10 15:31:35 | 000,000,185 | -H-- | C] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\eSReg.ini [2009.06.08 11:59:04 | 000,043,520 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== LOP Check ========== [2009.06.03 11:45:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis [2011.12.20 09:33:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Cisco [2011.07.04 20:53:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular [2011.12.12 12:55:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FileOpen [2009.09.17 10:20:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Juniper Networks [2009.06.04 20:29:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Maxtor [2011.03.04 14:38:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\regid.1986-12.com.adobe [2012.08.15 09:56:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RetroExp [2011.03.09 12:10:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft [2012.03.28 08:10:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Solidshield [2012.06.20 18:40:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TP-LINK [2009.06.14 11:11:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinZip [2010.05.20 16:04:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\AeroSnapApp [2012.07.16 12:39:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Audacity [2009.06.03 16:34:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Buhl Data Service [2009.10.05 17:24:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Canon [2011.01.18 13:21:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2010.03.15 15:48:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\ColorSchemer [2010.04.30 17:02:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\com.livebrush.2205ABAA7E8202CDC1251B1FA1E879364B7BAB52.1 [2011.10.31 15:10:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\com.springbox.mobilizer [2011.12.08 11:48:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Doblon [2011.12.21 12:37:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Dropbox [2010.10.26 09:18:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\DVDVideoSoft [2011.01.11 09:22:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\DVDVideoSoftIEHelpers [2012.04.02 15:32:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\elsterformular [2011.12.12 12:56:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\FileOpen [2012.03.29 10:39:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Games [2011.06.08 14:35:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\GetRightToGo [2011.11.07 10:54:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\GlarySoft [2011.03.09 11:35:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\GumNotes [2012.02.06 13:52:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\HTC [2011.09.15 15:33:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1 [2012.02.27 13:25:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Imaging Sciences International [2011.05.13 12:13:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Juniper Networks [2011.02.07 13:55:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Leadertech [2009.06.04 20:29:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Maxtor Quick Start [2010.03.13 19:33:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\NAVI [2011.12.06 10:40:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Notepad++ [2009.06.08 10:05:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\OpenOffice.org [2012.08.15 08:33:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\PriceGong [2012.03.01 16:26:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\ProtectDisc [2012.02.03 18:25:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\REINER SCT [2011.07.05 10:39:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\ScanSoft [2010.11.22 09:02:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\stickies [2011.01.18 13:20:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Subversion [2012.01.31 18:37:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\TeamViewer [2010.03.22 10:01:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Teleca [2010.05.28 08:01:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Thunderbird [2012.06.09 15:14:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Titanium [2012.01.19 13:44:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Visio [2011.10.21 14:57:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Zeon [2012.08.15 08:56:16 | 000,000,304 | ---- | M] () -- C:\WINDOWS\Tasks\GlaryInitialize.job [2012.08.15 09:55:00 | 000,000,232 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job ========== Purity Check ========== < End of report > [/CODE] und Extras OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 15.08.2012 09:49:38 - Run 1
OTL by OldTimer - Version 3.2.57.0 Folder = C:\Dokumente und Einstellungen\xxx\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,04 Gb Available Physical Memory | 52,19% Memory free
3,85 Gb Paging File | 2,72 Gb Available in Paging File | 70,78% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48,83 Gb Total Space | 25,34 Gb Free Space | 51,88% Space Free | Partition Type: NTFS
Drive E: | 7,31 Gb Total Space | 7,09 Gb Free Space | 96,93% Space Free | Partition Type: FAT32
Drive I: | 97,65 Gb Total Space | 47,11 Gb Free Space | 48,25% Space Free | Partition Type: NTFS
Drive J: | 195,31 Gb Total Space | 23,97 Gb Free Space | 12,27% Space Free | Partition Type: NTFS
Drive P: | 97,65 Gb Total Space | 80,94 Gb Free Space | 82,88% Space Free | Partition Type: NTFS
Drive S: | 439,45 Gb Total Space | 419,09 Gb Free Space | 95,37% Space Free | Partition Type: NTFS
Drive Y: | 232,88 Gb Total Space | 16,89 Gb Free Space | 7,25% Space Free | Partition Type: NTFS
Drive Z: | 52,61 Gb Total Space | 3,35 Gb Free Space | 6,37% Space Free | Partition Type: NTFS
Computer Name: SILVERSTONE | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- P:\Tools\Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- P:\Tools\Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "P:\Microsoft Office\WordViewer2003\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Universal Viewer] -- "P:\Tools\Universal Viewer\Viewer.exe" "@@%1" (UVViewSoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"P:\Tools\VMWare\bin\vmware-remotemks.exe" = P:\Tools\VMWare\bin\vmware-remotemks.exe:*:Enabled:VMware Remote MKS -- (VMware, Inc.)
"P:\Tools\VMWare\bin\wswc.exe" = P:\Tools\VMWare\bin\wswc.exe:*:Enabled:VMware View Client -- (VMware, Inc.)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"P:\Tools\Maxtorplatte\mssManager.exe" = P:\Tools\Maxtorplatte\mssManager.exe:*:Enabled:mssManager -- ()
"P:\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe" = P:\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe:*:Enabled:Adobe Dreamweaver CS3 -- (Adobe Systems, Inc.)
"F:\xampplite\mysql\bin\mysqld.exe" = F:\xampplite\mysql\bin\mysqld.exe:*:Enabled:mysqld
"C:\Programme\Skype\Plugin Manager\skypePM.exe" = C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"P:\Tools\WS_FTP\WS_FTP95.exe" = P:\Tools\WS_FTP\WS_FTP95.exe:*:Enabled:WS_FTP 95 -- (Ipswitch, Inc. 81 Hartwell Ave. Lexington, MA)
"F:\xampplite\apache\bin\httpd.exe" = F:\xampplite\apache\bin\httpd.exe:*:Disabled:Apache HTTP Server
"P:\Tools\Iomega StorCenter\sohoclient.exe" = P:\Tools\Iomega StorCenter\sohoclient.exe:*:Enabled:Storage Manager 2.1.15.48076 -- (EMC)
"C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Dropbox\bin\Dropbox.exe" = C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox -- (Dropbox, Inc.)
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"P:\Tools\VMWare\bin\vmware-remotemks.exe" = P:\Tools\VMWare\bin\vmware-remotemks.exe:*:Enabled:VMware Remote MKS -- (VMware, Inc.)
"P:\Tools\VMWare\bin\wswc.exe" = P:\Tools\VMWare\bin\wswc.exe:*:Enabled:VMware View Client -- (VMware, Inc.)
"C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe" = C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe:*:Disabled:Akamai NetSession Interface -- (Akamai Technologies, Inc)
"P:\Tools\Forticlient\ipsec.exe" = P:\Tools\Forticlient\ipsec.exe:*:Disabled:FortiClient VPN Service
"P:\Tools\devolo\informer\devinf.exe" = P:\Tools\devolo\informer\devinf.exe:*:Enabled:MicroLink Informer
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{04D5D8F8-7654-11d3-A50A-00C04F44A9DA}" = Visio
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0A88ADDA-E297-4AB8-9540-016230895F62}" = MSN Toolbar
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{17E27BFC-BD58-11d2-AFC1-00C04F72FB3E}" = VBA (2816b)
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGear Starter
"{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}" = Adobe After Effects CS3 Presets
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1ADED728-C94D-B49E-4818-79FD96121AD4}" = Livebrush Lite
"{1C875160-7E87-45C6-85C5-4FE2A840A3B8}" = Maxtor Quick Start
"{1DCCB2B0-A482-464F-94F6-1219693E34F0}_is1" = AeroSnap 0.61
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23B72D50-1C7E-491C-8086-9E060051D316}" = Manual CanoScan LiDE 60
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2A6355EB-273D-4368-9DB6-FB99EBA9FABD}" = Cisco AnyConnect VPN Client
"{3031A053-DC97-4D03-9179-BF6F98F63FA2}" = Wunderlist
"{307702F6-FD2C-484A-8F2E-A1DCE85FD9CC}_is1" = 2weistein
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B11379A-9196-4228-981A-BB255E13109E}" = Autostart-Manager 2006
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{3EF372FC-C84D-4C72-B5E8-7D9C4B0936A6}" = Voiceprint Plus V6
"{411E0CC3-587A-468C-B461-95FAFD05E4DE}" = Adobe InDesign CS3
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{485ACF57-F364-440A-8496-E1E81C8FA1AA}" = Adobe Premiere Pro CS3 Third Party Content
"{487295FC-6C5C-11d3-A508-00C04F44A9DA}" = Programmdateien
"{49D23765-6C69-11d3-A508-00C04F44A9DA}" = Microsoft Visio 2000 (DE)
"{49DCE5F5-0B70-466F-A800-583BB4688B2C}" = Grafikfilter
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}" = Adobe Dreamweaver CS3
"{4B9D2D0C-9965-4D43-82AF-63B1BA47D46E}" = ScanSoft OmniPage SE 16
"{4F0C7CCF-5666-474B-B02E-AC514A95EC93}" = NVIDIA GAME System Software 2.8.1
"{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}" = Adobe Premiere Pro CS3 Functional Content
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{5624C000-B109-11D4-9DB4-00E0290FCAC5}" = VPN Client
"{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA}" = Adobe Premiere Pro CS3
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5AC54C83-060F-9610-CC29-9310CBDF80CB}" = Mobilizer
"{5B916827-C9BD-4113-BBF8-10265FF77648}" = AAMInstaller
"{61F619CD-BF1A-421D-A600-17E284659C71}" = Hilfe zu Developing Visio Solutions
"{62ED340C-678A-4841-8BD5-641410122538}" = AusweisApp
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{672D0014-71A9-45EF-B10E-DEF7426961A6}" = Sibelius Scorch (Firefox, Opera, Netscape only)
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{6E9EF98E-259E-416D-B5F8-0ABDB99942CE}" = Adobe Flash Player 10 ActiveX
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{75438C0E-9925-412E-AD85-D0E71C6CE2ED}" = USB2.0 PC Camera (SN9C201&202)
"{760BF94F-4FAF-4EF6-96D9-B55B12993992}" = Sherlock Holmes - Die Spur der Erwachten Remastered
"{76B01EB2-622C-11D3-8F9E-00C04F8DD7E3}" = Projektpläne
"{76B01EB5-622C-11D3-8F9E-00C04F8DD7E3}" = Organigramme
"{76B01EB8-622C-11D3-8F9E-00C04F8DD7E3}" = Raumplan
"{76B01EBB-622C-11D3-8F9E-00C04F8DD7E3}" = Netzwerkdiagramme
"{76B01EBE-622C-11D3-8F9E-00C04F8DD7E3}" = Landkarten
"{76B01EC1-622C-11D3-8F9E-00C04F8DD7E3}" = Formulare und Diagramme
"{76B01EC4-622C-11D3-8F9E-00C04F8DD7E3}" = Flußdiagramme
"{76B01EC7-622C-11D3-8F9E-00C04F8DD7E3}" = Blockdiagramm
"{76B01EC8-622C-11D3-8F9E-00C04F8DD7E3}" = Lösungen
"{76B01ECC-622C-11D3-8F9E-00C04F8DD7E3}" = Shape-Explorer
"{76B01ECD-622C-11D3-8F9E-00C04F8DD7E3}" = Als HTML speichern
"{76B01ECE-622C-11D3-8F9E-00C04F8DD7E3}" = Datenfeld-Berichts-Assistent
"{76B01ED0-622C-11D3-8F9E-00C04F8DD7E3}" = Seitenlayout-Assistent
"{76B01ED2-622C-11D3-8F9E-00C04F8DD7E3}" = Datenbankassistent
"{76B01ED3-622C-11D3-8F9E-00C04F8DD7E3}" = Datenfeld-Editor
"{76B01ED4-622C-11D3-8F9E-00C04F8DD7E3}" = Hilfe zu Clipart und Symbolen
"{76B01ED5-622C-11D3-8F9E-00C04F8DD7E3}" = Clipart und Symbole
"{76B01ED6-622C-11D3-8F9E-00C04F8DD7E3}" = Hilfe zu Beschriftungen und Verbindern
"{76B01ED7-622C-11D3-8F9E-00C04F8DD7E3}" = Beschriftungen und Verbinder
"{76B01ED9-622C-11D3-8F9E-00C04F8DD7E3}" = Anzeige von CAD-Zeichnungen
"{76B01EDB-622C-11D3-8F9E-00C04F8DD7E3}" = Hilfe zu Rahmen und Hintergründen
"{76B01EDC-622C-11D3-8F9E-00C04F8DD7E3}" = Rahmen und Hintergrunde
"{76B01EDD-622C-11D3-8F9E-00C04F8DD7E3}" = Zusatzprogramme
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3
"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Support.com Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C640345-AF96-4ABA-A697-97D2A0B8C6DB}" = Adobe Flash CS3
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{90FF23FE-0E1B-40DF-A22E-B4C0372E5936}" = Iomega Product Registration
"{9688A8B4-7654-11d3-A50A-00C04F44A9DA}" = Visio Core Files
"{9688A8C2-7654-11d3-A50A-00C04F44A9DA}" = Hilfe fur Visio 2000 (HTML Help)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9F31A1CD-57BC-47AD-B403-C6BD29FF1E2D}" = Sibelius Scorch (ActiveX Only)
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5386C02-6638-11D3-8F9F-00C04F8DD7E3}" = Hilfe zu Programmdateien
"{A5386C03-6638-11D3-8F9F-00C04F8DD7E3}" = Shape-Explorer-Hilfe
"{A5386C04-6638-11D3-8F9F-00C04F8DD7E3}" = Hilfe zu Blockdiagrammen
"{A5386C05-6638-11D3-8F9F-00C04F8DD7E3}" = Hilfe zu Flußdiagrammen
"{A5386C06-6638-11D3-8F9F-00C04F8DD7E3}" = Hilfe zu Formularen und Diagrammen
"{A5386C07-6638-11D3-8F9F-00C04F8DD7E3}" = Hilfe zu Landkarten
"{A5386C08-6638-11D3-8F9F-00C04F8DD7E3}" = Hilfe zu Netzwerkdiagrammen
"{A5386C09-6638-11D3-8F9F-00C04F8DD7E3}" = Hilfe zu Raumplänen
"{A5386C0A-6638-11D3-8F9F-00C04F8DD7E3}" = Hilfe zu Organigrammen
"{A5386C0B-6638-11D3-8F9F-00C04F8DD7E3}" = Hilfe zu Projektplänen
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB77DFDE-9949-4AEF-B180-BE322C3E65D0}" = HTC Sync
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-1033-F400-7760-000000000003}" = Adobe Acrobat 8 Professional - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{AFC39E22-39C8-4C3E-895D-B9D2B3144E74}" = TP-LINK Wireless Client Utility
"{B1914265-0D07-48E0-A937-F20A76D0032D}" = Acronis*True*Image*Home
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BA0D764E-4256-4408-979B-6B1AEFCAE985}_is1" = Karaoke DVD Burner
"{BCC57687-98A2-4C4C-B0F8-BC6B6F52D4E3}" = Retrospect Express HD 2.5
"{BCEDD813-269C-4D8F-A4BA-01FDC66254D3}" = Adobe Flash Video Encoder
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{C8D7A672-F697-4572-AC62-C856053A8DBC}" = Adobe Illustrator CS3
"{C9D456FD-C25B-49DE-AA71-6B76D6550B23}" = Adobe Fireworks CS3
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CA78EE0D-B198-46BF-80E6-89EE4D49101D}" = VMware View Client
"{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}" = Canon CanoScan Toolbox 4.9
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}" = WinZip 11.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFC9F871-7C40-40B6-BE4A-B98A5B309716}" = Adobe Flash Professional CS5
"{D01D4968-D20E-431D-859F-5CE139B2DF25}" = Versionshinweise
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}" = Adobe Photoshop CS3
"{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{D765F1CE-5AE5-4C47-B134-AE58AC474740}" = OpenOffice.org 3.1
"{D7BF3B76-EEF9-4868-9B2B-42ABF60B279A}" = Microsoft_VC80_CRT_x86
"{DA896917-C1DA-45B2-B4D2-68162F16C0DD}" = Adobe Creative Suite 3 Master Collection
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DFC6573E-124D-4026-BFA4-B433C9D3FF21}" = ISO Recorder
"{DFFDDCF5-CB32-4354-8823-1B9E68025953}" = Adobe Setup
"{E21115EF-2B96-44F2-83CB-6347E017AC5F}" = FileOpen Client
"{E680BB35-F552-4B28-BE4F-8E7CE515636F}" = Octava SD4
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E8814A8F-3B06-11D3-8CD7-00C04F72C04D}" = Microsoft Visual Studio Service Pack 3
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"{FF3E2850-BD2E-4B56-A89D-21E588D518E0}" = Adobe Contribute CS3
"7-Zip" = 7-Zip 4.65
"Adobe Acrobat 8 Professional - English, Français, Deutsch_831" = Adobe Acrobat 8.3.1 - CPSID_83708
"Adobe AIR" = Adobe AIR
"Adobe ColdFusion 9 .NET Integration Services" = Adobe ColdFusion 9 .NET Integration Services
"Adobe ColdFusion 9 Solr Service" = Adobe ColdFusion 9 Solr Service
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_67a7fb1e97aa14ee9ef0950eb6fd757" = Adobe Creative Suite 3 Master Collection hinzufügen oder entfernen
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Akamai" = Akamai NetSession Interface Service
"Amazon Kindle" = Amazon Kindle
"Audacity_is1" = Audacity 2.0
"Avira AntiVir Desktop" = Avira Antivirus Premium 2012
"CDex" = CDex extraction audio
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.livebrush.2205ABAA7E8202CDC1251B1FA1E879364B7BAB52.1" = Livebrush Lite
"com.springbox.mobilizer" = Mobilizer
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"ElsterFormular 12.2.2.6665k" = ElsterFormular
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"FLV Player" = FLV Player 2.0 (build 25)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free DVD Creator (by minidvdsoft)_is1" = Free DVD Creator version 2.0
"Free Video to Flash Converter_is1" = Free Video to Flash Converter version 4.7.16
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.32
"Glary Utilities_is1" = Glary Utilities 2.39.0.1310
"Google Updater" = Google Updater
"Hardcopy(P__Tools_Hardcopy)" = Hardcopy (P:\Tools\Hardcopy)
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{1C875160-7E87-45C6-85C5-4FE2A840A3B8}" = Maxtor Quick Start
"Iomega StorCenter" = Iomega StorCenter
"IrfanView" = IrfanView (remove only)
"Juniper_Setup_Client Activex Control" = Juniper Networks Setup Client Activex Control
"LAME_is1" = LAME v3.99.3 (for Windows)
"LHTTSGED" = L&H TTS3000 Deutsch
"Marvell Miniport Driver" = Marvell Miniport Driver
"Mediaport" = Mediaport
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Forefront UAG endpoint components 3.1.0" = Microsoft Forefront UAG endpoint components v4.0.0
"Mobile Partner" = Mobile Partner
"MozBackup" = MozBackup 1.4.9
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Notepad++" = Notepad++
"NVIDIA Drivers" = NVIDIA Drivers
"OWOK-NPAPI-20" = OWOK 2.0.0.4 NPAPI
"PixelRuler_is1" = PixelRuler v8.0.0.0
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"sp6" = Logitech SetPoint 6.32
"SQL-Teacher_is1" = SQL-Teacher
"StudioDV" = Studio
"Uninstall Adobe ColdFusion 9" = Adobe ColdFusion 9
"Uninstall Macromedia ColdFusion MX 7" = Macromedia ColdFusion MX 7
"Uninstall_is1" = Uninstall 1.0.0.1
"Universal Viewer" = Universal Viewer
"VLC media player" = VLC media player 1.1.7
"VMidi" = vanBasco's Karaoke Player
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Support.com Toolbar Updater
"Akamai" = Akamai NetSession Interface
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"GoToMeeting" = GoToMeeting 5.1.0.880
"Juniper_Networks_Cache_Cleaner 5.5.0" = Juniper Networks Cache Cleaner 5.5.0
"Juniper_Networks_Cache_Cleaner 6.3.0" = Juniper Networks Cache Cleaner 6.3.0
"Juniper_Setup_Client" = Juniper Networks Setup Client
"Neoteris_Host_Checker" = Juniper Networks Host Checker
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 15.08.2012 02:30:42 | Computer Name = SILVERSTONE | Source = Userenv | ID = 1041
Description = Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}"
nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich
durch eine fehlerhafte Registrierung verursacht.
Error - 15.08.2012 02:30:42 | Computer Name = SILVERSTONE | Source = Userenv | ID = 1041
Description = Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"
nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich
durch eine fehlerhafte Registrierung verursacht.
Error - 15.08.2012 02:30:42 | Computer Name = SILVERSTONE | Source = Userenv | ID = 1041
Description = Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}"
nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich
durch eine fehlerhafte Registrierung verursacht.
Error - 15.08.2012 02:30:42 | Computer Name = SILVERSTONE | Source = Userenv | ID = 1041
Description = Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"
nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich
durch eine fehlerhafte Registrierung verursacht.
Error - 15.08.2012 02:31:21 | Computer Name = SILVERSTONE | Source = simpleServer | ID = 3299
Description = simpleServer information: Error: Ignoring unknown directive "StartThread"
At
line 6 in C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\sohoclient\cfg/sohoclient.conf
Make
sure the required module is loaded and the relevant handlers have been added. Ensure
the directive is after all LoadModule and AddHandler directives. .
Error - 15.08.2012 02:55:50 | Computer Name = SILVERSTONE | Source = Userenv | ID = 1041
Description = Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}"
nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich
durch eine fehlerhafte Registrierung verursacht.
Error - 15.08.2012 02:55:50 | Computer Name = SILVERSTONE | Source = Userenv | ID = 1041
Description = Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"
nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich
durch eine fehlerhafte Registrierung verursacht.
Error - 15.08.2012 02:55:51 | Computer Name = SILVERSTONE | Source = Userenv | ID = 1041
Description = Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}"
nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich
durch eine fehlerhafte Registrierung verursacht.
Error - 15.08.2012 02:55:51 | Computer Name = SILVERSTONE | Source = Userenv | ID = 1041
Description = Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"
nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich
durch eine fehlerhafte Registrierung verursacht.
Error - 15.08.2012 02:56:33 | Computer Name = SILVERSTONE | Source = simpleServer | ID = 3299
Description = simpleServer information: Error: Ignoring unknown directive "StartThread"
At
line 6 in C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\sohoclient\cfg/sohoclient.conf
Make
sure the required module is loaded and the relevant handlers have been added. Ensure
the directive is after all LoadModule and AddHandler directives. .
[ Cisco AnyConnect VPN Client Events ]
Error - 27.06.2012 08:18:34 | Computer Name = SILVERSTONE | Source = vpnagent | ID = 67108866
Description = Function: CCapiCertificate::verifyChainPolicy File: .\Certificates\CapiCertificate.cpp
Line:
1914 Invoked Function: CertVerifyCertificateChainPolicy Return Code: -2146762487
(0x800B0109) Description: Eine Zertifikatskette wurde zwar verarbeitet, endete jedoch
mit einem Stammzertifikat, das beim Vertrauensanbieter nicht als vertrauenswürdig
gilt.
Error - 27.06.2012 08:18:34 | Computer Name = SILVERSTONE | Source = vpnagent | ID = 67108866
Description = Function: CCapiCertificate::verifyChainPolicy File: .\Certificates\CapiCertificate.cpp
Line:
1914 Invoked Function: CertVerifyCertificateChainPolicy Return Code: -2146762487
(0x800B0109) Description: Eine Zertifikatskette wurde zwar verarbeitet, endete jedoch
mit einem Stammzertifikat, das beim Vertrauensanbieter nicht als vertrauenswürdig
gilt.
Error - 27.06.2012 08:19:41 | Computer Name = SILVERSTONE | Source = vpnagent | ID = 67108866
Description = Function: CDtlsProtocol::timerCallback File: .\DtlsProtocol.cpp Line:
406 Invoked Function: CDtlsProtocol::retransmit Return Code: -31719410 (0xFE1C000E)
Description:
TLSPROTOCOL_ERROR_MAX_RETRANSMITS_EXCEEDED
Error - 27.06.2012 08:19:41 | Computer Name = SILVERSTONE | Source = vpnagent | ID = 67108866
Description = Function: CCdtpProtocol::OnTunnelInitiateComplete File: .\CdtpProtocol.cpp
Line:
506 Invoked Function: initiateTunnel Return Code: -31719410 (0xFE1C000E) Description:
TLSPROTOCOL_ERROR_MAX_RETRANSMITS_EXCEEDED
Error - 27.06.2012 08:19:41 | Computer Name = SILVERSTONE | Source = vpnagent | ID = 67108866
Description = Function: CTunnelStateMgr::OnTunnelInitiateComplete File: .\TunnelStateMgr.cpp
Line:
1038 Invoked Function: ITunnelProtocol::initiateTunnel Return Code: -31719410 (0xFE1C000E)
Description:
TLSPROTOCOL_ERROR_MAX_RETRANSMITS_EXCEEDED callback
Error - 27.06.2012 08:19:41 | Computer Name = SILVERSTONE | Source = vpnagent | ID = 67108866
Description = Function: CTlsTunnelMgr::OnTunnelInitiateComplete File: .\TunnelMgr.cpp
Line:
599 Invoked Function: CTunnelStateMgr::initiateTunnel Return Code: -31719410 (0xFE1C000E)
Description:
TLSPROTOCOL_ERROR_MAX_RETRANSMITS_EXCEEDED callback
Error - 27.06.2012 09:41:28 | Computer Name = SILVERSTONE | Source = vpnagent | ID = 67108866
Description = Function: RestoreProxySettingsToBrowser File: .\BrowserProxy.cpp Line:
1040 Invoked Function: DeleteFile Return Code: 2 (0x00000002) Description: Das System
kann die angegebene Datei nicht finden.
Error - 25.07.2012 16:42:56 | Computer Name = SILVERSTONE | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
Error - 25.07.2012 16:42:56 | Computer Name = SILVERSTONE | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::getDownloaderMessage File: .\MainThread.cpp Line:
964 Invoked Function: CVpnMgr::processEvents Return Code: 0 (0x00000000) Description:
fatal error, stopping service
Error - 25.07.2012 16:42:56 | Computer Name = SILVERSTONE | Source = vpnagent | ID = 67108866
Description = Function: service_main_NT File: .\Agent.cpp Line: 674 Invoked Function:
WaitForSingleObject Return Code: 6 (0x00000006) Description: Das Handle ist ungültig.
[ System Events ]
Error - 11.07.2012 10:20:00 | Computer Name = SILVERSTONE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
von Dienst Akamai.
Error - 16.07.2012 13:39:59 | Computer Name = SILVERSTONE | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Avira Email Schutz" wurde unerwartet beendet. Dies ist
bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden
durchgeführt: Starten Sie den Dienst neu..
Error - 23.07.2012 02:48:24 | Computer Name = SILVERSTONE | Source = Windows Update Agent | ID = 16
Description = Verbindung nicht möglich: Es konnte keine Verbindung mit dem Dienst
"Automatische Updates" hergestellt werden, daher können Updates nicht nach dem
angegebenen Zeitplan heruntergeladen und installiert werden. Es wird weiterhin versucht,
eine Verbindung herzustellen.
Error - 12.08.2012 05:14:28 | Computer Name = SILVERSTONE | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
Peer "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
Minuten wiederholt. Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
(0x80072751)
Error - 12.08.2012 05:14:28 | Computer Name = SILVERSTONE | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 12.08.2012 05:14:28 | Computer Name = SILVERSTONE | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
Peer "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
Minuten wiederholt. Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
(0x80072751)
Error - 12.08.2012 05:14:28 | Computer Name = SILVERSTONE | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 15 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 12.08.2012 05:18:38 | Computer Name = SILVERSTONE | Source = DCOM | ID = 10010
Description = Der Server "{4EB61BAC-A3B6-4760-9581-655041EF4D69}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 12.08.2012 05:18:45 | Computer Name = SILVERSTONE | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
Peer "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
Minuten wiederholt. Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
(0x80072751)
Error - 12.08.2012 05:18:45 | Computer Name = SILVERSTONE | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
< End of report >
Geändert von sabing (15.08.2012 um 12:56 Uhr) |
|
15.08.2012, 15:03
| #2 |
| /// Helfer-Team  | GVU 2.07 unter XP gefunden ... und entfernt ? Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Ersetze die *** Sternchen wieder in den Benutzernamen zurück! Code:
ATTFilter :OTL
SRV - [2012.07.11 16:18:32 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\programme\gemeinsame dateien\akamai/netsession_win_4f7fccd.dll -- (Akamai)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PCAMPR5.SYS -- (PCAMPR5)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.de/ig?hl=de&source=iglk|https://www.google.com/calendar/render?pli=1|http://www.quoka.de/tiermarkt/fische-aquaristik/|http://www.deine-tierwelt.de/kleinanzeigen/komplett-aquarium-351-l-c88556/?l=55452&r=200&so=51&i=50|http://kleinanzeigen.ebay.de/anzeigen/s-fische/aquarium/55452/aquarium/k0c138l5108r200+fische.art_s:aquarium|http://www.markt.de/landkreis-mainz-bingen/Tiere/Aquaristik/Aquaristik-Zubeh%C3%B6r/Aquarien/Komplett-Aquarien/categoryId,1201060104/radius,200/sorting,-date/suche.htm"
FF - prefs.js..network.proxy.http: "188.93.20.179"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD1.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
OO3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\prxtbDVD1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.05.28 10:58:20 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{33eee518-90af-11df-b003-00508dbad98e}\Shell - "" = AutoRun
O33 - MountPoints2\{33eee518-90af-11df-b003-00508dbad98e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{33eee518-90af-11df-b003-00508dbad98e}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{33eee51b-90af-11df-b003-00508dbad98e}\Shell - "" = AutoRun
O33 - MountPoints2\{33eee51b-90af-11df-b003-00508dbad98e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{33eee51b-90af-11df-b003-00508dbad98e}\Shell\AutoRun\command - "" = E:\AutoRun.exe
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2012.08.15 09:55:00 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012.08.15 09:27:11 | 000,001,222 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-436374069-839522115-1003UA.job
[2012.08.15 09:22:25 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.15 08:56:16 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\GlaryInitialize.job
[2012.08.15 08:56:02 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.15 08:54:37 | 004,503,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ism_0_llatsni.pad
[2012.08.14 17:42:20 | 000,001,626 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Startmenü\Programme\Autostart\ctfmon.lnk
[2012.08.12 14:33:00 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ |
|
15.08.2012, 16:22
| #3 |
| | GVU 2.07 unter XP gefunden ... und entfernt ? Hi t'john
__________________besten Dank! Alles wie von dir beschrieben durchgeführt. Hier das Resultat Code:
ATTFilter All processes killed
========== OTL ==========
Service Akamai stopped successfully!
Service Akamai deleted successfully!
c:\programme\gemeinsame dateien\akamai/netsession_win_4f7fccd.dll moved successfully.
Service WDICA stopped successfully!
Service WDICA deleted successfully!
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
Service PCAMPR5 stopped successfully!
Service PCAMPR5 deleted successfully!
File C:\WINDOWS\system32\PCAMPR5.SYS not found.
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
Service Changer stopped successfully!
Service Changer deleted successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://www.google.de/ig?hl=de&source=iglk|https://www.google.com/calendar/render?pli=1|hxxp://www.quoka.de/tiermarkt/fische-aquaristik/|hxxp://www.deine-tierwelt.de/kleinanzeigen/komplett-aquarium-351-l-c88556/?l=55452&r=200&so=51&i=50|hxxp://kleinanzeigen.ebay.de/anzeigen/s-fische/aquarium/55452/aquarium/k0c138l5108r200+fische.art_s:aquarium|hxxp://www.markt.de/landkreis-mainz-bingen/Tiere/Aquaristik/Aquaristik-Zubeh%C3%B6r/Aquarien/Komplett-Aquarien/categoryId,1201060104/radius,200/sorting,-date/suche.htm" removed from browser.startup.homepage
Prefs.js: "188.93.20.179" removed from network.proxy.http
Prefs.js: 8080 removed from network.proxy.http_port
Prefs.js: "localhost, 127.0.0.1, stealthy.co" removed from network.proxy.no_proxies_on
Prefs.js: true removed from network.proxy.share_proxy_settings
Prefs.js: 0 removed from network.proxy.type
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully.
C:\Programme\DVDVideoSoftTB\prxtbDVD1.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found.
File C:\Programme\DVDVideoSoftTB\prxtbDVD1.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Programme\Ask.com\Updater\Updater.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Akamai NetSession Interface deleted successfully.
C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33eee518-90af-11df-b003-00508dbad98e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33eee518-90af-11df-b003-00508dbad98e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33eee518-90af-11df-b003-00508dbad98e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33eee518-90af-11df-b003-00508dbad98e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33eee518-90af-11df-b003-00508dbad98e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33eee518-90af-11df-b003-00508dbad98e}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33eee51b-90af-11df-b003-00508dbad98e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33eee51b-90af-11df-b003-00508dbad98e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33eee51b-90af-11df-b003-00508dbad98e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33eee51b-90af-11df-b003-00508dbad98e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33eee51b-90af-11df-b003-00508dbad98e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33eee51b-90af-11df-b003-00508dbad98e}\ not found.
File E:\AutoRun.exe not found.
C:\WINDOWS\System32\ConduitEngine.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET128.tmp deleted successfully.
C:\WINDOWS\System32\SET12B.tmp deleted successfully.
C:\WINDOWS\System32\SET77.tmp deleted successfully.
C:\WINDOWS\System32\SET7C.tmp deleted successfully.
C:\WINDOWS\System32\SETA8.tmp deleted successfully.
C:\WINDOWS\System32\SETA9.tmp deleted successfully.
C:\WINDOWS\System32\SETAE.tmp deleted successfully.
C:\WINDOWS\System32\SETB5.tmp deleted successfully.
C:\WINDOWS\System32\SETBC.tmp deleted successfully.
C:\WINDOWS\System32\SETBD.tmp deleted successfully.
C:\WINDOWS\System32\SETBE.tmp deleted successfully.
C:\WINDOWS\System32\SETC2.tmp deleted successfully.
C:\WINDOWS\System32\SETC5.tmp deleted successfully.
C:\WINDOWS\System32\SETC6.tmp deleted successfully.
C:\WINDOWS\System32\SETC8.tmp deleted successfully.
C:\WINDOWS\System32\SETCD.tmp deleted successfully.
C:\WINDOWS\System32\SETD1.tmp deleted successfully.
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job moved successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-436374069-839522115-1003UA.job moved successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\WINDOWS\tasks\GlaryInitialize.job moved successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ism_0_llatsni.pad moved successfully.
C:\Dokumente und Einstellungen\xxx\Startmenü\Programme\Autostart\ctfmon.lnk moved successfully.
C:\WINDOWS\tasks\Google Software Updater.job moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Auflösungscache wurde geleert.
C:\Dokumente und Einstellungen\xxx\Desktop\cmd.bat deleted successfully.
C:\Dokumente und Einstellungen\xxx\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 4899887 bytes
->Temporary Internet Files folder emptied: 96755 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56507 bytes
User: xxx
->Temp folder emptied: 77517820 bytes
->Temporary Internet Files folder emptied: 17852178 bytes
->Java cache emptied: 11830523 bytes
->FireFox cache emptied: 771000292 bytes
->Google Chrome cache emptied: 89967079 bytes
->Flash cache emptied: 236766 bytes
User: LocalService
->Temp folder emptied: 82513 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes
User: Profiles
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2308581 bytes
RecycleBin emptied: 7820181126 bytes
Total Files Cleaned = 8.391,00 mb
OTL by OldTimer - Version 3.2.57.0 log created on 08152012_170757
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Bin ich jetzt "geheilt" ? Liebe Gruesse Sabing Geändert von sabing (15.08.2012 um 16:23 Uhr) Grund: Tippfehler entdeckt |
|
15.08.2012, 22:05
| #4 |
| /// Helfer-Team | GVU 2.07 unter XP gefunden ... und entfernt ? Sehr gut!  Nein, ich sage bescheid, wenn wir fertig sind  Wie laeuft der Rechner? 1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 2. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
|
|
16.08.2012, 07:25
| #5 |
| | GVU 2.07 unter XP gefunden ... und entfernt ? Rechner läuft ohne bemerkbare Einschränkungen. Aber sicher ist sicher.... Ey, ey Capt'n geh dann jetzt mal scannen ...... Geändert von sabing (16.08.2012 um 07:35 Uhr) Grund: Details hinzugefügt |
|
16.08.2012, 12:29
| #6 |
| /// Helfer-Team | GVU 2.07 unter XP gefunden ... und entfernt ? Bitte mit Logfiles wieder melden.
__________________ --> GVU 2.07 unter XP gefunden ... und entfernt ? |
|
16.08.2012, 19:27
| #7 |
| | GVU 2.07 unter XP gefunden ... und entfernt ? Hi hier das Ergebnis vom Malwarebytes (ist gut lange gelaufen :-) Code:
ATTFilter Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.11
xxx :: SILVERSTONE [Administrator]
16.08.2012 16:21:28
mbam-log-2012-08-16 (16-21-28).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|I:\|J:\|P:\|S:\|Y:\|Z:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 570995
Laufzeit: 3 Stunde(n), 47 Minute(n), 45 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 2
I:\....\SoftonicDownloader_for_topstyle.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.
P:\....\u1017.exe (PUP.HackTool.Proxy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende)
Code:
ATTFilter # AdwCleaner v1.801 - Logfile created 08/16/2012 at 20:22:40
# Updated 14/08/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : xxx - SILVERSTONE
# Boot Mode : Normal
# Running from : C:\Dokumente und Einstellungen\xxx\desktop\adwcleaner.exe
# Option [Search]
***** [Services] *****
***** [Files / Folders] *****
Folder Found : C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\PriceGong
Folder Found : C:\Programme\Ask.com
Folder Found : C:\Programme\Conduit
Folder Found : C:\Programme\DVDVideoSoftTB
Folder Found : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
***** [Registry] *****
[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Key Found : HKCU\Software\APN
Key Found : HKCU\Software\Ask.com
Key Found : HKCU\Software\AskToolbar
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\DVDVideoSoftTB
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\PriceGong
Key Found : HKCU\Toolbar
Key Found : HKLM\SOFTWARE\APN
Key Found : HKLM\SOFTWARE\AskToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\DVDVideoSoftTB
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar
***** [Registre - GUID] *****
Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3148CE3C-8E2A-47E3-84E1-3671D3A033AC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6F915CAE-2625-4B92-BE5B-D040750A6F9F}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{16791DB6-03B7-4ABC-9DBE-014475AB10DB}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3148CE3C-8E2A-47E3-84E1-3671D3A033AC}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3148CE3C-8E2A-47E3-84E1-3671D3A033AC}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
***** [Internet Browsers] *****
-\\ Internet Explorer v7.0.5730.11
[OK] Registry is clean.
*************************
AdwCleaner[R1].txt - [3872 octets] - [16/08/2012 20:22:40]
########## EOF - C:\AdwCleaner[R1].txt - [4000 octets] ##########
sabing Geändert von sabing (16.08.2012 um 19:28 Uhr) Grund: tippfehler entfernt |
|
17.08.2012, 01:06
| #8 |
| /// Helfer-Team | GVU 2.07 unter XP gefunden ... und entfernt ? Sehr gut!
danach: Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html |
|
17.08.2012, 20:15
| #9 |
| | GVU 2.07 unter XP gefunden ... und entfernt ? also: adwcleaner liefert folgendes Ergebnis Code:
ATTFilter # AdwCleaner v1.801 - Logfile created 08/17/2012 at 11:22:26
# Updated 14/08/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : xxx - SILVERSTONE
# Boot Mode : Normal
# Running from : C:\Dokumente und Einstellungen\xxx\desktop\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
Folder Deleted : C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\PriceGong
Folder Deleted : C:\Programme\Ask.com
Folder Deleted : C:\Programme\Conduit
Folder Deleted : C:\Programme\DVDVideoSoftTB
Folder Deleted : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
***** [Registry] *****
[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\AskToolbar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\DVDVideoSoftTB
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\PriceGong
Key Deleted : HKCU\Toolbar
Key Deleted : HKLM\SOFTWARE\APN
Key Deleted : HKLM\SOFTWARE\AskToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\DVDVideoSoftTB
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar
***** [Registre - GUID] *****
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3148CE3C-8E2A-47E3-84E1-3671D3A033AC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6F915CAE-2625-4B92-BE5B-D040750A6F9F}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{16791DB6-03B7-4ABC-9DBE-014475AB10DB}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3148CE3C-8E2A-47E3-84E1-3671D3A033AC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3148CE3C-8E2A-47E3-84E1-3671D3A033AC}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
***** [Internet Browsers] *****
-\\ Internet Explorer v7.0.5730.11
[OK] Registry is clean.
*************************
AdwCleaner[R1].txt - [4001 octets] - [16/08/2012 20:22:40]
AdwCleaner[S1].txt - [319 octets] - [17/08/2012 11:22:12]
AdwCleaner[S2].txt - [4079 octets] - [17/08/2012 11:22:26]
########## EOF - C:\AdwCleaner[S2].txt - [4207 octets] ##########
Emsisoft Anti-Malware Code:
ATTFilter Emsisoft Anti-Malware - Version 6.6
Letztes Update: 17.08.2012 11:46:28
Scan Einstellungen:
Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, I:\, J:\, P:\, S:\, Y:\, Z:\
Archiv Scan: An
ADS Scan: An
Scan Beginn: 17.08.2012 11:50:21
C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Sun\Java\Deployment\cache.7z -> cache\6.0\12\7f1a5d0c-1e5abf89 -> rt0a\rt0d.class gefunden: Exploit.Java.Blacole!E2
C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Sun\Java\Deployment\cache.7z -> cache\6.0\12\7f1a5d0c-1e5abf89 -> rt0a\rt0a.class gefunden: Exploit.Java.Blacole!E2
C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Sun\Java\Deployment\cache.7z -> cache\6.0\12\7f1a5d0c-1e5abf89 -> rt0a\rt0b.class gefunden: Exploit.Java.Blacole!E2
C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Sun\Java\Deployment\cache.7z -> cache\6.0\12\7f1a5d0c-1e5abf89 -> rt0a\rt0c.class gefunden: Exploit.Java.Blacole!E2
C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Sun\Java\Deployment\cache.7z -> cache\6.0\12\7f1a5d0c-1e5abf89 gefunden: Exploit.Java.Blacole!E2
P:\prog_zip\u.zip -> u1017.exe gefunden: not-a-virus:NetTool.Win32.UltraSurf!E2
Gescannt 850028
Gefunden 6
Scan Ende: 17.08.2012 16:05:37
Scan Zeit: 4:15:16
und jetzt ? Vielen Dank! Sabing |
|
18.08.2012, 15:06
| #10 |
| /// Helfer-Team | GVU 2.07 unter XP gefunden ... und entfernt ? Sehr gut! Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
|
|
19.08.2012, 18:33
| #11 |
| | GVU 2.07 unter XP gefunden ... und entfernt ? alles klar - here we go: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=d3bb4d6b3565ff4e9371d95f5b340325
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-19 05:24:15
# local_time=2012-08-19 07:24:15 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1792 16777191 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 275 275 0 0
# scanned=356605
# found=0
# cleaned=0
# scan_time=8349
|
|
19.08.2012, 18:38
| #12 |
| /// Helfer-Team | GVU 2.07 unter XP gefunden ... und entfernt ? Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck |
|
19.08.2012, 20:45
| #13 |
| | GVU 2.07 unter XP gefunden ... und entfernt ? Hi, alles abgearbeitet. also der Test liefert jetzt: Code:
ATTFilter
Firefox 14.0.1 ist aktuell
Flash (11,3,300,270) ist aktuell.
Java (1,7,0,6) ist aktuell.
Adobe Reader 8,3,1,289 ist veraltet!
Aktualisieren Sie bitte auf die neueste Version: 10,1,3
Habe schon versucht Acrobat zu deinstallieren (war erst Version 9.x.x), aber auch das klappt nicht: immer die gleiche Fehlermeldung Danke für deine Geduld und Hilfe liebe Gruesse SAbing |
|
19.08.2012, 21:04
| #14 |
| /// Helfer-Team | GVU 2.07 unter XP gefunden ... und entfernt ? Versuche mit Revo Uninstaller Download - Revo Uninstaller 1.93 zu deinstallieren. |
|
20.08.2012, 08:29
| #15 |
| | GVU 2.07 unter XP gefunden ... und entfernt ? Hi, alles gut jetzt. Habe mir über Adobe direkt die exe runtergeladen (hxxp://get.adobe.com/de/reader/direct/) und installiert - jetzt klappts Code:
ATTFilter
Firefox 14.0.1 ist aktuell
Flash (11,3,300,270) ist aktuell.
Java (1,7,0,6) ist aktuell.
Adobe Reader 10,1,4,38 ist aktuell.
besten Dank Sabing Geändert von sabing (20.08.2012 um 08:31 Uhr) Grund: URL war falsch ... ist es aber leider immer noch |
|
| Themen zu GVU 2.07 unter XP gefunden ... und entfernt ? |
| 5 minuten, 7-zip, adobe after effects, autostart, avira, board, cache, code, cs3/contributeieplugin.dll, dateien, dll, einstellungen, entfernen, fatal error, folge, gen, google earth, gvu-trojaner, install, install_0_msi.exe, java, nicht möglich, offline, ordner, plug-in, quarantäne, rechner, required, rundll, rundll32.exe, system, system32, temp, third party, trojaner, v 2.07, virus, visual studio, win, win xp, windows internet |
Linear-Darstellung
