| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: email link angeklickt - ist PC jetzt infiziert?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
23.08.2012, 11:43
| #1 |
| |  email link angeklickt - ist PC jetzt infiziert? Hallo, ich habe eine email mit einem link von einem Bekannten bekommen und dummerweiße drauf geklickt. Es war irgend ne Werbung und jetzt hab ich natürlich Angst das ich mir irgendwas eingefangen hab  . (link: hxxp://swugradschool.com/wp-content/themes/twentyten/likeit.php?orange209.bmp) Virenscanner hat nichts gefunden und gerade lass ich Malwarebytes laufen. Hab mich hier im forum bisschen eingelesen - jedoch waren die schirtte speziell nur für denjenigen der den Thread gepostet hat. Wäre sehr nett, wenn mir jemand bei meinem Problem helfen könnte  Gruß Stephan hier mal die ergebnisse von OTL: OTL.txt Code:
ATTFilter OTL logfile created on: 23.08.2012 18:27:34 - Run 1 OTL by OldTimer - Version 3.2.58.1 Folder = C:\Users\Windows\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,97 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 56,90% Memory free 7,93 Gb Paging File | 6,00 Gb Available in Paging File | 75,69% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,76 Gb Total Space | 289,04 Gb Free Space | 62,06% Space Free | Partition Type: NTFS Computer Name: LAPTOP | User Name: Windows | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Windows\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe () PRC - C:\Program Files (x86)\AVG Secure Search\vprot.exe () PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software) PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software) PRC - C:\Program Files (x86)\Stickies\stickies.exe (Zhorn Software) PRC - C:\Users\Windows\AppData\LocalLow\WOT\IE\WOTUpdater.exe () PRC - C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe (McAfee, Inc.) PRC - C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Program Files (x86)\SAP\SAPsetup\setup\Updater\NwSapAutoWorkstationUpdateService.exe (SAP AG) PRC - C:\Program Files (x86)\SAP\SapSetup\setup\Updater\NwSapSetupUserNotificationTool.exe (SAP AG) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Program Files (x86)\Program DJ\Wow Video&Audio\WVAMain.exe () PRC - C:\Program Files (x86)\Program DJ\Wireless Switch\wlss.exe (Compal Electronics, Inc.) PRC - C:\Program Files (x86)\Program DJ\Program DJ3\ProgramDJ3.exe () PRC - C:\Program Files (x86)\EgisTec\VITAKEY\PdtWzd.exe (Egis Technology Inc.) PRC - c:\Program Files (x86)\EgisTec\VITAKEY\CompPtcVUI.exe (Egis Technology Inc.) PRC - c:\Program Files (x86)\EgisTec\VITAKEY\BASVC.exe (Egis Technology Inc.) PRC - C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe (PostgreSQL Global Development Group) PRC - C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe (PostgreSQL Global Development Group) PRC - C:\Program Files\Dassault Systemes\PhotoStudioSatellite\B19\rayserver.exe () ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll () MOD - C:\Program Files (x86)\AVG Secure Search\vprot.exe () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\00a4922fbf869a79c043b665035516b6\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\4230ed1c7990e4ee8352baf67a2a85fa\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d0e1cdaff8f9055187f8e7b52c060dff\System.Management.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\63bc6e391de5014965039e100ce1e9d5\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\608d29d7cc89f3a9a195c91354561915\PresentationFramework.Aero.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll () MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll () MOD - C:\Users\Windows\AppData\Local\Temp\bd7c47bb-f5c0-417c-a180-ec348d87718a\CliSecureRT.dll () MOD - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () MOD - C:\Program Files (x86)\Stickies\shook70.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () MOD - C:\Program Files (x86)\Program DJ\Wow Video&Audio\WVAMain.exe () MOD - C:\Program Files (x86)\Program DJ\Program DJ3\ProgramDJ3.exe () MOD - C:\Program Files (x86)\Program DJ\Program DJ3\PdjHook.dll () MOD - C:\Windows\SysWOW64\EMSC.DLL () ========== Win32 Services (SafeList) ========== SRV:64bit: - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software) SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (IGDCTRL) -- C:\Program Files\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin) SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV:64bit: - (Ray) -- C:\Program Files\Dassault Systemes\PhotoStudioSatellite\B19\rayserver.exe () SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (vToolbarUpdater11.2.0) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe () SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (WOTUpdater) -- C:\Users\Windows\AppData\LocalLow\WOT\IE\WOTUpdater.exe () SRV - (McComponentHostService) -- C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe (McAfee, Inc.) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (NWSAPAutoWorkstationUpdateSvc) -- C:\Program Files (x86)\SAP\SAPsetup\setup\Updater\NwSapAutoWorkstationUpdateService.exe (SAP AG) SRV - (OpenVPNService) -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe () SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (IGBASVC) -- c:\Program Files (x86)\EgisTec\VITAKEY\BASVC.exe (Egis Technology Inc.) SRV - (pgsql-8.3) -- C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe (PostgreSQL Global Development Group) ========== Driver Services (SafeList) ========== DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software) DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software) DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software) DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software) DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software) DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (ssudserd) -- C:\Windows\SysNative\drivers\ssudserd.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd) DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation) DRV:64bit: - (ssadbus) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation) DRV:64bit: - (ssadserd) -- C:\Windows\SysNative\drivers\ssadserd.sys (MCCI Corporation) DRV:64bit: - (ssadmdfl) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (androidusb) -- C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (TFsExDisk) -- C:\Windows\SysNative\drivers\TFsExDisk.sys (Teruten Inc) DRV:64bit: - (dgderdrv) -- C:\Windows\SysNative\drivers\dgderdrv.sys (Devguru Co., Ltd) DRV:64bit: - (sscemdm) -- C:\Windows\SysNative\drivers\sscemdm.sys (MCCI Corporation) DRV:64bit: - (ssceserd) -- C:\Windows\SysNative\drivers\ssceserd.sys (MCCI Corporation) DRV:64bit: - (sscebus) -- C:\Windows\SysNative\drivers\sscebus.sys (MCCI Corporation) DRV:64bit: - (sscemdfl) -- C:\Windows\SysNative\drivers\sscemdfl.sys (MCCI Corporation) DRV:64bit: - (FPSensor) -- C:\Windows\SysNative\drivers\FPSensor.sys (LTT) DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (NETw5v64) -- C:\Windows\SysNative\drivers\NETw5v64.sys (Intel Corporation) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation) DRV:64bit: - (EMSC) -- C:\Windows\SysNative\drivers\EMSC.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corp) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (e1express) -- C:\Windows\SysNative\drivers\e1e6032e.sys (Intel Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corporation) DRV:64bit: - (enecir) -- C:\Windows\SysNative\drivers\enecir.sys (ENE TECHNOLOGY INC.) DRV:64bit: - (enecirhid) -- C:\Windows\SysNative\drivers\enecirhid.sys (ENE TECHNOLOGY INC.) DRV:64bit: - (enecirhidma) -- C:\Windows\SysNative\drivers\enecirhidma.sys (ENE TECHNOLOGY INC.) DRV:64bit: - (LUMDriver) -- C:\Windows\SysNative\drivers\LUMDriver.sys (IBM) DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.) DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.) DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.) DRV:64bit: - (IFXTPM) -- C:\Windows\SysNative\drivers\ifxtpm.sys (Infineon Technologies AG) DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.) DRV - (TFsExDisk) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys (Teruten Inc) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (EMSC) -- C:\Windows\SysWOW64\drivers\EMSC.sys (Windows (R) Win 7 DDK provider) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bigseekpro.com/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10} IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.avg.com/?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=10.2.0.3&sap=hp IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 70 79 93 11 89 B5 CA 01 [binary data] IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=10.2.0.3&sap=dsp&q={searchTerms} IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = hxxp://www.bigseekpro.com/search/browser/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10}?q={searchTerms} IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bigseekpro.com/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10} IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - No CLSID value found ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3 FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: info@youtube-mp3.org:1.0.2 FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49&sap=ku&q=" FF - prefs.js..network.proxy.autoconfig_url: "chrome://viewtubes/content/viewtubes_false.pac" FF - prefs.js..network.proxy.type: 2 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_233.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll () FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Windows\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Windows\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012.07.09 22:48:41 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2012.06.03 18:18:58 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 17:20:30 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.07.19 09:18:30 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 17:20:30 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.07.19 09:18:30 | 000,000,000 | ---D | M] [2010.02.26 19:00:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Windows\AppData\Roaming\mozilla\Extensions [2012.08.10 14:33:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Windows\AppData\Roaming\mozilla\Firefox\Profiles\4ddcnqn9.default\extensions [2012.03.30 17:34:32 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Windows\AppData\Roaming\mozilla\Firefox\Profiles\4ddcnqn9.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012.01.13 19:59:36 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Windows\AppData\Roaming\mozilla\Firefox\Profiles\4ddcnqn9.default\extensions\wotstats@mywot.com [2012.06.04 11:20:15 | 000,000,853 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\11-suche.xml [2012.06.04 11:20:15 | 000,002,209 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\englische-ergebnisse.xml [2012.06.04 11:20:15 | 000,010,506 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\gmx-suche.xml [2012.06.04 11:20:15 | 000,002,368 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\lastminute.xml [2011.04.29 10:42:42 | 000,002,382 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\search.xml [2012.06.04 11:20:15 | 000,005,489 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\webde-suche.xml [2012.07.19 09:18:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2010.03.10 19:39:18 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files (x86)\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012.07.19 09:18:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2011.07.28 22:41:32 | 000,006,796 | ---- | M] () (No name found) -- C:\USERS\WINDOWS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4DDCNQN9.DEFAULT\EXTENSIONS\INFO@YOUTUBE-MP3.ORG.XPI [2011.08.26 15:41:09 | 000,011,510 | ---- | M] () (No name found) -- C:\USERS\WINDOWS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4DDCNQN9.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI [2012.07.18 17:20:30 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.06.09 10:15:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.07.09 22:48:36 | 000,003,769 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml [2012.06.09 10:15:29 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.06.09 10:15:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.06.09 10:15:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.09 10:15:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.09 10:15:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49 CHR - default_search_provider: AVG Secure Search (Enabled) CHR - default_search_provider: search_url = hxxp://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=&lang=&ds=&pr=&d=&v=&sap=dsp&q={searchTerms} CHR - default_search_provider: suggest_url = hxxp://clients5.google.com/complete/search?hl={language}&q={searchTerms}&client=ie8&inputencoding={inputEncoding}&outputencoding={outputEncoding} CHR - homepage: hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49 CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Windows\AppData\Local\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Windows\AppData\Local\Google\Chrome\Application\19.0.1084.52\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Windows\AppData\Local\Google\Chrome\Application\19.0.1084.52\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: Google Update (Enabled) = C:\Users\Windows\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: Brushed = C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfjgbcjfpbbfepcccpaffkjofcmglifg\1.0_0\ CHR - Extension: WOT = C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Extensions\nphjeokkkbngjpiofnfpnafjeofjomfb\2.11.7_0\ O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll () O2 - BHO: (WOT) - {9E571C81-21E7-496B-9E6B-127E60263022} - C:\Users\Windows\AppData\LocalLow\WOT\IE\WOT.dll (WOT Services Oy) O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll () O3 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found. O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [GCTray] C:\Program Files\Program DJ\Green Charger\GCTray.exe (Compal Electronics, Inc.) O4 - HKLM..\Run: [HF_G_Jul] C:\Program Files (x86)\AVG Secure Search\HF_G_Jul.exe () O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [Program DJ3] C:\Program Files (x86)\Program DJ\Program DJ3\ProgramDJ3.exe () O4 - HKLM..\Run: [SAP_WUS_UNT] C:\Program Files (x86)\SAP\SAPsetup\setup\Updater\NwSapSetupUserNotificationTool.exe (SAP AG) O4 - HKLM..\Run: [VitaKeyPdtWzd] c:\Program Files (x86)\EgisTec\VITAKEY\PdtWzd.exe (Egis Technology Inc.) O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe () O4 - HKLM..\Run: [WLSS] C:\Program Files (x86)\Program DJ\Wireless Switch\WLSS.exe (Compal Electronics, Inc.) O4 - HKLM..\Run: [Wow Video&Audio] C:\Program Files (x86)\Program DJ\Wow Video&Audio\WVAMain.exe () O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000..\Run: [ICQ] C:\Program Files (x86)\ICQ7.0\ICQ.exe (ICQ, LLC.) O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung) O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Windows\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O4 - Startup: C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk = C:\Users\Windows\AppData\Roaming\Microsoft\Installer\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}\Icon8CF9C550.exe () O4 - Startup: C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk = C:\Program Files (x86)\Stickies\stickies.exe (Zhorn Software) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe () O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe () O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..Trusted Domains: fritz.box ([]* in Lokales Intranet) O15 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..Trusted Ranges: Range1 ([*] in Lokales Intranet) O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{56B39D6E-573D-48E2-BBF4-87A7B2E9D49D}: DhcpNameServer = 134.108.34.5 134.108.34.6 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7C2A9F2F-FC47-483C-BAA4-23151AA28853}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DB15E62F-A29D-418C-9ED6-B25EC22F8E62}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18:64bit: - Protocol\Handler\saphtmlp - No CLSID value found O18:64bit: - Protocol\Handler\sapr3 - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\saphtmlp {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll (SAP, Walldorf) O18 - Protocol\Handler\sapr3 {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll (SAP, Walldorf) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll () O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\Shell - "" = AutoRun O33 - MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\Shell\AutoRun\command - "" = E:\ICM_ML.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.08.23 18:24:51 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Windows\Desktop\OTL.exe [2012.08.23 12:24:37 | 000,000,000 | ---D | C] -- C:\Users\Windows\AppData\Roaming\Malwarebytes [2012.08.23 12:24:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.23 12:24:25 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.08.23 12:24:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.23 12:24:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.08.17 22:57:07 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll [2012.08.17 22:57:04 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll [2012.08.17 22:57:03 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll [2012.08.17 22:57:03 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe [2012.08.17 22:57:02 | 000,911,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.08.17 22:57:01 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.08.17 22:57:01 | 000,609,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2012.08.17 22:57:00 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll [2012.08.17 22:56:59 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll [2012.08.17 22:56:59 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll [2012.08.17 22:56:33 | 000,735,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2012.08.17 22:56:32 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.08.17 22:56:32 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.08.17 22:56:32 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.08.17 22:56:32 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.08.17 22:56:31 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.08.17 22:56:31 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.08.17 22:56:25 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll [2012.07.29 15:14:06 | 000,000,000 | ---D | C] -- C:\Users\Windows\AppData\Local\PunkBuster [2012.07.29 15:14:03 | 000,000,000 | ---D | C] -- C:\Users\Windows\AppData\Roaming\Ubisoft [3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.08.23 18:29:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.23 18:24:56 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Windows\Desktop\OTL.exe [2012.08.23 17:45:01 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1545989608-3791393258-1579190891-1000UA.job [2012.08.23 14:43:21 | 000,013,232 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.23 14:43:21 | 000,013,232 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.23 14:34:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.23 14:34:44 | 3193,540,608 | -HS- | M] () -- C:\hiberfil.sys [2012.08.23 12:24:26 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.22 20:45:00 | 000,001,076 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1545989608-3791393258-1579190891-1000Core.job [2012.08.22 14:48:31 | 000,002,469 | ---- | M] () -- C:\Users\Windows\Desktop\Google Chrome.lnk [2012.08.18 10:53:01 | 000,452,912 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.08.06 13:56:07 | 000,001,818 | ---- | M] () -- C:\Users\Windows\Desktop\Assassin's Creed Brotherhood.lnk [2012.07.29 15:14:12 | 000,280,976 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.07.29 15:14:12 | 000,280,976 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.08.23 12:24:26 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.11 18:40:26 | 044,381,525 | ---- | C] () -- C:\Users\Windows\Desktop\Die Perfekte Masche Von Neil Strauss S151.pdf [2012.08.06 13:56:07 | 000,001,818 | ---- | C] () -- C:\Users\Windows\Desktop\Assassin's Creed Brotherhood.lnk [2012.07.29 15:14:12 | 000,280,976 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.07.18 17:17:13 | 000,280,976 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.07.18 17:17:09 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2012.03.28 22:11:08 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2012.03.28 22:11:06 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2012.03.28 22:11:06 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2012.03.28 22:11:06 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2012.03.28 22:11:06 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2012.03.27 16:17:31 | 001,064,960 | ---- | C] () -- C:\Windows\SysWow64\h5krnl32.dll [2012.03.27 16:17:31 | 000,188,928 | ---- | C] () -- C:\Windows\SysWow64\h5icon32.dll [2012.03.27 16:17:31 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\h5menu32.dll [2012.03.27 16:17:31 | 000,095,744 | ---- | C] () -- C:\Windows\SysWow64\h5rtf32.dll [2012.03.27 16:17:31 | 000,051,200 | ---- | C] () -- C:\Windows\SysWow64\h5tool32.dll [2011.07.26 12:02:15 | 001,591,234 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.04.03 14:06:23 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2010.06.02 17:59:26 | 000,015,390 | ---- | C] () -- C:\ProgramData\CommentsGames.ele [2010.06.02 17:59:26 | 000,000,612 | ---- | C] () -- C:\ProgramData\Categories.ecx [2010.05.25 17:40:23 | 000,005,077 | ---- | C] () -- C:\ProgramData\bltofzsb.qlf [2010.03.17 18:18:06 | 000,007,602 | ---- | C] () -- C:\Users\Windows\AppData\Local\Resmon.ResmonCfg [2010.03.10 19:43:21 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.03.02 19:47:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\CommentsPlayers.ele [2010.02.25 16:18:25 | 000,000,373 | ---- | C] () -- C:\Users\Windows\AppData\Local\postgresinstall.bat ========== LOP Check ========== [2011.10.31 13:49:05 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\DAEMON Tools Lite [2011.10.10 21:04:50 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\DassaultSystemes [2012.08.23 14:37:10 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Dropbox [2010.11.07 15:02:28 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\FRITZ! [2011.05.09 21:00:30 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\HEM Data [2012.07.17 10:45:33 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\HoldemManager [2012.07.10 10:02:44 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\ICQ [2011.06.01 18:56:49 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\JavaEditor [2011.12.29 14:57:24 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Kalypso Media [2012.03.27 20:41:04 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\OpenCandy [2010.08.18 14:18:02 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\OpenOffice.org [2012.03.27 20:41:06 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\pdfforge [2012.07.18 17:17:05 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\PunkBuster [2011.04.22 21:26:04 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Roaming [2012.04.29 14:19:39 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Samsung [2012.06.19 19:57:24 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\SAP [2012.08.23 14:36:29 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\stickies [2011.04.22 12:57:37 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\TeamViewer [2012.05.12 13:50:49 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Tropico 4 [2011.12.25 23:13:03 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Tropico 4 Demo [2012.07.29 15:14:03 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Ubisoft [2011.11.19 15:33:41 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Vocup [2011.06.07 15:17:09 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\www.rene-zeidler.de [2012.05.19 11:30:07 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > extras.txt Code:
ATTFilter OTL Extras logfile created on: 23.08.2012 18:27:34 - Run 1
OTL by OldTimer - Version 3.2.58.1 Folder = C:\Users\Windows\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,97 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 56,90% Memory free
7,93 Gb Paging File | 6,00 Gb Available in Paging File | 75,69% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,76 Gb Total Space | 289,04 Gb Free Space | 62,06% Space Free | Partition Type: NTFS
Computer Name: LAPTOP | User Name: Windows | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{18D237DF-3C95-4CD1-9F3F-F10B21988519}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{1D781EED-8A57-4FD2-BBE0-CC5655B39001}" = lport=10243 | protocol=6 | dir=in | app=system |
"{2FB5FF05-E9EC-4202-93B0-0F6BBE625861}" = rport=445 | protocol=6 | dir=out | app=system |
"{3087FE83-0CF0-4023-A6F6-574B813B0C71}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{81B55B6C-F438-4BC5-B05D-A478C067F65E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{974DD0FA-A8AE-4B99-88F9-E3FE6CC9F612}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{981DF4FF-6C9B-457F-A55B-C2B9AC703CCF}" = rport=137 | protocol=17 | dir=out | app=system |
"{99FA31BB-C114-4F7A-9023-DB1258D8B5FC}" = rport=10243 | protocol=6 | dir=out | app=system |
"{9E8831EA-57AD-45FD-B800-742273CC1697}" = rport=138 | protocol=17 | dir=out | app=system |
"{9F4319BB-C55C-4F2C-9DCE-5383CB4D8111}" = lport=137 | protocol=17 | dir=in | app=system |
"{B14FE3AD-934B-4D05-845A-012C37E5A51D}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{B2552153-4DF3-46F2-8324-DF2902201DD8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B2725B5D-9CED-4392-B032-4931B48CD783}" = rport=139 | protocol=6 | dir=out | app=system |
"{C32B9495-23CD-4CCC-83C3-5F1412404984}" = lport=2869 | protocol=6 | dir=in | app=system |
"{CBFF105A-DDBD-469D-AC73-2E20D84C9F0F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D1CE0DFB-DCB5-43DC-A387-3680C90F1629}" = lport=139 | protocol=6 | dir=in | app=system |
"{DA617D29-6248-48F6-9740-6A039F94961A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E74D30E1-BA0A-4314-8613-F6E1C5B42CBF}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{E7D0F6F7-E044-4DD9-9351-8F7DE7D45EEB}" = lport=138 | protocol=17 | dir=in | app=system |
"{F0CA6E35-DB0F-4B33-9317-1E2B85EF9DAE}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{FACF3BC8-4495-42CA-9E1F-95A81F3A88DA}" = lport=445 | protocol=6 | dir=in | app=system |
"{FDBEE076-4DD7-4F32-A9A8-D4E413E29EBF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FE62D50C-E684-4D7B-AB5E-5453FD9ACFCA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08392412-A330-44EA-960E-DFCD4855E4AC}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrsp.exe |
"{0A6C244D-B408-42C9-B0E7-83A4FF456BEC}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{13AECA43-0001-4BB6-85CC-4410CE6849D4}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe |
"{1878020A-621B-4906-8D5A-58BDF1EBD97E}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{1D8421E9-FA91-4AD3-804B-BCCB9A9CFD5A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1ECA765F-61EC-4A50-81DA-5984BDA728F6}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrsp.exe |
"{2AAB2A12-27D4-4C23-B3E6-1B9A27821387}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3054836D-D78B-41D1-936C-00E28BC79E40}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{3FC51A7D-E59B-4D90-B230-3858D6293007}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{407D7603-8AF7-46B4-9BE4-50481241F5CC}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbmp.exe |
"{420D660A-BC26-48D8-A820-B8D735B68058}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4ECF7ED1-B828-4E02-A693-A348B2148871}" = protocol=17 | dir=in | app=c:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe |
"{4F08F6FF-9B7A-4AC7-BB25-4F502DF41236}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe |
"{581F8A9A-0C82-4B14-A3C0-EE6A27672625}" = protocol=6 | dir=in | app=c:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe |
"{65D1EAB6-7B61-4D68-82EE-BDE87B07F7A8}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbmp.exe |
"{6606A7E7-88E5-43E5-9C8A-5A75181415D4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{69474EAC-CE18-4F3E-9EEA-CDD875880E4C}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe |
"{6A7F6BF0-D085-4BB8-87D4-45389B6FEF1B}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\uplaybrowser.exe |
"{6B238D72-302B-451F-AA21-7B13708F4FC7}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{6DBA4AD0-8582-421B-BC18-46E32440B91B}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\assassinscreedbrotherhood.exe |
"{70DC66C4-2BB7-4B7E-93B3-B5DAA49935DE}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrmp.exe |
"{720C7295-2BA5-4172-9EF9-34B040DE2F9A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7444C175-182A-4446-B9CE-EA8AF5735FBC}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe |
"{75FE62A2-822E-4098-A1C8-11970237E8A4}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbsp.exe |
"{770CB09C-EEDE-4CF6-A795-C488B7E6B083}" = protocol=6 | dir=out | app=system |
"{7865B82D-30EB-45EB-B378-BB5F4400E8C8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{787028BC-F159-4D75-BA0F-C457FA05AEF0}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\uplaybrowser.exe |
"{790B600C-A66B-48A7-8D74-6C46885466A3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{813A4671-F246-4F5E-9706-A204B33C4D0D}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{8D01091B-3A9A-4477-BB32-54776364CEB3}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{99E21E47-E6E3-4D9E-AE80-BF6D4848F9E6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{A06FD655-4840-465A-9CE2-BF2DCAA94D1B}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{A6A8C204-265D-4216-AC6B-DB7A3FDD85FC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{AA71EC75-49AD-46F1-B524-FB1E9E29D805}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe |
"{AAE7909C-CED9-4627-B3B2-9D4C7B0495B7}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{AEAE6C9A-1F7D-443D-BF57-2D22E28D534D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BB05F38F-0B58-4B97-88F5-0226E5270B01}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{BE994362-DE8E-457B-BE71-09D3B954C8AC}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{CEE7C599-032D-4B6D-A442-5E719A09F435}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D4AB5906-57FE-41EE-997E-309DCD4C25DF}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrmp.exe |
"{DB13C7AC-6B1A-4FBD-BD4B-68E23FB7CFCA}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{DD3A761E-A136-4358-B91A-AB368A522B9D}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbsp.exe |
"{DEC77A51-D43C-4E6F-B272-6E6509F0BF32}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\assassinscreedrevelations.exe |
"{DED2630E-6424-4B0E-9BEC-8D7D0C3FA483}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\assassinscreedrevelations.exe |
"{EAED3116-550C-4C5E-8C38-68370BF399E4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{ED11586F-0740-41D3-A2C4-D0AE71BB4C9E}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F3292B40-CDD9-459E-AEC0-578DE0A627EE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F41901A3-9291-461A-9899-28CD0CE833BD}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe |
"{FB87BFA9-18E6-465F-8F8B-7ACB31419863}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\assassinscreedbrotherhood.exe |
"{FD4F9363-4B79-4819-B186-FD47F07004B9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{2CB53398-6C5F-4FD9-93A4-C4E3F31A0A4E}C:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhdlc.exe" = protocol=6 | dir=in | app=c:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhdlc.exe |
"TCP Query User{314287BA-60C1-43D1-872E-9274F5DBA1DF}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catutil.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catutil.exe |
"TCP Query User{3BC178A9-63C9-4EE1-BE33-FE108054C401}C:\program files (x86)\icq7.0\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.0\icq.exe |
"TCP Query User{42955380-0D5B-496E-88C1-5BDF1B2AE51B}C:\program files\bohemia interactive\arma demo\armademo.exe" = protocol=6 | dir=in | app=c:\program files\bohemia interactive\arma demo\armademo.exe |
"TCP Query User{45B8C68B-1C4F-405C-9921-B1DFF31AF7DD}C:\program files\bohemia interactive\arma 2\arma2.exe" = protocol=6 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2.exe |
"TCP Query User{479AF775-02BB-4D67-AC4D-E38EFEC62581}C:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe |
"TCP Query User{4E7C578F-E6D6-4959-AED1-BD1A4C32F43F}C:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhd.exe" = protocol=6 | dir=in | app=c:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhd.exe |
"TCP Query User{631FB4AB-2808-4652-8A88-BB9A63BE0640}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{AA619760-570C-45D4-997C-8915CAEB7568}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe |
"TCP Query User{BD1714F1-5D91-43A3-88A6-A00182BDC2CE}C:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{C4D7BB15-991A-420A-BDE6-0334099701FA}C:\program files (x86)\icq7.0\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.0\icq.exe |
"TCP Query User{D2D73D6A-97BD-4AAF-B193-E19ED5DD14DA}C:\program files (x86)\pokerstrategy.com\pokerstrategy.com equilator\equilator.exe" = protocol=6 | dir=in | app=c:\program files (x86)\pokerstrategy.com\pokerstrategy.com equilator\equilator.exe |
"TCP Query User{E608D09D-E1DF-4894-B85F-D20B873FB5D4}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\cnext.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\cnext.exe |
"TCP Query User{E9FFFE7C-C3FE-4275-B263-14EF82DC957A}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\orbixd.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\orbixd.exe |
"TCP Query User{F4D5892B-377F-4D02-9C0F-1F260FB9B8AB}C:\program files (x86)\ea games\command & conquer die ersten 10 jahre\command & conquer(tm) generals zero hour\game.dat" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\command & conquer die ersten 10 jahre\command & conquer(tm) generals zero hour\game.dat |
"UDP Query User{0370D868-1279-4CB9-A980-6A822884FF0D}C:\program files (x86)\icq7.0\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.0\icq.exe |
"UDP Query User{2C888E98-7A2F-421D-A1AB-310EF3DBE091}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{2FAAA548-A0BE-4FC8-A3C8-DF1AC83802AB}C:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhdlc.exe" = protocol=17 | dir=in | app=c:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhdlc.exe |
"UDP Query User{35B8BC24-611D-45EF-96BE-304CFE3DAB26}C:\program files (x86)\icq7.0\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.0\icq.exe |
"UDP Query User{3B716BAB-FC13-4435-A0F1-B880E977C850}C:\program files (x86)\pokerstrategy.com\pokerstrategy.com equilator\equilator.exe" = protocol=17 | dir=in | app=c:\program files (x86)\pokerstrategy.com\pokerstrategy.com equilator\equilator.exe |
"UDP Query User{487BC037-3FD3-485B-AD9C-A675A64199EA}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catutil.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catutil.exe |
"UDP Query User{6B45FA83-B8FC-43F1-A4B6-8638C3E4590B}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe |
"UDP Query User{6D2C2CB0-8D90-49A0-B35D-A85DFD49F3F2}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\cnext.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\cnext.exe |
"UDP Query User{79648D2B-5E21-47A0-B33F-C8EED94AF06C}C:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhd.exe" = protocol=17 | dir=in | app=c:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhd.exe |
"UDP Query User{89AB545A-45B2-4E09-A95B-A6A2DC12DF4D}C:\program files (x86)\ea games\command & conquer die ersten 10 jahre\command & conquer(tm) generals zero hour\game.dat" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\command & conquer die ersten 10 jahre\command & conquer(tm) generals zero hour\game.dat |
"UDP Query User{D4AB077D-4856-47D7-8238-F9707FB7C16D}C:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe |
"UDP Query User{DA7B3C67-E065-4BF4-8D88-7E294733C1ED}C:\program files\bohemia interactive\arma demo\armademo.exe" = protocol=17 | dir=in | app=c:\program files\bohemia interactive\arma demo\armademo.exe |
"UDP Query User{DBE3EF87-C543-4BDE-822F-C7B5B56B175E}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\orbixd.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\orbixd.exe |
"UDP Query User{E683A843-44ED-41B0-B0CC-55281C43B58F}C:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{FE6EF2A1-3A4F-45D2-96FB-59DCC4705456}C:\program files\bohemia interactive\arma 2\arma2.exe" = protocol=17 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.1.0.2200
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{26A24AE4-039D-4CA4-87B4-2F86416018FF}" = Java(TM) 6 Update 18 (64-bit)
"{2D5D9603-22CF-4B99-83F6-0CD20330F62E}" = FRITZ!DSL64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{CF1EB598-B424-436A-B15F-B763846BA970}" = Dassault Systemes Software Prerequisites x86-x64
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D285FC5F-3021-32E9-9C59-24CA325BDC5C}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Dassault Systemes B19_0" = Dassault Systemes Software B19
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"WinRAR archiver" = WinRAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{02A10468-2F1C-447C-AD8E-4DEDDEA25AE2}" = Medieval II Total War : Kingdoms : Crusades
"{045A9539-37B6-464D-94F9-E4ADFA856903}" = PokerStrategy.com Equilator
"{0B82D6C6-9ECC-4710-97AB-5CE482E72852}_is1" = TableScan Turbo v0.47b (BETA)
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23BDF7D8-C353-4BA8-8567-814F91332CEA}" = Wireless Switch 2
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{33A22B2D-55BA-4508-B767-BF2E9C21A73F}" = Assassin's Creed Revelations 1.03
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{419043F8-9CA0-4038-8939-E345EC4915DC}" = EzRemote
"{44D66AD9-AE19-4AFD-BE7E-A1B44C856697}" = MSXML4.0 redistributable
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CFFAEC0-1F2A-4D38-8D95-3995A936ADD9}" = NetWorkingWizard_ICM
"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{65FBA21B-7F80-4E4E-B275-0958D2648F94}_is1" = Java-Editor 9.19b, 2010.01.31
"{66D6F3BD-CA23-41A4-9FA3-96B26B32528D}" = Command & Conquer Die ersten 10 Jahre
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73D7F26F-A650-49F3-9928-AD204673797C}" = Green Charger2
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{75983B66-804C-40D1-BA13-64DAF652A6F1}" = Medieval II Total War : Kingdoms : Americas
"{7AEE1963-7001-4C37-BC20-2FAEB74AA41C}" = Medieval II Total War : Kingdoms : Teutonic
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{9366DD3C-3DCB-431B-BE4A-45D7E4BD4D2A}" = Program DJ3
"{9428A68A-9B43-473D-9771-FDA1D15B4C0D}" = VITAKEY
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A47A9101-6EB5-4314-BDA1-297880FBB908}" = Microsoft redistributable runtime DLLs VS2008 SP1(x86)
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{AED06A3C-2AA7-4418-89E7-94352385DCDC}" = Tropico 4 Demo
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B823632F-3B72-4514-8861-B961CE263224}" = PostgreSQL 8.3
"{BD8A0C60-1AEB-11D6-B8E1-00025521AE60}" = VBA (3821b)
"{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood
"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War
"{CADD1D0D-A26B-464E-A0F2-FC1DB07CC04E}" = EzTube
"{CB09F557-4821-46D0-BF86-8D1389AA6BC7}" = Tabellenbuch Metall digital
"{CEC7A786-A9C8-4EF7-BB59-6518E3B3C878}" = vcredist_x86
"{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}" = Medieval II Total War : Kingdoms : Britannia
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2F506E1-047B-457C-9611-0D60F930BF5E}" = PokerStrategy.com Elephant
"{F408DA6B-DA75-4D95-B87D-49AFF0B4EBB0}" = Wow Video&Audio utility
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FEF06E73-A519-4510-8CF3-B66041B91D8A}" = EMSC
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Algebrator_is1" = Algebrator 4.0
"ArmA2" = ArmA2 Uninstall
"avast" = avast! Free Antivirus
"AVG Secure Search" = AVG Security Toolbar
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"BattlEye" = BattlEye Uninstall
"Betfair Poker JPC_is1" = Betfair Poker JPC 1.0.0
"CamStudio" = CamStudio
"DAEMON Tools Lite" = DAEMON Tools Lite
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"FLV Player" = FLV Player 2.0 (build 25)
"HoldemManager2" = Holdem Manager 2
"InstallShield_{045A9539-37B6-464D-94F9-E4ADFA856903}" = PokerStrategy.com Equilator
"InstallShield_{23BDF7D8-C353-4BA8-8567-814F91332CEA}" = Wireless Switch 2
"InstallShield_{419043F8-9CA0-4038-8939-E345EC4915DC}" = EzRemote
"InstallShield_{73D7F26F-A650-49F3-9928-AD204673797C}" = Green Charger2
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{9366DD3C-3DCB-431B-BE4A-45D7E4BD4D2A}" = Program DJ3
"InstallShield_{9428A68A-9B43-473D-9771-FDA1D15B4C0D}" = VITAKEY
"InstallShield_{CADD1D0D-A26B-464E-A0F2-FC1DB07CC04E}" = EzTube
"InstallShield_{F408DA6B-DA75-4D95-B87D-49AFF0B4EBB0}" = Wow Video&Audio utility
"KaloMa_is1" = KaloMa 4.92
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"OpenVPN" = OpenVPN 2.1.1
"PartyPoker" = PartyPoker
"PokerStars" = PokerStars
"PROHYBRIDR" = 2007 Microsoft Office system
"PunkBusterSvc" = PunkBuster Services
"SAP_ECL" = ECL Viewer
"SAP_JNet" = SAP JNet
"SAP_WUS" = SAPSetup Automatic Workstation Update Service
"SAPBI" = SAP Business Explorer
"SAPGUI710" = SAP GUI for Windows 7.20
"Teachmaster 4.0" = Teachmaster 4.0 (nur Entfernen)
"Vocup_is1" = Vocup 1.4.2
"ZhornStickies" = Stickies 7.1a
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"Titan Poker" = Titan Poker
"Tropico 4" = Tropico 4 1.00
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 25.06.2012 14:16:51 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: McCHSvc.exe, Version: 3.0.207.0,
Zeitstempel: 0x4dfb634d Name des fehlerhaften Moduls: mcscan32.dll, Version: 5.400.0.1158,
Zeitstempel: 0x4a705d78 Ausnahmecode: 0xc0000005 Fehleroffset: 0x002800f8 ID des fehlerhaften
Prozesses: 0x1278 Startzeit der fehlerhaften Anwendung: 0x01cd52fead1b4f1f Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe
Pfad
des fehlerhaften Moduls: C:\Program Files (x86)\McAfee Security Scan\3.0.207\mcscan32.dll
Berichtskennung:
eef5c483-bef1-11e1-bb4e-00262260a35b
Error - 17.07.2012 04:39:06 | Computer Name = laptop | Source = .NET Runtime | ID = 1026
Description =
Error - 17.07.2012 04:39:09 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: HoldemManager.exe, Version: 2.0.0.6556,
Zeitstempel: 0x4f75e3b5 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.17651,
Zeitstempel: 0x4e21213c Ausnahmecode: 0xe0434352 Fehleroffset: 0x000000000000cacd
ID
des fehlerhaften Prozesses: 0x8c8 Startzeit der fehlerhaften Anwendung: 0x01cd63f77e4e6225
Pfad
der fehlerhaften Anwendung: C:\Program Files (x86)\Holdem Manager 2\HoldemManager.exe
Pfad
des fehlerhaften Moduls: C:\Windows\system32\KERNELBASE.dll Berichtskennung: dfecb498-cfea-11e1-ba58-00262260a35b
Error - 19.07.2012 12:42:54 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
0x4ffecafb Name des fehlerhaften Moduls: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
0x4ffecafb Ausnahmecode: 0xc0000005 Fehleroffset: 0x001cd2b2 ID des fehlerhaften Prozesses:
0xea8 Startzeit der fehlerhaften Anwendung: 0x01cd65a92c272289 Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe Pfad des
fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe
Berichtskennung:
c914c7b9-d1c0-11e1-8fb9-00262260a35b
Error - 19.07.2012 16:36:18 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
0x4ffecafb Name des fehlerhaften Moduls: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
0x4ffecafb Ausnahmecode: 0xc0000005 Fehleroffset: 0x001cd2b2 ID des fehlerhaften Prozesses:
0xcf4 Startzeit der fehlerhaften Anwendung: 0x01cd65d2fd2b0ed5 Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe Pfad des
fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe
Berichtskennung:
643db2ea-d1e1-11e1-bac3-00262260a35b
Error - 21.07.2012 10:51:12 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
0x4ffecafb Name des fehlerhaften Moduls: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
0x4ffecafb Ausnahmecode: 0xc0000005 Fehleroffset: 0x001cd2b2 ID des fehlerhaften Prozesses:
0x674 Startzeit der fehlerhaften Anwendung: 0x01cd67267425fc6a Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe Pfad des
fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe
Berichtskennung:
835073d1-d343-11e1-b282-00262260a35b
Error - 21.07.2012 13:39:00 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: ACRSP.exe, Version: 0.0.0.0, Zeitstempel:
0x4f3a78e5 Name des fehlerhaften Moduls: ACRSP.exe, Version: 0.0.0.0, Zeitstempel:
0x4f3a78e5 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00438154 ID des fehlerhaften Prozesses:
0xfa0 Startzeit der fehlerhaften Anwendung: 0x01cd675d2baf92a2 Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\Ubisoft\Assassin's Creed Revelations\ACRSP.exe
Pfad
des fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Assassin's Creed Revelations\ACRSP.exe
Berichtskennung:
f41d5a7f-d35a-11e1-b282-00262260a35b
Error - 22.07.2012 06:09:08 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: ACRSP.exe, Version: 0.0.0.0, Zeitstempel:
0x4f3a78e5 Name des fehlerhaften Moduls: ACRSP.exe, Version: 0.0.0.0, Zeitstempel:
0x4f3a78e5 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00438154 ID des fehlerhaften Prozesses:
0x2f0 Startzeit der fehlerhaften Anwendung: 0x01cd67f19a2beba9 Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\Ubisoft\Assassin's Creed Revelations\ACRSP.exe
Pfad
des fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Assassin's Creed Revelations\ACRSP.exe
Berichtskennung:
45d391ae-d3e5-11e1-8783-00262260a35b
Error - 07.08.2012 16:06:12 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
0x50167691 Name des fehlerhaften Moduls: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
0x50167691 Ausnahmecode: 0xc0000005 Fehleroffset: 0x001cd2b2 ID des fehlerhaften Prozesses:
0x1388 Startzeit der fehlerhaften Anwendung: 0x01cd747d207338a5 Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe Pfad des
fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe
Berichtskennung:
55775a10-e0cb-11e1-bad3-00262260a35b
Error - 22.08.2012 10:33:05 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
0x50167691 Name des fehlerhaften Moduls: npuplaypchub.dll_unloaded, Version: 0.0.0.0,
Zeitstempel: 0x50167629 Ausnahmecode: 0xc0000005 Fehleroffset: 0x74455450 ID des fehlerhaften
Prozesses: 0xbc0 Startzeit der fehlerhaften Anwendung: 0x01cd8072b056f43f Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe
Pfad
des fehlerhaften Moduls: npuplaypchub.dll Berichtskennung: 488c8063-ec66-11e1-bad0-00262260a35b
Error - 22.08.2012 10:33:54 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
0x50167691 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel:
0x4ec49b8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002ff27 ID des fehlerhaften Prozesses:
0xbc0 Startzeit der fehlerhaften Anwendung: 0x01cd8072b056f43f Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe Pfad des
fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll Berichtskennung: 65cfab01-ec66-11e1-bad0-00262260a35b
[ System Events ]
Error - 22.08.2012 08:09:00 | Computer Name = laptop | Source = ACPI | ID = 327693
Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen
Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware
hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie
den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen
Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
Error - 22.08.2012 09:57:34 | Computer Name = laptop | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 22.08.2012 14:21:21 | Computer Name = laptop | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 22.08.2012 15:28:34 | Computer Name = laptop | Source = ACPI | ID = 327693
Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen
Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware
hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie
den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen
Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
Error - 22.08.2012 15:28:39 | Computer Name = laptop | Source = ACPI | ID = 327693
Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen
Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware
hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie
den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen
Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
Error - 23.08.2012 05:55:40 | Computer Name = laptop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
Error - 23.08.2012 05:55:40 | Computer Name = laptop | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 23.08.2012 06:07:58 | Computer Name = laptop | Source = ACPI | ID = 327693
Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen
Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware
hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie
den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen
Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
Error - 23.08.2012 08:34:50 | Computer Name = laptop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
Error - 23.08.2012 08:34:50 | Computer Name = laptop | Source = atikmdag | ID = 43029
Description = Display is not active
< End of report >
|
|
24.08.2012, 02:32
| #2 |
| /// Helfer-Team  | email link angeklickt - ist PC jetzt infiziert? Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
MOD - C:\Users\Windows\AppData\Local\Temp\bd7c47bb-f5c0-417c-a180-ec348d87718a\CliSecureRT.dll ()
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=10.2.0.3&sap=hp
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\URLSearchHook: - No CLSID value found
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=10.2.0.3&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = http://www.bigseekpro.com/search/browser/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10}?q={searchTerms}
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - No CLSID value found
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: info@youtube-mp3.org:1.0.2
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49&sap=ku&q="
FF - prefs.js..network.proxy.autoconfig_url: "chrome://viewtubes/content/viewtubes_false.pac"
FF - prefs.js..network.proxy.type: 2
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_233.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012.07.09 22:48:41 | 000,000,000 | ---D | M]
CHR - homepage: http://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49
CHR - default_search_provider: search_url = http://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=&lang=&ds=&pr=&d=&v=&sap=dsp&q={searchTerms}
O3 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk = C:\Users\Windows\AppData\Roaming\Microsoft\Installer\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}\Icon8CF9C550.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\Shell - "" = AutoRun
O33 - MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\Shell\AutoRun\command - "" = E:\ICM_ML.exe
[3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2012.06.04 11:20:15 | 000,000,853 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\11-suche.xml
[2012.06.04 11:20:15 | 000,002,209 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\englische-ergebnisse.xml
[2012.06.04 11:20:15 | 000,010,506 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\gmx-suche.xml
[2012.06.04 11:20:15 | 000,002,368 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\lastminute.xml
[2012.06.04 11:20:15 | 000,005,489 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\webde-suche.xml
[2011.04.29 10:42:42 | 000,002,382 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\search.xml
[2012.06.09 10:15:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.09 10:15:29 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.09 10:15:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.09 10:15:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.09 10:15:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.09 10:15:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
[2012.07.09 22:48:36 | 000,003,769 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.03.28 22:11:08 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2010.03.10 19:43:21 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ |
|
24.08.2012, 14:10
| #3 |
| | email link angeklickt - ist PC jetzt infiziert? danke schonmal im vorraus
__________________pc hat sich ein paar mal aufgehängt, hoffe das ist egal - otl hat ja was ausgegeben. Code:
ATTFilter All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\ not found.
HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry key HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}\ not found.
HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\{CA3EB689-8F09-4026-AA10-B9534C691CE0} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\ not found.
Prefs.js: "AVG Secure Search" removed from browser.search.defaultenginename
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "www.google.de" removed from browser.startup.homepage
Prefs.js: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3 removed from extensions.enabledItems
Prefs.js: youtube2mp3@mondayx.de:1.0.7 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems
Prefs.js: info@youtube-mp3.org:1.0.2 removed from extensions.enabledItems
Prefs.js: "hxxp://isearch.avg.com/search?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49&sap=ku&q=" removed from keyword.URL
Prefs.js: "chrome://viewtubes/content/viewtubes_false.pac" removed from network.proxy.autoconfig_url
Prefs.js: 2 removed from network.proxy.type
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0\ not found.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar not found.
File C:\ProgramData\AVG Secure Search\11.1.0.12\ not found.
Use Chrome's Settings page to change the HomePage.
Use Chrome's Settings page to remove the default_search_provider items.
Registry value HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DivXUpdate not found.
File C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
Registry value HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
File move failed. C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk scheduled to be moved on reboot.
File C:\Users\Windows\AppData\Roaming\Microsoft\Installer\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}\Icon8CF9C550.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
File C:\Programs\PartyGaming\PartyPoker\RunApp.exe not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
File C:\Programs\PartyGaming\PartyPoker\RunApp.exe not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{935fcef5-08f8-11e0-99b9-00262260a35b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{935fcef5-08f8-11e0-99b9-00262260a35b}\ not found.
File E:\ICM_ML.exe not found.
File/Folder C:\Windows\SysWow64\*.tmp not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\11-suche.xml not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\englische-ergebnisse.xml not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\gmx-suche.xml not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\lastminute.xml not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\webde-suche.xml not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\search.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml not found.
File C:\Windows\MusiccityDownload.exe not found.
File C:\ProgramData\ezsidmv.dat not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Windows\Desktop\cmd.bat deleted successfully.
C:\Users\Windows\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: elephant
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Public
User: Windows
->Temp folder emptied: 315975 bytes
->Temporary Internet Files folder emptied: 34698 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 23713977 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 456 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 15320 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 49554 bytes
RecycleBin emptied: 5854278965 bytes
Total Files Cleaned = 5.606,00 mb
OTL by OldTimer - Version 3.2.58.1 log created on 08242012_150234
Files\Folders moved on Reboot...
File\Folder C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk not found!
C:\Users\Windows\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
|
|
24.08.2012, 14:58
| #4 |
| /// Helfer-Team | email link angeklickt - ist PC jetzt infiziert? Du hast den Fix mehrmals ausgefuehrt? 1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 2. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
|
|
24.08.2012, 21:28
| #5 |
| | email link angeklickt - ist PC jetzt infiziert? ja, habe den fix mehrmals ausgeführt malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.24.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Windows :: LAPTOP [Administrator] Schutz: Deaktiviert 24.08.2012 18:55:04 mbam-log-2012-08-24 (18-55-04).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 561698 Laufzeit: 1 Stunde(n), 37 Minute(n), 22 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) adwcleaner: Code:
ATTFilter # AdwCleaner v1.801 - Logfile created 08/24/2012 at 22:26:38
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Windows - LAPTOP
# Boot Mode : Normal
# Running from : C:\Users\Windows\Desktop\adwcleaner.exe
# Option [Search]
***** [Services] *****
Found : vToolbarUpdater11.2.0
***** [Files / Folders] *****
Folder Found : C:\Users\Windows\AppData\Local\AVG Secure Search
Folder Found : C:\Users\Windows\AppData\LocalLow\AVG Secure Search
Folder Found : C:\Users\Windows\AppData\LocalLow\Toolbar4
Folder Found : C:\Users\Windows\AppData\Roaming\OpenCandy
Folder Found : C:\Users\Windows\AppData\Roaming\pdfforge
Folder Found : C:\ProgramData\AVG Secure Search
Folder Found : C:\Program Files (x86)\AVG Secure Search
Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search
***** [Registry] *****
Key Found : HKCU\Software\AVG Secure Search
Key Found : HKCU\Software\IGearSettings
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\AVG Secure Search
Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Found : HKLM\SOFTWARE\Classes\S
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
[x64] Key Found : HKCU\Software\AVG Secure Search
[x64] Key Found : HKCU\Software\IGearSettings
[x64] Key Found : HKCU\Software\Softonic
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
[x64] Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
[x64] Key Found : HKLM\SOFTWARE\Classes\S
[x64] Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
[x64] Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
[x64] Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
[x64] Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
***** [Registre - GUID] *****
Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.7601.17514
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.bigseekpro.com/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10}
[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=11.1.0.12&sap=nt
-\\ Mozilla Firefox v14.0.1 (de)
Profile name : default
File : C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\prefs.js
Found : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\10.2.0.3");
-\\ Google Chrome v21.0.1180.83
File : C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Preferences
Found : "homepage": "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66[...]
Found : "urls_to_restore_on_startup": [ "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5[...]
Found : "icon_url": "hxxp://isearch.avg.com/favicon.ico",
Found : "keyword": "isearch.avg.com",
Found : "name": "AVG Secure Search",
Found : "search_url": "hxxp://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=&l[...]
Found : "homepage": "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae[...]
Found : "urls_to_restore_on_startup": [ "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb2[...]
*************************
AdwCleaner[R1].txt - [7901 octets] - [24/08/2012 22:26:38]
########## EOF - C:\AdwCleaner[R1].txt - [8029 octets] ##########
|
|
24.08.2012, 23:07
| #6 |
| /// Helfer-Team | email link angeklickt - ist PC jetzt infiziert? Sehr gut!
danach: Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________ --> email link angeklickt - ist PC jetzt infiziert? |
|
25.08.2012, 13:04
| #7 |
| | email link angeklickt - ist PC jetzt infiziert? adwcleaner Code:
ATTFilter # AdwCleaner v1.801 - Logfile created 08/25/2012 at 11:29:29
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Windows - LAPTOP
# Boot Mode : Normal
# Running from : C:\Users\Windows\Desktop\adwcleaner.exe
# Option [Delete]
***** [Services] *****
Stopped & Deleted : vToolbarUpdater11.2.0
***** [Files / Folders] *****
Folder Deleted : C:\Users\Windows\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Windows\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Windows\AppData\LocalLow\Toolbar4
Folder Deleted : C:\Users\Windows\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\Windows\AppData\Roaming\pdfforge
Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search
***** [Registry] *****
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
***** [Registre - GUID] *****
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.7601.17514
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.bigseekpro.com/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10} --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=11.1.0.12&sap=nt --> hxxp://www.google.com
-\\ Mozilla Firefox v14.0.1 (de)
Profile name : default
File : C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\prefs.js
Deleted : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\10.2.0.3");
-\\ Google Chrome v21.0.1180.83
File : C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Preferences
Deleted : "homepage": "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66[...]
Deleted : "urls_to_restore_on_startup": [ "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5[...]
Deleted : "icon_url": "hxxp://isearch.avg.com/favicon.ico",
Deleted : "keyword": "isearch.avg.com",
Deleted : "name": "AVG Secure Search",
Deleted : "search_url": "hxxp://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=&l[...]
Deleted : "homepage": "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae[...]
Deleted : "urls_to_restore_on_startup": [ "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb2[...]
*************************
AdwCleaner[R1].txt - [7976 octets] - [24/08/2012 22:26:38]
AdwCleaner[S1].txt - [6519 octets] - [25/08/2012 11:29:29]
########## EOF - C:\AdwCleaner[S1].txt - [6647 octets] ##########
Code:
ATTFilter Emsisoft Anti-Malware - Version 6.6
Letztes Update: 25.08.2012 11:46:28
Scan Einstellungen:
Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
Archiv Scan: An
ADS Scan: An
Scan Beginn: 25.08.2012 11:46:57
c:\users\windows\appdata\roaming\microsoft\windows\start menu\programs\partypoker gefunden: Trace.File.partypoker!E1
c:\poker\titan poker gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\buttons gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\dialogs gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\login gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\buttons gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\history gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\sidegames gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\history\cards gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\sounds gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\anim gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\waitinglist gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\emoticons gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\buttons gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\dialogs gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\history gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\cards gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\tables gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat\chat_bottom gefunden: Trace.File.titan poker!E1
c:\poker gefunden: Trace.File.club dice poker!E1
c:\users\windows\appdata\roaming\microsoft\internet explorer\quick launch\partypoker.lnk gefunden: Trace.File.partypoker!E1
c:\users\windows\appdata\roaming\microsoft\internet explorer\quick launch\titan poker.lnk gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\casino.hlp gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\casino.ico gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\cactivex.dll gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack.dll gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack.gam gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\cashier.gam gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\casino.exe gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\common.gam gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\common.dll gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\cashier.dll gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\loader.dll gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\loader.gam gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_common.gam gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_common.dll gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline.css gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_table.dll gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_lobby.dll gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline.js gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline_functions.js gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline_poker.html gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\chat.html gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\colors.html gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\edit.html gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_lobby.gam gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\emoticons.html gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\cards\card.lwo gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins\coins-alpha.bmp gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins\coins.bmp gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat\chat.html gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\directsounddriver.dll gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\fileinfo2r.dat gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\fileinfo2.dat gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\ptsetup.lang gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\gdigraphdriver.dll gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\topview.gam gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\ptsetup.log gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\replace.exe gefunden: Trace.File.titan poker!E1
Key: hkey_current_user\software\ptech gefunden: Trace.Registry.e2give(charitynetwork)!E1
Value: hkey_current_user\software\partygaming\partypoker --> 1 gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 2 gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 4 gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 5 gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 6 gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 7 gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 10 gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 9 gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> adslastknownstate gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> apppath gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> fourcolourdeck gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> initialport gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> installstate gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> mucklosinghand gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> sl gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> tabletype gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> id gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> usecount gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> autologintoothergames gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> cfdialogshown gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> oldcfformat gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> freshinstall gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayname gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayversion gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installdate gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installlocation gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installsource gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installsourcefile gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> publisher gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> silentsettings gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> uninstallstring gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayicon gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> table_minplayers gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> table_playmode gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_6players gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_beginner gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_buyin gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_gametype gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_headsup gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_scheduled gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_sitngo gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_startin gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> global_login_hint gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> lobby_favouritegames gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_dealervoices gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_music gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_avatar_num gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_empty gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_finished gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_full gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_inprogress gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_showsidegames gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_smallview gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_sounds gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_xlslots gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options-fullscreen gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options-volume gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_12players gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> poker_nickname gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> ptdevm gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> table_realmode gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortby_second gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortorder_first gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortorder_second gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> tribeca_playernotes gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> username gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortby_first gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_10players gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> poker_login_type gefunden: Trace.Registry.titan poker!E1
Gescannt 834703
Gefunden 140
Scan Ende: 25.08.2012 13:13:18
Scan Zeit: 1:26:21
Value: hkey_current_user\software\titan poker\quicksearch --> table_minplayers Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> table_playmode Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_6players Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_beginner Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_buyin Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_gametype Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_headsup Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_scheduled Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_sitngo Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_startin Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> global_login_hint Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> lobby_favouritegames Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_dealervoices Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_music Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_avatar_num Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_empty Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_finished Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_full Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_inprogress Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_showsidegames Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_smallview Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_sounds Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_xlslots Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options-fullscreen Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options-volume Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_12players Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> poker_nickname Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> ptdevm Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> table_realmode Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortby_second Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortorder_first Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortorder_second Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> tribeca_playernotes Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> username Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortby_first Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_10players Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> poker_login_type Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 1 Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 2 Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 4 Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 5 Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 6 Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 7 Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 10 Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 9 Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> adslastknownstate Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> apppath Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> fourcolourdeck Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> initialport Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> installstate Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> mucklosinghand Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> sl Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> tabletype Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> id Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> usecount Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> autologintoothergames Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> cfdialogshown Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> oldcfformat Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> freshinstall Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayname Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayversion Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installdate Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installlocation Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installsource Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installsourcefile Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> publisher Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> silentsettings Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> uninstallstring Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayicon Quarantäne Trace.Registry.partypoker!E1
Key: hkey_current_user\software\ptech Quarantäne Trace.Registry.e2give(charitynetwork)!E1
c:\poker\titan poker Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\buttons Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\dialogs Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\login Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\buttons Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\history Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\sidegames Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\history\cards Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\sounds Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\anim Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\waitinglist Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\emoticons Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\buttons Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\dialogs Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\history Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\cards Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\tables Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat\chat_bottom Quarantäne Trace.File.titan poker!E1
c:\users\windows\appdata\roaming\microsoft\internet explorer\quick launch\titan poker.lnk Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\casino.hlp Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\casino.ico Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\cactivex.dll Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack.dll Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack.gam Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\cashier.gam Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\casino.exe Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\common.gam Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\common.dll Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\cashier.dll Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\loader.dll Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\loader.gam Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_common.gam Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_common.dll Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline.css Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_table.dll Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_lobby.dll Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline.js Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline_functions.js Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline_poker.html Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\chat.html Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\colors.html Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\edit.html Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_lobby.gam Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\emoticons.html Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\cards\card.lwo Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins\coins-alpha.bmp Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins\coins.bmp Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat\chat.html Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\directsounddriver.dll Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\fileinfo2r.dat Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\fileinfo2.dat Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\ptsetup.lang Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\gdigraphdriver.dll Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\topview.gam Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\ptsetup.log Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\replace.exe Quarantäne Trace.File.titan poker!E1
c:\users\windows\appdata\roaming\microsoft\windows\start menu\programs\partypoker Quarantäne Trace.File.partypoker!E1
c:\users\windows\appdata\roaming\microsoft\internet explorer\quick launch\partypoker.lnk Quarantäne Trace.File.partypoker!E1
c:\poker Quarantäne Trace.File.club dice poker!E1
Quarantäne 140
|
|
25.08.2012, 17:35
| #8 |
| /// Helfer-Team | email link angeklickt - ist PC jetzt infiziert? Sehr gut! Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
|
|
26.08.2012, 13:46
| #9 |
| | email link angeklickt - ist PC jetzt infiziert?Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=7079e18fc3fbe04f92519d1736e1f100
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-25 06:14:14
# local_time=2012-08-25 08:14:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=770 16774141 100 97 5621909 122625598 0 0
# compatibility_mode=5893 16776573 100 94 15729 97545574 0 0
# compatibility_mode=8192 67108863 100 0 280 280 0 0
# scanned=172862
# found=0
# cleaned=0
# scan_time=2730
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=7079e18fc3fbe04f92519d1736e1f100
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-26 12:38:21
# local_time=2012-08-26 02:38:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=770 16774141 100 97 5677632 122684921 0 0
# compatibility_mode=5893 16776573 100 94 52899 97604897 0 0
# compatibility_mode=8192 67108863 100 0 59603 59603 0 0
# scanned=354633
# found=3
# cleaned=3
# scan_time=9655
C:\Users\Windows\Downloads\Programme\SoftonicDownloader_fuer_vocup.exe a variant of Win32/SoftonicDownloader.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Users\Windows\Downloads\Programme\Topviewsoft_ScreenVideoCapture(2).exe Win32/Somoto application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Users\Windows\Downloads\Programme\vlc-1.1.9-win32.exe Win32/StartPage.OIE trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
|
|
27.08.2012, 02:03
| #10 |
| /// Helfer-Team | email link angeklickt - ist PC jetzt infiziert? Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck |
|
27.08.2012, 11:26
| #11 |
| | email link angeklickt - ist PC jetzt infiziert? PluginCheck Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen. Überprüft wird: Browser, Flash, Java und Adobe Reader Version. Firefox 14.0.1 ist aktuell Flash (11,4,402,265) ist aktuell. Java (1,7,0,6) ist aktuell. Adobe Reader 10,1,4,38 ist aktuell. |
|
27.08.2012, 18:23
| #12 |
| /// Helfer-Team | email link angeklickt - ist PC jetzt infiziert? Sehr gut! damit bist Du sauber und entlassen!  adwCleaner entfernen
Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Zurücksetzen der Sicherheitszonen Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen. Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html Systemwiederherstellungen leeren Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein: Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7 Danach wieder aktivieren. Aufräumen mit CCleaner Lasse mit CCleaner (Download) (Anleitung) Fehler in der
Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html PC wird immer langsamer - was tun? |
|
| Themen zu email link angeklickt - ist PC jetzt infiziert? |
| angeklickt, angst, avg secure search, avg security toolbar, bekannte, black, eingefangen, email, forum, gefangen, gefunde, geklickt, gepostet, infiziert, infiziert?, install.exe, intranet, irgend, langs, laufe, link, link angeklickt, malwarebytes, microsoft office 2003, natürlich, nichts, ntdll.dll, orange, plug-in, problem, scan, scanner, secure search, speziell, thread, vcredist, vtoolbarupdater, werbung |
Linear-Darstellung
