| |
| |||||||
Log-Analyse und Auswertung: BKA-Trojaner V. 1.15 - Windows 7 64bitWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
17.09.2012, 20:59
| #1 |
| |  BKA-Trojaner V. 1.15 - Windows 7 64bit Hallo! Gestern tauchte bei mir auch der BKA Trojaner (V. 1.15, laut bka-trojaner.de) auf. Als Anti-Viren Software benutze ich G Data Internet Security 2011 (immer auf dem neusten Signatur-Stand) Nachdem sich der Taskmanager nicht oeffnen ließ schaltete ich den PC aus und fuhr ihn erneut im abgesichteren Modus hoch um kurz zu recherchieren und kappte danach direkt die Internetverbindung. Danach fuehrte ich einen Scan mit Malwarebytes durch (log siehe unten). Habe ebenfalls einen Quick-Scan mit OTL durchgefuehrt, der Log ist ebenfalls unten. Ich habe sowieso vor Windows neuzuinstallieren (da ich bald eine SSD einbauen werde). Momentan habe ich meine Festplatte in eine Partition fuer Windows und den Rest fuer Daten (dorthin werden auch fast alle Programme installiert) aufgeteilt. Da ich aber vorher noch ein paar Daten sichern moechte (und vor allem nach Einbau der SSD fuer Windows, die zwei bisherigen Partitionen auf der Festplatte zusammenfassen moechte und auch zum Zeitpunkt der Infektion eine externe Festplatte angeschlossen war (diese hab ich sofort weggenommen), wollte ich gerne mein System von dem Trojaner befreien und sicherstellen, dass meine externe HDD nicht befallen ist. Momentan benutze ich Ubuntu von einem USB Stick (um diesen Text zu schreiben und meine Daten dann abzusichern, wenn frei von Infektion). Nachdem ich den Scan von Malwarebytes (im abgesichertem Modus) durchgefuehrt habe und ein Neustart erforderlich war, ließ ich Windows normal starten, was auch ohne Probleme klappte. Jedoch blinkte kurz danach oben rechts am Bildschirm ganz kurz ein roter Kasten auf, was mir auch kurz bevor der Sperrscreen des BKA Trojaners auftauchte auffiel, weshalb ich den PC direkt herunterfuhr, um weiteren Schaden zu vermindern. Ich bedanke mich schonmal fuer eure Hilfe. Lg jar31 (Ubuntu hat hier nur englisches Layout, bitte entschuldigt die fehlende oe,ae und ue) Hier die Logs: Malwarebytes Code:
ATTFilter Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Datenbank Version: v2012.09.16.11 Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 8.0.7600.16385 Lukas :: LUKAS-PC [Administrator] 16.09.2012 21:27:28 mbam-log-2012-09-16 (21-27-28).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 687738 Laufzeit: 1 Stunde(n), 2 Minute(n), 45 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{B7D26961-C836-2B35-29BD-2A0EE276765B} (Trojan.ZbotR.Gen) -> Daten: C:\Users\Lukas\AppData\Roaming\Uvbe\oqod.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 1 C:\Users\Lukas\AppData\Roaming\hellomoto (Trojan.Ransom.FGen) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 2 C:\Users\Lukas\AppData\Roaming\hellomoto\TujP.dat (Trojan.Ransom.FGen) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Lukas\AppData\Roaming\hellomoto\BukF.dat (Trojan.Ransom.FGen) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) OTL Logs: OTL Code:
ATTFilter OTL logfile created on: 17.09.2012 20:22:31 - Run 1 OTL by OldTimer - Version 3.2.61.5 Folder = C:\Users\Lukas\Desktop 64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,85 Gb Available Physical Memory | 71,21% Memory free 8,00 Gb Paging File | 6,86 Gb Available in Paging File | 85,81% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 48,73 Gb Total Space | 10,67 Gb Free Space | 21,89% Space Free | Partition Type: NTFS Drive D: | 4,31 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive E: | 416,93 Gb Total Space | 19,18 Gb Free Space | 4,60% Space Free | Partition Type: NTFS Drive F: | 14,90 Gb Total Space | 14,21 Gb Free Space | 95,35% Space Free | Partition Type: FAT32 Computer Name: LUKAS-PC | User Name: Lukas | Logged in as Administrator. Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.09.17 18:12:18 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Lukas\Desktop\OTL.exe ========== Modules (No Company Name) ========== ========== Services (SafeList) ========== SRV:64bit: - [2010.02.03 06:17:10 | 000,202,752 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.09.10 21:54:05 | 004,537,664 | ---- | M] () [Auto | Stopped] -- c:\program files (x86)\common files\akamai/netsession_win_5891ae0.dll -- (Akamai) SRV - [2012.09.08 15:56:49 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.09.08 15:55:24 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.08.13 13:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2012.08.11 00:03:57 | 000,103,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.06.04 11:50:20 | 001,766,464 | ---- | M] (G Data Software AG) [On_Demand | Stopped] -- E:\Program Files (x86)\Firewall\GDFwSvcx64.exe -- (GDFwSvc) SRV - [2012.06.01 05:05:18 | 002,011,056 | ---- | M] (G Data Software AG) [Auto | Stopped] -- E:\Program Files (x86)\AVK\AVKWCtlx64.exe -- (AVKWCtl) SRV - [2012.05.25 14:19:24 | 001,540,120 | ---- | M] (G Data Software AG) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy) SRV - [2012.03.29 04:42:27 | 000,470,008 | ---- | M] (G Data Software AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe -- (GDScan) SRV - [2012.01.27 05:43:33 | 000,468,472 | ---- | M] (G Data Software AG) [Auto | Stopped] -- E:\Program Files (x86)\AVK\AVKService.exe -- (AVKService) SRV - [2011.08.12 17:13:26 | 000,087,040 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service) SRV - [2011.05.26 21:28:56 | 000,040,960 | ---- | M] () [Auto | Stopped] -- C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer) SRV - [2011.04.07 17:37:16 | 005,352,960 | ---- | M] (Native Instruments GmbH) [Auto | Stopped] -- C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe -- (NIHardwareService) SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.04.24 01:10:34 | 000,209,768 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2010.04.24 01:10:28 | 000,483,688 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.03.18 12:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2010.03.04 00:49:01 | 000,075,064 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2010.02.03 12:40:50 | 000,094,440 | ---- | M] (tzuk) [Auto | Stopped] -- e:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.04.30 12:23:26 | 000,090,112 | ---- | M] () [Auto | Stopped] -- e:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service) SRV - [2009.02.10 18:01:49 | 000,116,104 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE -- (IJPLMSVC) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.06.03 11:50:01 | 000,106,648 | ---- | M] (G Data Software) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\GRD.sys -- (GRD) DRV:64bit: - [2012.06.03 11:40:21 | 000,059,768 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PktIcpt.sys -- (GDPkIcpt) DRV:64bit: - [2012.06.03 11:36:43 | 000,064,376 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\HookCentre.sys -- (HookCentre) DRV:64bit: - [2012.06.03 11:36:32 | 000,122,744 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\MiniIcpt.sys -- (GDMnIcpt) DRV:64bit: - [2012.06.03 11:36:32 | 000,065,912 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\gdwfpcd64.sys -- (gdwfpcd) DRV:64bit: - [2012.06.03 11:36:32 | 000,054,136 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\GDBehave.sys -- (GDBehave) DRV:64bit: - [2012.01.05 11:41:20 | 000,060,248 | ---- | M] (Focusrite Audio Engineering Limited.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ffusb2audio.sys -- (ffusb2audio) DRV:64bit: - [2011.08.20 15:51:05 | 000,031,448 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GdNetMon64.sys -- (GdNetMon) DRV:64bit: - [2011.07.07 18:42:38 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2011.05.10 08:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011.04.09 18:42:56 | 000,013,824 | ---- | M] (nerds.de) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\loopbe1.sys -- (LoopBeMidi1) DRV:64bit: - [2010.06.25 16:08:10 | 000,036,928 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\htcnprot.sys -- (htcnprot) DRV:64bit: - [2010.04.24 01:10:32 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2010.04.24 01:10:28 | 000,269,672 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2010.04.24 01:10:28 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2010.04.24 01:10:20 | 000,721,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2010.04.07 20:57:08 | 000,073,784 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2010.04.07 20:57:08 | 000,028,728 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.02.27 10:36:18 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd) DRV:64bit: - [2010.02.03 06:55:18 | 006,366,720 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag) DRV:64bit: - [2010.02.03 05:23:58 | 000,186,880 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2010.01.28 16:33:38 | 000,116,736 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:64bit: - [2009.08.17 13:20:46 | 001,235,968 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV:64bit: - [2009.07.16 05:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.22 16:52:30 | 000,215,040 | ---- | M] (Realtek ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009.05.05 06:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) DRV:64bit: - [2008.11.04 10:52:36 | 000,145,960 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018unic.sys -- (s1018unic) DRV:64bit: - [2008.11.04 10:52:36 | 000,132,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018mgmt.sys -- (s1018mgmt) DRV:64bit: - [2008.11.04 10:52:36 | 000,128,552 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018obex.sys -- (s1018obex) DRV:64bit: - [2008.11.04 10:52:36 | 000,034,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018nd5.sys -- (s1018nd5) DRV:64bit: - [2008.11.04 10:52:32 | 000,152,616 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018mdm.sys -- (s1018mdm) DRV:64bit: - [2008.11.04 10:52:32 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018mdfl.sys -- (s1018mdfl) DRV:64bit: - [2008.11.04 10:52:30 | 000,113,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018bus.sys -- (s1018bus) DRV:64bit: - [2008.06.27 08:51:10 | 000,088,632 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs) DRV:64bit: - [2008.06.23 10:08:41 | 001,358,336 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cmudaxp.sys -- (cmudaxp) DRV:64bit: - [2008.02.21 03:10:36 | 000,196,992 | ---- | M] (Omnivision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ov550ivx.sys -- (OV550I) DRV:64bit: - [2008.01.09 12:28:20 | 000,034,032 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\seehcri.sys -- (seehcri) DRV - [2011.05.12 20:11:41 | 000,106,224 | ---- | M] (G Data Software) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\GRD.sys -- (GRD) DRV - [2010.02.03 12:40:44 | 000,134,760 | ---- | M] (tzuk) [Kernel | On_Demand | Stopped] -- e:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - No CLSID value found IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 68 00 E5 A2 5D E7 CC 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKCU\..\SearchScopes\{0259B413-E84B-4C02-9409-6D3D00205873}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F464F524D3D4945464D3126713D7B7365617263685465726D737D267372633D7B72656665727265723A736F757263653F7D&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&k=0 IE - HKCU\..\SearchScopes\{0BD5909D-F694-4D73-A6F2-E230CF17EA97}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 IE - HKCU\..\SearchScopes\{12F10CC7-00CE-420D-911F-96F182B8225B}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 IE - HKCU\..\SearchScopes\{2B0E84CC-90FE-4913-B7AF-096971E474A7}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 IE - HKCU\..\SearchScopes\{4AFDB8AA-7B4C-41B0-8371-ACBD138A77A2}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E636F6E647569742E636F6D2F526573756C74734578742E617370783F713D7B7365617263685465726D737D26536561726368536F757263653D3426637469643D435432333034313537&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&k=0 IE - HKCU\..\SearchScopes\{C0058E40-BD96-4946-A978-D98908C6C9F0}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421;<local> ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Bing" FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://www.bing.com/search?FORM=IEFM1&q=" FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://de.gopro.com/|hxxp://www.guardian.co.uk/|hxxp://uk.yahoo.com/" FF - prefs.js..extensions.enabledAddons: artur.dubovoy@gmail.com:3.6.2 FF - prefs.js..extensions.enabledAddons: ffextension@weheartit.com:2.3.1 FF - prefs.js..extensions.enabledAddons: foxmarks@kei.com:4.0.5 FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.2 FF - prefs.js..extensions.enabledAddons: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.5 FF - prefs.js..extensions.enabledAddons: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.17 FF - prefs.js..extensions.enabledAddons: {906305f7-aafc-45e9-8bbd-941950a84dad}:1.1.11215.1124 FF - prefs.js..extensions.enabledAddons: {9051303c-7e41-4311-a783-d6fe5ef2832d}:14.0.4 FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.9.10 FF - prefs.js..extensions.enabledItems: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.3 FF - prefs.js..extensions.enabledItems: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.16 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:21.1.10084.997 FF - prefs.js..extensions.enabledItems: X-pireprototype@x-pire.net:1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..keyword.URL: "hxxp://www.bing.com/search?FORM=IEFM1&q=" FF - prefs.js..network.proxy.autoconfig_url: "file:///C:\\Users\\Lukas\\AppData\\Local\\Temp\\proxtube.pac" FF - prefs.js..network.proxy.type: 0 FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Lukas\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.08 15:55:25 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.08 15:55:20 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.08 15:55:25 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.08 15:55:20 | 000,000,000 | ---D | M] [2012.05.19 14:31:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\Extensions [2012.05.19 14:31:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\Extensions\ideskbrowser@haufe.de [2012.09.15 14:40:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions [2011.11.26 03:49:58 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} [2011.05.15 00:51:41 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a} [2012.09.15 14:40:59 | 000,000,000 | ---D | M] ("FVD Suite Addon") -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions\{9051303c-7e41-4311-a783-d6fe5ef2832d} [2011.12.31 20:34:24 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions\foxmarks@kei.com [2012.05.17 21:46:07 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions\ich@maltegoetz.de [2012.07.09 19:49:36 | 000,185,600 | ---- | M] () (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\extensions\artur.dubovoy@gmail.com.xpi [2012.07.08 19:34:40 | 000,057,159 | ---- | M] () (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\extensions\ffextension@weheartit.com.xpi [2011.12.31 00:38:19 | 000,074,526 | ---- | M] () (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\extensions\{11483926-db67-4190-91b1-ef20fcec5f33}.xpi [2012.06.30 00:39:41 | 000,525,327 | ---- | M] () (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012.07.04 15:45:08 | 000,743,290 | ---- | M] () (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011.05.26 21:29:01 | 000,001,123 | ---- | M] () -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\conduit.xml [2011.05.26 22:27:22 | 000,001,030 | ---- | M] () -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\wikipedia-de.xml [2012.09.08 15:55:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.09.08 15:55:15 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.09.08 15:55:15 | 000,000,000 | ---D | M] (G Data BankGuard) -- C:\Program Files (x86)\mozilla firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad} [2012.09.08 15:55:24 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2012.05.04 10:14:47 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.08.29 11:52:58 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.05.04 10:14:47 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.05.04 10:14:47 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.05.04 10:14:47 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.05.04 10:14:47 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.07.24 17:33:40 | 000,396,541 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com O1 - Hosts: 127.0.0.1 adobeereg.com O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 practivate.adobe.com O1 - Hosts: 127.0.0.1 ereg.adobe.com O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com O1 - Hosts: 127.0.0.1 wip3.adobe.com O1 - Hosts: 127.0.0.1 activate-sea.adobe.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com O1 - Hosts: 127.0.0.1 3dns.adobe.com O1 - Hosts: 127.0.0.1 3dns-1.adobe.com O1 - Hosts: 127.0.0.1 3dns-2.adobe.com O1 - Hosts: 127.0.0.1 3dns-3.adobe.com O1 - Hosts: 127.0.0.1 3dns-4.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-1.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-4.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-5.adobe.com O1 - Hosts: 127.0.0.1 hh-software.com O1 - Hosts: 127.0.0.1 www.hh-software.com O1 - Hosts: 13690 more lines... O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (no name) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - No CLSID value found. O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G Data\AVKProxy\BanksafeBHO.dll (G Data Software AG) O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC) O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4:64bit: - HKLM..\Run: [Cmaudio8788] C:\Windows\Syswow64\cmicnfgp.cpl (C-Media Corporation) O4:64bit: - HKLM..\Run: [Cmaudio8788GX] C:\Windows\syswow64\HsMgr.exe () O4:64bit: - HKLM..\Run: [Cmaudio8788GX64] C:\Windows\system\HsMgr64.exe () O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS) O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [boincmgr] E:\Program Files (x86)\BOINC\boincmgr.exe (Space Sciences Laboratory) O4 - HKLM..\Run: [boinctray] E:\Program Files (x86)\BOINC\boinctray.exe (Space Sciences Laboratory) O4 - HKLM..\Run: [G Data AntiVirus Tray Application] E:\Program Files (x86)\AVKTray\AVKTray.exe (G Data Software AG) O4 - HKLM..\Run: [GDFirewallTray] E:\Program Files (x86)\Firewall\GDFirewallTray.exe (G Data Software AG) O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA) O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe () O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKCU..\Run: [AdobeBridge] File not found O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Lukas\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) O4 - HKCU..\Run: [ONAIR] C:\Programme\ONAIR\ONAIR.exe (DJMASTER.COM) O4 - HKCU..\Run: [SandboxieControl] e:\Program Files\Sandboxie\SbieCtrl.exe (tzuk) O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Lukas\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe () O4 - HKCU..\Run: [SpybotSD TeaTimer] e:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe File not found O4 - HKCU..\Run: [UIRibbon] C:\Users\Lukas\AppData\Local\Microsoft\Windows\1646\UIRibbon.exe () O4 - Startup: C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Lukas\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0) O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7692B860-8954-4F13-8019-0406A17CEFDF}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\haufereader - No CLSID value found O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\gopher - No CLSID value found O18 - Protocol\Handler\haufereader - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2012.04.23 16:38:12 | 000,000,135 | ---- | M] () - F:\autorun.inf -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.09.17 20:21:12 | 000,600,064 | ---- | C] (OldTimer Tools) -- C:\Users\Lukas\Desktop\OTL.exe [2012.09.17 01:15:01 | 000,000,000 | ---D | C] -- C:\Users\Lukas\AppData\Roaming\hellomoto [2012.09.16 21:25:06 | 000,000,000 | ---D | C] -- C:\Users\Lukas\AppData\Roaming\Malwarebytes [2012.09.16 21:24:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.09.16 21:24:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.09.16 21:24:56 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.16 21:24:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.09.08 15:55:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.09.03 21:11:58 | 000,000,000 | ---D | C] -- C:\Users\Lukas\Desktop\Wolves Carry My Name - Amongst Ruins And Ashes [2012.08.30 22:57:20 | 000,000,000 | ---D | C] -- C:\Users\Lukas\Desktop\EBAY_BMTH [2012.08.23 15:20:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ONAIR [2012.08.23 15:20:31 | 000,000,000 | ---D | C] -- C:\Program Files\ONAIR [2012.08.23 15:18:27 | 000,000,000 | ---D | C] -- C:\Users\Lukas\Desktop\Neuer Ordner [2010.05.28 14:17:59 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpe8767.dll [2010.05.28 14:12:30 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpe8297.dll [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.09.17 20:22:07 | 001,500,018 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.09.17 20:22:07 | 000,654,372 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.09.17 20:22:07 | 000,616,254 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.09.17 20:22:07 | 000,129,986 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.09.17 20:22:07 | 000,106,376 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.09.17 20:21:58 | 000,000,020 | ---- | M] () -- C:\Users\Lukas\defogger_reenable [2012.09.17 20:20:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.17 20:20:12 | 3220,574,208 | -HS- | M] () -- C:\hiberfil.sys [2012.09.17 18:12:18 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Lukas\Desktop\OTL.exe [2012.09.17 18:12:12 | 000,050,477 | ---- | M] () -- C:\Users\Lukas\Desktop\Defogger.exe [2012.09.16 21:24:57 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.16 15:03:33 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.16 15:03:33 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.12 16:21:04 | 000,063,959 | ---- | M] () -- C:\Users\Lukas\Desktop\67498_1313092368014_7053341_n.jpg [2012.09.07 21:03:24 | 000,059,966 | ---- | M] () -- C:\Users\Lukas\Desktop\kuendigungshelfer_491601690001.pdf [2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.05 00:02:12 | 000,031,775 | ---- | M] () -- C:\Users\Lukas\Desktop\lebenslauf_mama.pdf [2012.09.05 00:02:02 | 000,015,765 | ---- | M] () -- C:\Users\Lukas\Desktop\lebenslauf_mama.odt [2012.09.02 13:05:30 | 000,853,368 | ---- | M] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch.JPG [2012.09.02 13:05:30 | 000,648,094 | ---- | M] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch0001.JPG [2012.09.02 13:05:30 | 000,633,785 | ---- | M] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch0002.JPG [2012.09.01 20:25:14 | 000,027,374 | ---- | M] () -- C:\Users\Lukas\Desktop\kirk-and-spock.jpg [2012.09.01 20:25:12 | 000,034,912 | ---- | M] () -- C:\Users\Lukas\Desktop\Kirk_Spock_McCoy_bridge_2267.jpg [2012.09.01 19:55:43 | 000,080,276 | ---- | M] () -- C:\Users\Lukas\Desktop\star_trek_csg_031.jpg [2012.08.29 20:06:06 | 000,014,799 | ---- | M] () -- C:\Users\Public\Documents\Unbenannt 1.ods [2012.08.28 15:51:04 | 002,755,832 | ---- | M] () -- C:\Users\Lukas\Desktop\trial.png [2012.08.28 12:48:26 | 000,023,056 | ---- | M] () -- C:\Users\Lukas\Desktop\554572_10151055993617620_1395222658_n.jpg [2012.08.25 21:59:50 | 000,069,300 | ---- | M] () -- C:\Users\Lukas\Desktop\tab_25_08_96432_rinoa_fires_in_the_distant_north_gpx.gp5 [2012.08.22 20:25:28 | 000,001,502 | ---- | M] () -- C:\Users\Lukas\Desktop\csgo - Verknüpfung.lnk [2012.08.22 20:25:06 | 000,000,117 | ---- | M] () -- C:\Users\Lukas\Desktop\tick128.cfg [2012.08.22 20:24:50 | 000,000,115 | ---- | M] () -- C:\Users\Lukas\Desktop\tick64.cfg [2012.08.21 21:19:21 | 000,011,551 | ---- | M] () -- C:\Users\Lukas\Desktop\valve (2).rc [2012.08.21 16:19:11 | 000,770,883 | ---- | M] () -- C:\Windows\SysWow64\sig.bin [2012.08.21 16:19:11 | 000,043,211 | ---- | M] () -- C:\Windows\SysWow64\nmp.map [2012.08.21 00:17:14 | 000,005,506 | ---- | M] () -- C:\Windows\Sandboxie.ini [2012.08.20 15:38:26 | 000,001,805 | ---- | M] () -- C:\Users\Lukas\Desktop\Spotify.lnk [2012.08.19 18:39:26 | 000,948,940 | ---- | M] () -- C:\Users\Lukas\Desktop\The+xx+GIF.gif [2012.08.19 16:48:54 | 000,144,265 | ---- | M] () -- C:\Users\Lukas\Desktop\explosions_in_the_sky_catastrophe_and_the_cure.gp5 [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.09.17 20:21:58 | 000,000,020 | ---- | C] () -- C:\Users\Lukas\defogger_reenable [2012.09.17 20:21:13 | 000,050,477 | ---- | C] () -- C:\Users\Lukas\Desktop\Defogger.exe [2012.09.16 21:24:57 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.12 16:21:03 | 000,063,959 | ---- | C] () -- C:\Users\Lukas\Desktop\67498_1313092368014_7053341_n.jpg [2012.09.07 21:03:28 | 000,059,966 | ---- | C] () -- C:\Users\Lukas\Desktop\kuendigungshelfer_491601690001.pdf [2012.09.05 00:02:10 | 000,031,775 | ---- | C] () -- C:\Users\Lukas\Desktop\lebenslauf_mama.pdf [2012.09.05 00:02:01 | 000,015,765 | ---- | C] () -- C:\Users\Lukas\Desktop\lebenslauf_mama.odt [2012.09.02 14:06:04 | 000,853,368 | ---- | C] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch.JPG [2012.09.02 14:06:04 | 000,648,094 | ---- | C] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch0001.JPG [2012.09.02 14:06:04 | 000,633,785 | ---- | C] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch0002.JPG [2012.09.01 20:25:14 | 000,027,374 | ---- | C] () -- C:\Users\Lukas\Desktop\kirk-and-spock.jpg [2012.09.01 20:25:10 | 000,034,912 | ---- | C] () -- C:\Users\Lukas\Desktop\Kirk_Spock_McCoy_bridge_2267.jpg [2012.09.01 19:55:41 | 000,080,276 | ---- | C] () -- C:\Users\Lukas\Desktop\star_trek_csg_031.jpg [2012.08.29 19:59:20 | 000,014,799 | ---- | C] () -- C:\Users\Public\Documents\Unbenannt 1.ods [2012.08.28 15:51:03 | 002,755,832 | ---- | C] () -- C:\Users\Lukas\Desktop\trial.png [2012.08.28 12:48:25 | 000,023,056 | ---- | C] () -- C:\Users\Lukas\Desktop\554572_10151055993617620_1395222658_n.jpg [2012.08.25 21:59:58 | 000,069,300 | ---- | C] () -- C:\Users\Lukas\Desktop\tab_25_08_96432_rinoa_fires_in_the_distant_north_gpx.gp5 [2012.08.22 20:25:29 | 000,001,502 | ---- | C] () -- C:\Users\Lukas\Desktop\csgo - Verknüpfung.lnk [2012.08.22 20:25:06 | 000,000,117 | ---- | C] () -- C:\Users\Lukas\Desktop\tick128.cfg [2012.08.22 20:24:50 | 000,000,115 | ---- | C] () -- C:\Users\Lukas\Desktop\tick64.cfg [2012.08.21 21:20:09 | 000,011,551 | ---- | C] () -- C:\Users\Lukas\Desktop\valve (2).rc [2012.08.20 15:38:26 | 000,001,805 | ---- | C] () -- C:\Users\Lukas\Desktop\Spotify.lnk [2012.08.19 18:39:25 | 000,948,940 | ---- | C] () -- C:\Users\Lukas\Desktop\The+xx+GIF.gif [2012.08.19 16:48:59 | 000,144,265 | ---- | C] () -- C:\Users\Lukas\Desktop\explosions_in_the_sky_catastrophe_and_the_cure.gp5 [2012.07.25 14:40:52 | 007,416,576 | ---- | C] () -- C:\Users\Lukas\Song 3 Retardierendes Moment.mp3 [2012.06.20 16:12:17 | 000,000,132 | ---- | C] () -- C:\Users\Lukas\AppData\Roaming\Adobe BMP Format CS5 Prefs [2011.09.27 11:17:26 | 000,198,144 | ---- | C] () -- C:\Windows\SysWow64\LXPrnUtil10.dll [2011.09.27 11:16:20 | 000,304,128 | ---- | C] () -- C:\Windows\SysWow64\LxDNT100.dll [2011.09.27 11:14:14 | 000,133,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvmc100.dll [2011.09.27 11:13:58 | 000,069,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvm100.dll [2011.08.21 11:51:02 | 000,770,883 | ---- | C] () -- C:\Windows\SysWow64\sig.bin [2011.06.06 18:30:24 | 000,200,704 | R--- | C] () -- C:\Windows\SysWow64\HsMgr.exe [2011.06.06 18:30:16 | 000,139,264 | R--- | C] () -- C:\Windows\SysWow64\VmixP8.dll [2011.06.06 18:29:53 | 000,039,288 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.cfl [2011.06.06 18:28:37 | 000,007,214 | R--- | C] () -- C:\Windows\Cmicnfgp.ini.cfg [2011.06.06 18:28:37 | 000,000,862 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.imi [2011.05.29 10:35:26 | 000,006,656 | ---- | C] () -- C:\Users\Lukas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.05.14 16:41:44 | 000,000,132 | ---- | C] () -- C:\Users\Lukas\AppData\Roaming\Adobe GIF Format CS5 Prefs [2011.04.27 20:21:07 | 000,000,471 | ---- | C] () -- C:\Users\Lukas\AppData\Roaming\Poladroid prefs.plist [2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.03.02 17:32:06 | 000,311,296 | ---- | C] () -- C:\Windows\SysWow64\EMRegSys.dll [2010.07.29 22:41:04 | 000,000,132 | ---- | C] () -- C:\Users\Lukas\AppData\Roaming\Adobe PNG Format CS5 Prefs [2010.06.19 20:43:57 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat ========== LOP Check ========== [2012.08.03 18:38:32 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\.minecraft [2012.05.20 22:45:18 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\.spoutcraft [2011.02.19 23:10:32 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Alien Skin [2010.03.21 16:55:48 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Amazon [2011.06.06 18:36:07 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\ASUS [2012.07.09 19:39:42 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Babylon [2011.12.28 16:34:14 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\bsnes [2010.12.22 00:21:13 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Canneverbe Limited [2011.06.10 16:47:55 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Canon [2012.03.19 22:27:00 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\CasaPortale.de [2010.10.10 20:37:01 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2010.07.06 18:43:07 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\com.destroytoday.destroytwitter [2010.02.27 11:09:20 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\DAEMON Tools Lite [2010.10.10 19:27:02 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\dBpoweramp [2010.04.26 12:06:25 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Digital Distribution Networks Ltd [2012.09.17 01:15:19 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Dropbox [2012.04.05 19:14:36 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\DVDVideoSoft [2011.09.01 16:48:26 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\elsterformular [2011.05.29 09:22:37 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Engelmann Media [2010.05.27 12:55:56 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Feedreader [2012.07.09 19:59:54 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\FVD Suite [2012.08.03 11:53:42 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\FXpansion [2012.06.02 19:40:43 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Guitar Pro 6 [2012.05.19 14:31:03 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Haufe Mediengruppe [2010.04.01 03:27:15 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\HDRsoft [2012.09.17 01:15:01 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\hellomoto [2010.03.22 21:31:17 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\HLSW [2012.07.22 20:09:54 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\HTC [2012.07.22 22:33:29 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1 [2012.08.10 13:49:36 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\ICQ [2012.05.08 08:47:13 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Lexware [2011.04.27 21:06:29 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Nik Software [2011.05.26 21:28:56 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\OCS [2010.03.07 21:39:54 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\OpenOffice.org [2011.05.26 21:29:01 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Opera [2011.09.21 15:56:56 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\PandoraRecovery [2012.07.31 23:02:21 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\PreSonus [2012.08.07 21:57:07 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Propellerhead Software [2010.04.02 09:18:25 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Red Kawa [2012.09.03 12:59:34 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\SoftGrid Client [2012.09.16 20:10:14 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Spotify [2011.05.13 23:18:18 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2010.09.08 15:40:58 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\TP [2010.02.27 20:34:57 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1 [2010.05.15 19:46:42 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Ubisoft [2010.05.19 06:25:27 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Uvbe [2010.03.06 17:59:28 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\VSO [2011.02.19 18:41:00 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Wingnut [2010.05.19 01:54:35 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Yqdut [2012.06.17 11:08:13 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:63238B95 < End of report > Code:
ATTFilter OTL Extras logfile created on: 17.09.2012 20:22:31 - Run 1
OTL by OldTimer - Version 3.2.61.5 Folder = C:\Users\Lukas\Desktop
64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,85 Gb Available Physical Memory | 71,21% Memory free
8,00 Gb Paging File | 6,86 Gb Available in Paging File | 85,81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,73 Gb Total Space | 10,67 Gb Free Space | 21,89% Space Free | Partition Type: NTFS
Drive D: | 4,31 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 416,93 Gb Total Space | 19,18 Gb Free Space | 4,60% Space Free | Partition Type: NTFS
Drive F: | 14,90 Gb Total Space | 14,21 Gb Free Space | 95,35% Space Free | Partition Type: FAT32
Computer Name: LUKAS-PC | User Name: Lukas | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "e:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- E:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "e:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "e:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- E:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "e:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== System Restore Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03F2D47A-D716-430A-8443-503120D30206}" = rport=10243 | protocol=6 | dir=out | app=system |
"{086951C2-BA05-4518-8A3B-9285F766AA73}" = lport=28962 | protocol=17 | dir=in | name=cod4 |
"{12552145-E516-4F5F-9CA5-511A306CB67F}" = lport=2869 | protocol=6 | dir=in | app=system |
"{16F80983-BABA-45D1-910A-EB9DC75D5CA4}" = lport=137 | protocol=17 | dir=in | app=system |
"{1DC88FBA-2948-47CB-BD6E-7946C55A76A1}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1F1B8E2E-2B30-4F6F-902E-59A88AC37244}" = rport=138 | protocol=17 | dir=out | app=system |
"{3093CF20-A537-4043-AD31-EEF971648EE0}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{3B060073-105E-4740-90BE-84D97D3439CD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{44301E8D-F609-4C29-9A02-C8353F96E722}" = lport=2869 | protocol=6 | dir=in | app=system |
"{4C419D30-5971-4597-9B8B-928A17CAFFD1}" = rport=445 | protocol=6 | dir=out | app=system |
"{5E4AEB9C-5779-49DD-B8CE-DC09CAF19EA6}" = lport=5900 | protocol=6 | dir=in | name=vnc5900 |
"{612A5231-22EF-4A5C-90DF-B63D8F34FF6A}" = lport=10243 | protocol=6 | dir=in | app=system |
"{7A3D84C9-28B7-407B-9D4F-0D51F1AAA01D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7FA0E550-2494-4BA9-A9E3-8DDB30C9CB4C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{81A8270F-B761-43EB-84B5-4BC09DA0BD66}" = rport=137 | protocol=17 | dir=out | app=system |
"{87CD18EA-D025-41D0-B51A-F5F7E16E82CA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{89BE9C59-DADA-48C5-B481-19F297CE9099}" = lport=138 | protocol=17 | dir=in | app=system |
"{9B73F55E-2214-4FFD-8FB7-4E953C820F8C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A1242B21-DE3C-40C2-A622-ED35125B6586}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{B1F31A8D-9270-41F1-AF29-75C44606BC79}" = lport=5800 | protocol=6 | dir=in | name=vnc5800 |
"{B7E08CC6-615B-41C0-8E40-011193352F56}" = lport=445 | protocol=6 | dir=in | app=system |
"{BAB5FA7D-7091-4DD2-B72A-8C6B4ED3DCB0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{CD907766-B4E0-48E3-8849-41A70BA02444}" = lport=139 | protocol=6 | dir=in | app=system |
"{DEA2FAD5-7CA9-4D6A-B5AD-05EB21B24C5E}" = rport=139 | protocol=6 | dir=out | app=system |
"{DEFFF42B-8F8D-4202-A784-4E03F01C134A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E19C028D-2645-438A-9593-025F7F901549}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{E2B6410B-74E9-49C0-8C4F-87075982CD37}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F4267CFC-2C4C-4B6D-8261-FF3E5A6DC87D}" = lport=49185 | protocol=6 | dir=in | name=akamai netsession interface |
"{F9F7C2C5-7F40-492A-A2A2-A46D0A0F5E8C}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{FFE966F4-2243-4CA9-A5E0-7CC0CD96389E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D046988-64D5-4D92-8DB7-8A38C1B9983A}" = protocol=6 | dir=in | app=c:\program files (x86)\ultravnc\vncviewer.exe |
"{0D3EFD73-9BDF-4227-90DA-9684575186A2}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\counter-strike source\hl2.exe |
"{1B505F5C-7834-42DF-8C30-5DABE4AA88D5}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\common\call of duty 4\iw3sp.exe |
"{233BA9C3-2718-417F-8041-23DC27B34680}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2550E7EE-AEE2-4AA0-8C65-F11F46F53398}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\common\call of duty 4\iw3mp.exe |
"{25565A69-1AAF-40BA-A6D0-14E48AC372AC}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steam.exe |
"{2F335760-8DDC-4B14-A5C7-ACA2F4BB19D2}" = protocol=6 | dir=in | app=c:\users\lukas\appdata\local\akamai\netsession_win.exe |
"{33C90D89-E87D-4762-B4D2-61FFB661EBED}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\common\amd driver updater, vista and 7, 64 bit\setup.exe |
"{344C4683-D6FE-4364-AD08-9EEA7FF97A18}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe |
"{34537401-24CE-4975-BB81-AF90643C0FF3}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{35168F63-0A72-403B-A9EB-C9855EEA8681}" = protocol=17 | dir=in | app=c:\program files (x86)\ultravnc\winvnc.exe |
"{35AF5413-C3C8-431D-804E-97C737BE89FE}" = protocol=6 | dir=in | app=c:\users\lukas\appdata\roaming\dropbox\bin\dropbox.exe |
"{3848F042-D06E-472A-B30F-7BB9B480E1CB}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe |
"{3AECB477-B529-4A23-BB0F-07C56AC0E325}" = protocol=6 | dir=in | app=e:\program files (x86)\sierra\fearcombat\fearmp.exe |
"{3D57D5C6-85EC-4B54-9DA0-BC6185526F91}" = protocol=6 | dir=out | app=system |
"{3E6EF1C0-34D0-4129-84D2-2C28CA21D1AC}" = protocol=17 | dir=in | app=c:\users\lukas\appdata\roaming\dropbox\bin\dropbox.exe |
"{427F5EB0-78DA-4612-9F5E-9404481D9C7D}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\day of defeat source\hl2.exe |
"{453F5C81-3B6A-4085-8196-A00B60E6B2A0}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\common\call of duty 4\iw3sp.exe |
"{491AABDC-7158-40D9-8907-14E6441D5FDB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4BB866D1-3566-4E21-88F9-ED7565786F00}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4D17876D-C9EB-40AC-9F2E-F606CAB880FB}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\common\call of duty 4\iw3mp.exe |
"{50766362-13C9-45D3-876C-6C65ABE253AF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{51254B0A-0E13-46F9-A2FF-86E5A8A03A82}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{5BD2052A-94E2-4CCA-8265-6B5406478118}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{5C34740E-7141-463F-9548-00C98E30EDDA}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\common\amd driver updater, vista and 7, 64 bit\setup.exe |
"{5EBDBAF3-1412-459A-AA91-24FABE34FB20}" = protocol=6 | dir=in | app=c:\program files (x86)\ultravnc\winvnc.exe |
"{6836F41F-68CC-4889-850B-DFA963922B7A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{69AAA40B-B0F4-4A20-9FB7-EDC4DF46BA48}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{6FAD433F-D066-434F-A913-2CCD516A48CE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{70333767-3577-4B2F-91DA-961551C1FF16}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\counter-strike source\hl2.exe |
"{70C7A060-0E8C-4007-9045-34BACF170F44}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe |
"{7408203B-E74A-4C8B-BB4E-43DAD6B83AF2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{776A4067-60F2-437D-B7A3-FE7EE103844F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{799C980F-C39C-40CE-B017-60BC23E2D219}" = protocol=17 | dir=in | app=c:\users\lukas\appdata\local\akamai\netsession_win.exe |
"{79A769AD-FCA8-4291-B4AD-650606017B13}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{837AAECB-F96C-4AF2-B3C0-914996580810}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{83D78DDB-411F-4D03-92DC-3BFA75510CE8}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe |
"{AA18B86D-852E-4B9B-8938-77E10752BB74}" = protocol=6 | dir=in | app=e:\program files (x86)\rockstar games\eflc\launcheflc.exe |
"{AF0A4004-7801-4AED-9201-3D417188DD90}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B61413A3-36B6-409C-BA37-FF5217B442EE}" = protocol=17 | dir=in | app=c:\program files (x86)\ultravnc\vncviewer.exe |
"{B7A35CE4-5B43-4FC5-834F-BEE147A0DF1D}" = protocol=6 | dir=in | app=e:\program files (x86)\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe |
"{BE461CD2-8DC9-4083-8E42-CD3C411C8BD2}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\day of defeat source\hl2.exe |
"{C1523AA7-70A5-416E-9B47-AB353C55C8FA}" = protocol=17 | dir=in | app=e:\program files (x86)\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe |
"{C17FA47F-D0A3-495A-9C2A-D6049E54ECC2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{C3FAC08B-478B-4DB4-8E1D-C3543C7D9FA1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C87CBF1F-4405-40F1-8938-03AA5B4144B2}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C8EB60FF-6885-452A-A7DB-25F3E13E75E4}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe |
"{CF13866C-D01D-4028-930B-0DD06C8FFDD3}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{D0D4C853-B0FF-4467-B385-E2803D853164}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{D2745AE4-6E12-4D4D-B5D4-88CB07F7F7D8}" = protocol=17 | dir=in | app=e:\program files (x86)\sierra\fearcombat\fearmp.exe |
"{D3D385F0-7844-42FE-83BE-BBA55E081B94}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe |
"{E351BEDA-C975-46AB-B161-1BB812D460E6}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E3EE07C7-CCD1-478F-899B-AD5CC464F8A3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E87CFD64-C8B1-4B20-86B1-CE42221E9CB0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{EBE4D7D5-C5C5-4188-9381-9BE75DF50395}" = protocol=17 | dir=in | app=e:\program files (x86)\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe |
"{ED11CAB6-C4BA-4D71-87D0-AEF5032139F3}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{F1C40E5E-A510-41D7-A124-F45FA57592E4}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{F4BC20CD-1FF1-4583-9588-90B10AF04E47}" = protocol=17 | dir=in | app=e:\program files (x86)\rockstar games\eflc\launcheflc.exe |
"{F727242D-6C85-42C8-BECE-2DB466916219}" = protocol=6 | dir=in | app=e:\program files (x86)\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe |
"{FE8698D5-3D93-430C-814F-8041C3E00777}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steam.exe |
"{FEC84996-CA99-4F92-8684-7D42279C551B}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"TCP Query User{1DE46F76-8130-4700-90A0-C1318380AB5E}E:\program files (x86)\steam\steamapps\wachkoma\insurgency\hl2.exe" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\insurgency\hl2.exe |
"TCP Query User{3DA85CEF-4447-415A-BBFB-DC16093853C2}E:\program files (x86)\tvants\tvants.exe" = protocol=6 | dir=in | app=e:\program files (x86)\tvants\tvants.exe |
"TCP Query User{4EE5B384-9D83-469D-A0A8-BF9C86FFFC25}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"TCP Query User{641587D0-EF95-4160-9B5F-2E4B8C606C76}E:\program files (x86)\black_box\assassin's creed 2\assassinscreediigame.exe" = protocol=6 | dir=in | app=e:\program files (x86)\black_box\assassin's creed 2\assassinscreediigame.exe |
"TCP Query User{73B2A950-7D88-4A7F-9880-EA28DEEFD5EB}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"TCP Query User{76E2DFB1-6197-490A-88A5-3A49CEC7C428}C:\users\lukas\appdata\roaming\uvbe\oqod.exe" = protocol=6 | dir=in | app=c:\users\lukas\appdata\roaming\uvbe\oqod.exe |
"TCP Query User{8312C046-B9EA-46C2-9F40-ABFFB3E4341F}E:\program files (x86)\game\fifa.exe" = protocol=6 | dir=in | app=e:\program files (x86)\game\fifa.exe |
"TCP Query User{916222A0-9A51-47E0-8094-57E8A9E50A4E}E:\program files (x86)\ubisoft\splinter cell pandora tomorrow\pandora.exe" = protocol=6 | dir=in | app=e:\program files (x86)\ubisoft\splinter cell pandora tomorrow\pandora.exe |
"TCP Query User{9310BEC2-C15A-4E42-9EB8-401CAD670223}E:\program files (x86)\xfire\xfire.exe" = protocol=6 | dir=in | app=e:\program files (x86)\xfire\xfire.exe |
"TCP Query User{986F6CE8-DC5C-4D70-AD00-E4E55A79CB94}C:\program files (x86)\quicktime\quicktimeplayer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\quicktime\quicktimeplayer.exe |
"TCP Query User{C72DA3D8-360E-4D13-82DC-D59B68D14A78}E:\program files (x86)\steam\steamapps\wachkoma\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\team fortress 2\hl2.exe |
"TCP Query User{DB836777-C13F-47A2-B28B-BB57B9926899}E:\program files (x86)\hlsw\hlsw.exe" = protocol=6 | dir=in | app=e:\program files (x86)\hlsw\hlsw.exe |
"TCP Query User{DFBB08FF-0A7C-4D71-AAF1-DFF48A3EDC53}E:\program files (x86)\tom clancy's rainbow six vegas 2\binaries\r6vegas2_game.exe" = protocol=6 | dir=in | app=e:\program files (x86)\tom clancy's rainbow six vegas 2\binaries\r6vegas2_game.exe |
"TCP Query User{E43C6925-AFE5-45E4-92D1-F141F79AA8DE}E:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe" = protocol=6 | dir=in | app=e:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe |
"TCP Query User{EBF74D12-7F29-4C43-9A8F-39DDAEA60115}C:\users\lukas\appdata\roaming\uvbe\oqod.exe" = protocol=6 | dir=in | app=c:\users\lukas\appdata\roaming\uvbe\oqod.exe |
"UDP Query User{149D8088-F1FD-4B74-9B58-33F108F97A94}E:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe" = protocol=17 | dir=in | app=e:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe |
"UDP Query User{267B901A-31F5-45EF-86C3-AEA7E980EA68}E:\program files (x86)\xfire\xfire.exe" = protocol=17 | dir=in | app=e:\program files (x86)\xfire\xfire.exe |
"UDP Query User{2CBCF193-C41C-49B4-B4CC-8EAEAAAB7678}E:\program files (x86)\black_box\assassin's creed 2\assassinscreediigame.exe" = protocol=17 | dir=in | app=e:\program files (x86)\black_box\assassin's creed 2\assassinscreediigame.exe |
"UDP Query User{40A988F9-7E19-4C3F-929F-F48119ADB7DB}E:\program files (x86)\hlsw\hlsw.exe" = protocol=17 | dir=in | app=e:\program files (x86)\hlsw\hlsw.exe |
"UDP Query User{5107539C-4503-4271-A55B-668AFEA47FEF}C:\users\lukas\appdata\roaming\uvbe\oqod.exe" = protocol=17 | dir=in | app=c:\users\lukas\appdata\roaming\uvbe\oqod.exe |
"UDP Query User{57D9A238-5FCD-4995-B707-5108AD9FA2AC}E:\program files (x86)\tom clancy's rainbow six vegas 2\binaries\r6vegas2_game.exe" = protocol=17 | dir=in | app=e:\program files (x86)\tom clancy's rainbow six vegas 2\binaries\r6vegas2_game.exe |
"UDP Query User{61A25EC7-0A39-4880-80FA-0739A7FB9619}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"UDP Query User{70E22CBC-BE8D-448F-8337-7FB2AC0670AD}E:\program files (x86)\steam\steamapps\wachkoma\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\team fortress 2\hl2.exe |
"UDP Query User{C0A9BEDB-B2BB-41FE-AFEB-28CA880C39E0}E:\program files (x86)\tvants\tvants.exe" = protocol=17 | dir=in | app=e:\program files (x86)\tvants\tvants.exe |
"UDP Query User{C16804AF-69E7-4A99-8E25-D829602281F7}C:\users\lukas\appdata\roaming\uvbe\oqod.exe" = protocol=17 | dir=in | app=c:\users\lukas\appdata\roaming\uvbe\oqod.exe |
"UDP Query User{C2BC7265-6034-45E9-87D3-2EDCF0A2C7E9}E:\program files (x86)\ubisoft\splinter cell pandora tomorrow\pandora.exe" = protocol=17 | dir=in | app=e:\program files (x86)\ubisoft\splinter cell pandora tomorrow\pandora.exe |
"UDP Query User{C49C6711-B0B1-491B-8FD0-BA4FF2EC6079}E:\program files (x86)\steam\steamapps\wachkoma\insurgency\hl2.exe" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\insurgency\hl2.exe |
"UDP Query User{C9D3ECF4-2B02-4957-A975-2C2AC29C288F}E:\program files (x86)\game\fifa.exe" = protocol=17 | dir=in | app=e:\program files (x86)\game\fifa.exe |
"UDP Query User{D8B65AC6-6829-4B3A-9257-70ABD59BE558}C:\program files (x86)\quicktime\quicktimeplayer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\quicktime\quicktimeplayer.exe |
"UDP Query User{F1C3B84E-EBEE-463D-AF77-29908A2BA703}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01D57CF6-B5BC-4D03-AFF5-7960CFBD05A9}" = Native Instruments Guitar Rig 5
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0886900B-B2F3-452C-B580-60F1253F7F80}" = Native Instruments Controller Editor
"{0B8565BA-BAD5-4732-B122-5FD78EFC50A9}" = Native Instruments Service Center
"{0E543634-7E25-4B8F-8D5B-97880E5E5088}" = Bonjour
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4700_series" = Canon iP4700 series Printer Driver
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{23170F69-40C1-2702-0465-000001000000}" = 7-Zip 4.65 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417003FF}" = Java(TM) 7 Update 3 (64-bit)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{439760BC-7737-4386-9B1D-A90A3E8A22EA}" = Apple Mobile Device Support
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5552453B-BB76-45E3-973D-F95E458ED780}" = Native Instruments Kontakt 5
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{A792E67C-FDA4-A301-0C3C-53BA86EFBB5A}" = ccc-utility64
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BCF07271-A853-4D3A-B668-4B752174CAA8}" = iTunes
"{C6116410-5EC8-50DE-3F01-A0EC616E2468}" = ATI Catalyst Install Manager
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CFFF260C-F510-45BB-8F8E-1D4AC1232786}" = Adobe Photoshop Lightroom 3.3 64-bit
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"0B8B34F4BB96072BB79F86A0EDC21145F80BC191" = Windows-Treiberpaket - Focusrite USB 2.0 Audio Driver (01/05/2012 2.3.128.0)
"Alien Skin Exposure 3" = Alien Skin Exposure 3
"C-Media Oxygen HD Audio Driver" = ASUS Xonar D1 Audio Driver
"Focusrite USB 2.0 Audio Driver_is1" = Focusrite USB 2.0 Audio Driver 2.3
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"ONAIR_is1" = ONAIR 4.0.0.835
"PhotomatixPro3x64_is1" = Photomatix Pro version 3.2.5
"Recuva" = Recuva
"Sandboxie" = Sandboxie 3.44 (64-bit)
"SearchAnonymizer" = SearchAnonymizer
"VueScan" = VueScan
"Wingnut Lo-Fi" = Wingnut Lo-Fi
"WinRAR archiver" = WinRAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{009AC76E-1A66-4682-82B7-417E77F3C648}" = Superior Drummer Installer
"{00B2E284-0B9A-33B4-7E91-BAFD1E35CAFE}" = TweetDeck
"{0197D136-598D-4968-BEEA-91C1B764F05D}" = Lexware buchhalter 2012
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{03534DA5-2F88-4B8E-A978-849B979E1B8F}" = TuxGuitar
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{063E409E-3D7C-4A4A-95AB-2F124B9224B3}" = ArcSoft PhotoImpression 6
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0F32914F-A633-4516-B531-7084C8F19F93}" = Haufe iDesk-Browser
"{14A487F2-1259-4E6C-AE3C-3C888DDBCB60}_is1" = Guitar Pro 6
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{1923679F-C14B-4790-BC54-EFA3FCDE147B}" = Lexware Elster
"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1D081AB0-B1CC-11E0-80C0-005056B12123}" = Haufe iDesk-Service
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{212D202D-487D-49C4-8A76-4D3BB91B8471}" = BOINC
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 30
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.009.00
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{47CAFF95-C3D8-ABF2-70BC-89DE00D8FB19}" = Catalyst Control Center Graphics Light
"{4962EBAC-AE7C-1B22-1EA0-0916A7E40954}" = Catalyst Control Center Graphics Full Existing
"{49A62E2B-B35C-941D-DF48-601207CF14C0}" = Catalyst Control Center Graphics Previews Common
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{5454083B-1308-4485-BF17-111000028701}" = Grand Theft Auto: Episodes from Liberty City
"{5454083B-1308-4485-BF17-111000028702}" = Grand Theft Auto: Episodes from Liberty City
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5866520C-8857-4986-833A-039F4584C3F7}" = Toontrack solo
"{61B8B2F9-D8DA-4B24-89A9-DB09F38A4899}" = Grand Theft Auto: Episodes From Liberty City
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A490E11-6C8A-777C-4E00-43F3CC16A1EC}" = CCC Help English
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{6DED41BC-C9EF-4330-B4E5-46CB2C5C6E2D}" = No23 Recorder
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser und SDK
"{72736F5F-520D-472A-88CC-7B02872FD34E}" = ATI Catalyst Registration
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{75E607CF-7BAE-4B88-84B3-97F3DF44BA28}" = FEARCombat
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{77919701-C3E7-09AA-D2F7-DBF42CD7C13D}" = Catalyst Control Center HydraVision Full
"{78B2F09F-BDC7-7865-CF4C-233B64A3BE51}" = Catalyst Control Center Graphics Full New
"{79FE9434-81F4-4690-83D0-E0E1722EB7EA}" = Songwriters Pack 3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83AA2913-C123-4146-85BD-AD8F93971D39}" = BabylonObjectInstaller
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.19
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{8967ABFB-CBCA-4EC0-8DE8-A01135267C16}" = EZplayer pro
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140011-0061-0407-0000-0000000FF1CE}" = Microsoft Office Home and Student 2010 - Deutsch
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch
"{AE09704D-9051-4C25-B940-77F889F0C93F}" = OVTScanner_Vista64
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BF460607-4598-40DF-BEF9-62EB9083E887}" = Odd Monster MIDI Fills Pack
"{C0E8FE43-C35B-451D-B35F-D4BD056D70E7}" = Camtasia Studio 7
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C339CB05-05DE-37A1-52C3-5373BF3B662D}" = DestroyTwitter 2
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C670480D-10CE-4E2E-929E-EE453EDE6BE2}" = G Data InternetSecurity 2011
"{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}" = CanoScan Toolbox Ver4.9
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D241BBEC-B1C7-7953-EDDE-D90A654A8D2C}" = ccc-core-static
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D5B18B60-4FC3-42AD-A629-9CA10ACC06CD}" = HTC Sync
"{D5C24E77-099E-9B84-5BE2-708E70B938A9}" = Catalyst Control Center Core Implementation
"{D7F912D4-C237-4079-966A-5044A5025CBF}}_is1" = Focusrite Scarlett Plug-in Suite 1.1
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB1299AF-9EE0-422B-959E-F4171B2AE0F7}" = EZXDfh
"{DBAC777E-23A6-4862-B1F8-414119EA46DF}" = Rock Songs
"{DC4757E2-BAE3-0BFE-C6E5-576CB911FF52}" = Catalyst Control Center Graphics Previews Vista
"{DF344785-0900-471E-B9F5-6F28C89AF638}" = TAXMAN Bibliothek 2012
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E8FF78D0-4D1C-4B2D-AC80-670F135F5461}" = Poladroid
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F30787F6-EA4F-4BC8-0001-398BDCC33E1E}" = MovieSaver*3.0
"{F3C2ECAA-1B4D-4B75-9105-106B0D03EF02}" = Lexware Info Service
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA3FDB06-3368-4579-B2F2-5AE8AD6E7871}" = TAXMAN 2012
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"ABC Amber Audio Converter" = ABC Amber Audio Converter
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Akamai" = Akamai NetSession Interface Service
"Audacity_is1" = Audacity 1.2.6
"AviSynth" = AviSynth 2.5
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"Beneton Movie GIF_is1" = Beneton Movie GIF 1.1.2
"Bome's Mouse Keyboard_is1" = Bome's Mouse Keyboard 2.00
"Canon iP4700 series Benutzerregistrierung" = Canon iP4700 series Benutzerregistrierung
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon Utilities My Printer
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.destroytoday.destroytwitter" = DestroyTwitter 2
"dBpoweramp [Calculate Audio CRC] Codec" = dBpoweramp [Calculate Audio CRC] Codec
"dBpoweramp Dalet Codec" = dBpoweramp Dalet Codec
"dBpoweramp FLAC Codec" = dBpoweramp FLAC Codec
"dBpoweramp m4a Codec" = dBpoweramp m4a Codec
"dBpoweramp Monkeys Audio Codec" = dBpoweramp Monkeys Audio Codec
"dBpoweramp Mp2 and BwfMp2 codec" = dBpoweramp Mp2 and BwfMp2 codec
"dBpoweramp mp3 (Fraunhofer IIS) Codec" = dBpoweramp mp3 (Fraunhofer IIS) Codec
"dBpoweramp Music Converter" = dBpoweramp Music Converter
"dBpoweramp Ogg Vorbis Codec" = dBpoweramp Ogg Vorbis Codec
"dBpoweramp Real Audio (Helix) Encoder" = dBpoweramp Real Audio (Helix) Encoder
"dBPoweramp tooLame MP2 codec" = dBPoweramp tooLame MP2 codec
"dBpoweramp Wave64 Codec" = dBpoweramp Wave64 Codec
"dBpoweramp WavPack Codec" = dBpoweramp WavPack Codec
"ElsterFormular für Privatanwender 12.3.2.6814p" = ElsterFormular für Privatanwender
"FeedReader_is1" = FeedReader
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 5.0.6.221
"FXpansion BFD2" = FXpansion BFD2
"GIF Animator" = Microsoft GIF Animator
"Groove Monkee Power Rock" = Groove Monkee Power Rock
"Groove Monkee Progressive" = Groove Monkee Progressive
"Groove Monkee Rock" = Groove Monkee Rock
"Groove Monkee Rock 3" = Groove Monkee Rock 3
"Guitar Explorer 1.0" = Guitar Explorer 1.0
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"JDownloader" = JDownloader
"LastFM Motorokr Screensaver" = LastFM Motorokr Screensaver
"LoopBe1" = LoopBe1 - Internal MIDI Port
"Magic DVD Ripper_is1" = Magic DVD Ripper V5.5.2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Movies" = Movies
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Native Instruments Controller Editor" = Native Instruments Controller Editor
"Native Instruments Guitar Rig 5" = Native Instruments Guitar Rig 5
"Native Instruments Kontakt 5" = Native Instruments Kontakt 5
"Native Instruments Service Center" = Native Instruments Service Center
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"NirSoft VideoCacheView" = NirSoft VideoCacheView
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"OpenAL" = OpenAL
"PandoraRecovery" = PandoraRecovery (Remove Only)
"pepakura_viewer3en" = Pepakura Viewer 3
"PreSonus Studio One 2" = PreSonus Studio One 2
"Recover My Files_is1" = Recover My Files
"R-Studio 5.2NSIS" = R-Studio 5.2
"SpeedFan" = SpeedFan (remove only)
"Steam App 300" = Day of Defeat: Source
"Steam App 440" = Team Fortress 2
"Steam App 730" = Counter-Strike: Global Offensive Beta
"SUPER ©" = SUPER © Version 2010.bld.38 (May 2, 2010)
"TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1" = TweetDeck
"Ultravnc2_is1" = UltraVnc
"Vidomi" = Vidomi (remove only)
"Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions
"Virtual MIDI Piano Keyboard" = Virtual MIDI Piano Keyboard
"WinLiveSuite" = Windows Live Essentials
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Dropbox" = Dropbox
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
"Spotify" = Spotify
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 07.10.2011 09:06:27 | Computer Name = Lukas-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "e:\program files
(x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
"e:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der
Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
Error - 07.10.2011 18:44:41 | Computer Name = Lukas-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "e:\program files
(x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
"e:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der
Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
Error - 08.10.2011 09:22:28 | Computer Name = Lukas-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information. (Patch task for {90140011-0061-0407-0000-0000000FF1CE}):
DownloadLatest Failed: Die Serververbindung konnte nicht hergestellt werden.
Error - 08.10.2011 11:37:15 | Computer Name = Lukas-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: AmazonMP3Downloader.exe, Version:
1.0.0.0, Zeitstempel: 0x4b5a479c Name des fehlerhaften Moduls: ntdll.dll, Version:
6.1.7600.16695, Zeitstempel: 0x4cc7ab86 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00038db9
ID
des fehlerhaften Prozesses: 0x1280 Startzeit der fehlerhaften Anwendung: 0x01cc85cff6bf7666
Pfad
der fehlerhaften Anwendung: e:\Program Files (x86)\Amazon\MP3 Downloader\AmazonMP3Downloader.exe
Pfad
des fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll Berichtskennung: 65cb5c41-f1c3-11e0-aeb3-e0cb4ec3aad7
Error - 08.10.2011 18:35:55 | Computer Name = Lukas-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "e:\program files
(x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
"e:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der
Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
Error - 09.10.2011 04:37:18 | Computer Name = Lukas-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information. (Patch task for {90140011-0061-0407-0000-0000000FF1CE}):
DownloadLatest Failed: Die Serververbindung konnte nicht hergestellt werden.
Error - 10.10.2011 05:37:54 | Computer Name = Lukas-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information. (Patch task for {90140011-0061-0407-0000-0000000FF1CE}):
DownloadLatest Failed: Die Serververbindung konnte nicht hergestellt werden.
Error - 10.10.2011 10:00:56 | Computer Name = Lukas-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "e:\program files
(x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
"e:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der
Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
Error - 11.10.2011 08:50:04 | Computer Name = Lukas-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information. (Patch task for {90140011-0061-0407-0000-0000000FF1CE}):
DownloadLatest Failed: Die Serververbindung konnte nicht hergestellt werden.
Error - 11.10.2011 15:00:16 | Computer Name = Lukas-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "e:\program files
(x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
"e:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der
Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
[ System Events ]
Error - 17.09.2012 14:20:33 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 17.09.2012 14:20:54 | Computer Name = Lukas-PC | Source = DCOM | ID = 10005
Description =
Error - 17.09.2012 14:20:54 | Computer Name = Lukas-PC | Source = DCOM | ID = 10005
Description =
Error - 17.09.2012 14:20:54 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
< End of report >
|
|
18.09.2012, 02:49
| #2 |
| /// Helfer-Team  | BKA-Trojaner V. 1.15 - Windows 7 64bit Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen. Diese Nacheinander abarbeiten und die 4 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen. Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern mede dies bitte. 1. Schritt Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
SRV - [2012.09.10 21:54:05 | 004,537,664 | ---- | M] () [Auto | Stopped] -- c:\program files (x86)\common files\akamai/netsession_win_5891ae0.dll -- (Akamai)
SRV - [2011.05.26 21:28:56 | 000,040,960 | ---- | M] () [Auto | Stopped] -- C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer)
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157
IE - HKCU\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKCU\..\SearchScopes\{0259B413-E84B-4C02-9409-6D3D00205873}: "URL" = http://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F464F524D3D4945464D3126713D7B7365617263685465726D737D267372633D7B72656665727265723A736F757263653F7D&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&k=0
IE - HKCU\..\SearchScopes\{0BD5909D-F694-4D73-A6F2-E230CF17EA97}: "URL" = http://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{12F10CC7-00CE-420D-911F-96F182B8225B}: "URL" = http://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{2B0E84CC-90FE-4913-B7AF-096971E474A7}: "URL" = http://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{4AFDB8AA-7B4C-41B0-8371-ACBD138A77A2}: "URL" = http://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E636F6E647569742E636F6D2F526573756C74734578742E617370783F713D7B7365617263685465726D737D26536561726368536F757263653D3426637469643D435432333034313537&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&k=0
IE - HKCU\..\SearchScopes\{C0058E40-BD96-4946-A978-D98908C6C9F0}: "URL" = http://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421;
FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=IEFM1&q="
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://de.gopro.com/|http://www.guardian.co.uk/|http://uk.yahoo.com/"
FF - prefs.js..extensions.enabledAddons: artur.dubovoy@gmail.com:3.6.2
FF - prefs.js..extensions.enabledAddons: ffextension@weheartit.com:2.3.1
FF - prefs.js..extensions.enabledAddons: foxmarks@kei.com:4.0.5
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.2
FF - prefs.js..extensions.enabledAddons: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.5
FF - prefs.js..extensions.enabledAddons: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.17
FF - prefs.js..extensions.enabledAddons: {906305f7-aafc-45e9-8bbd-941950a84dad}:1.1.11215.1124
FF - prefs.js..extensions.enabledAddons: {9051303c-7e41-4311-a783-d6fe5ef2832d}:14.0.4
FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.9.10
FF - prefs.js..extensions.enabledItems: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.3
FF - prefs.js..extensions.enabledItems: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.16
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:21.1.10084.997
FF - prefs.js..extensions.enabledItems: X-pireprototype@x-pire.net:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=IEFM1&q="
FF - prefs.js..network.proxy.autoconfig_url: "file:///C:\\Users\\Lukas\\AppData\\Local\\Temp\\proxtube.pac"
FF - prefs.js..network.proxy.type: 0
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
O2 - BHO: (no name) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Lukas\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] e:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe File not found
O4 - HKCU..\Run: [UIRibbon] C:\Users\Lukas\AppData\Local\Microsoft\Windows\1646\UIRibbon.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.04.23 16:38:12 | 000,000,135 | ---- | M] () - F:\autorun.inf -- [ FAT32 ]
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:63238B95
[2011.05.26 21:29:01 | 000,001,123 | ---- | M] () -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\conduit.xml
[2011.05.26 22:27:22 | 000,001,030 | ---- | M] () -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\wikipedia-de.xml
[2012.05.04 10:14:47 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.05.04 10:14:47 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.04 10:14:47 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.04 10:14:47 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.04 10:14:47 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
[2012.08.29 11:52:58 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.09.17 01:15:01 | 000,000,000 | ---D | C] -- C:\Users\Lukas\AppData\Roaming\hellomoto
[2010.06.19 20:43:57 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2012.07.09 19:39:42 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Babylon
:Files
C:\Users\Lukas\AppData\Roaming\Uvbe\
C:\Users\Lukas\AppData\Local\Microsoft\Windows\1646\
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\Lukas\*.tmp
C:\Users\Lukas\AppData\Local\{*}
C:\Users\Lukas\AppData\Local\Temp\*.exe
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
ipconfig /flushdns /c
:Commands
[emptytemp]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! 2. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 3. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
4. Schritt
__________________ |
|
18.09.2012, 15:14
| #3 |
| | BKA-Trojaner V. 1.15 - Windows 7 64bit Hallo,
__________________schonmal vielen Dank. Hier die logs: OTL-Fix: Code:
ATTFilter All processes killed
========== OTL ==========
Service Akamai stopped successfully!
Service Akamai deleted successfully!
c:\program files (x86)\common files\akamai/netsession_win_5891ae0.dll moved successfully.
Service SearchAnonymizer stopped successfully!
Service SearchAnonymizer deleted successfully!
C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0259B413-E84B-4C02-9409-6D3D00205873}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0259B413-E84B-4C02-9409-6D3D00205873}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0BD5909D-F694-4D73-A6F2-E230CF17EA97}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BD5909D-F694-4D73-A6F2-E230CF17EA97}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{12F10CC7-00CE-420D-911F-96F182B8225B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12F10CC7-00CE-420D-911F-96F182B8225B}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2B0E84CC-90FE-4913-B7AF-096971E474A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B0E84CC-90FE-4913-B7AF-096971E474A7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4AFDB8AA-7B4C-41B0-8371-ACBD138A77A2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4AFDB8AA-7B4C-41B0-8371-ACBD138A77A2}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C0058E40-BD96-4946-A978-D98908C6C9F0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C0058E40-BD96-4946-A978-D98908C6C9F0}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "Bing" removed from browser.search.defaultenginename
Prefs.js: "XfireXO Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://www.bing.com/search?FORM=IEFM1&q=" removed from browser.search.defaulturl
Prefs.js: "Wikipedia (de)" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://de.gopro.com/|hxxp://www.guardian.co.uk/|hxxp://uk.yahoo.com/" removed from browser.startup.homepage
Prefs.js: artur.dubovoy@gmail.com:3.6.2 removed from extensions.enabledAddons
Prefs.js: ffextension@weheartit.com:2.3.1 removed from extensions.enabledAddons
Prefs.js: foxmarks@kei.com:4.0.5 removed from extensions.enabledAddons
Prefs.js: ich@maltegoetz.de:1.4.2 removed from extensions.enabledAddons
Prefs.js: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.5 removed from extensions.enabledAddons
Prefs.js: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.17 removed from extensions.enabledAddons
Prefs.js: {906305f7-aafc-45e9-8bbd-941950a84dad}:1.1.11215.1124 removed from extensions.enabledAddons
Prefs.js: {9051303c-7e41-4311-a783-d6fe5ef2832d}:14.0.4 removed from extensions.enabledAddons
Prefs.js: foxmarks@kei.com:3.9.10 removed from extensions.enabledItems
Prefs.js: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.3 removed from extensions.enabledItems
Prefs.js: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.16 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 removed from extensions.enabledItems
Prefs.js: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:21.1.10084.997 removed from extensions.enabledItems
Prefs.js: X-pireprototype@x-pire.net:1.0 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 removed from extensions.enabledItems
Prefs.js: "hxxp://www.bing.com/search?FORM=IEFM1&q=" removed from keyword.URL
Prefs.js: "file:///C:\\Users\\Lukas\\AppData\\Local\\Temp\\proxtube.pac" removed from network.proxy.autoconfig_url
Prefs.js: 0 removed from network.proxy.type
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Ocs_SM deleted successfully.
C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizer.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Akamai NetSession Interface deleted successfully.
C:\Users\Lukas\AppData\Local\Akamai\netsession_win.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\UIRibbon deleted successfully.
C:\Users\Lukas\AppData\Local\Microsoft\Windows\1646\UIRibbon.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
F:\autorun.inf moved successfully.
C:\Windows\SysWow64\tmpF8B0.tmp deleted successfully.
C:\Windows\SysWow64\tmpF8E0.tmp deleted successfully.
ADS C:\ProgramData\Temp:63238B95 deleted successfully.
C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\conduit.xml moved successfully.
C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\wikipedia-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml moved successfully.
C:\Users\Lukas\AppData\Roaming\hellomoto folder moved successfully.
C:\ProgramData\ezsidmv.dat moved successfully.
C:\Users\Lukas\AppData\Roaming\Babylon folder moved successfully.
========== FILES ==========
C:\Users\Lukas\AppData\Roaming\Uvbe folder moved successfully.
C:\Users\Lukas\AppData\Local\Microsoft\Windows\1646 folder moved successfully.
File\Folder C:\ProgramData\*.exe not found.
C:\ProgramData\TEMP folder moved successfully.
File\Folder C:\Users\Lukas\*.tmp not found.
C:\Users\Lukas\AppData\Local\{0B8AB97F-8378-4041-B663-A58D10B77C51} folder moved successfully.
C:\Users\Lukas\AppData\Local\{1E60FB72-9257-40C6-AFB6-CC65D239E74F} folder moved successfully.
C:\Users\Lukas\AppData\Local\Temp\SkypeSetup.exe moved successfully.
C:\Users\Lukas\AppData\Local\Temp\vcredist_x64.exe moved successfully.
C:\Users\Lukas\AppData\Local\Temp\vcredist_x86.exe moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Lukas\Desktop\cmd.bat deleted successfully.
C:\Users\Lukas\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: AppData
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56468 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Lukas
->Temp folder emptied: 15243623 bytes
->Temporary Internet Files folder emptied: 23909379 bytes
->FireFox cache emptied: 95468682 bytes
->Flash cache emptied: 323192 bytes
User: Lukas2
->Temp folder emptied: 114985 bytes
->Temporary Internet Files folder emptied: 33223 bytes
->Flash cache emptied: 56468 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 11211843 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 102360 bytes
RecycleBin emptied: 4805317246 bytes
Total Files Cleaned = 4.722,00 mb
OTL by OldTimer - Version 3.2.61.5 log created on 09182012_141045
Files\Folders moved on Reboot...
C:\Users\Lukas\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Malwarebytes-Log: Code:
ATTFilter Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Datenbank Version: v2012.09.18.02 Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 8.0.7600.16385 Lukas :: LUKAS-PC [Administrator] 18.09.2012 14:19:20 mbam-log-2012-09-18 (14-19-20).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|F:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 682926 Laufzeit: 1 Stunde(n), 1 Minute(n), 14 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\_OTL\MovedFiles\09182012_141045\C_Users\Lukas\AppData\Local\Microsoft\Windows\1646\UIRibbon.exe (Spyware.Password) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) AdwCleaner[R1] Code:
ATTFilter # AdwCleaner v2.002 - Datei am 09/18/2012 um 16:00:12 erstellt
# Aktualisiert am 16/09/2012 von Xplode
# Betriebssystem : Windows 7 Professional (64 bits)
# Benutzer : Lukas - LUKAS-PC
# Bootmodus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\Lukas\Desktop\adwcleaner.exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gefunden : C:\user.js
Ordner Gefunden : C:\Program Files (x86)\Yontoo
Ordner Gefunden : C:\ProgramData\Babylon
Ordner Gefunden : C:\ProgramData\boost_interprocess
Ordner Gefunden : C:\ProgramData\Tarma Installer
Ordner Gefunden : C:\Users\Lukas\AppData\LocalLow\BabylonToolbar
Ordner Gefunden : C:\Users\Lukas\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wp4l5jes.default\Conduit
***** [Registrierungsdatenbank] *****
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\Software\Babylon
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\b
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Products\3192AA38321C641458DBDAF83979D193
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2304157
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Schlüssel Gefunden : HKLM\SOFTWARE\Tarma Installer
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.7600.16385
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v15.0 (de)
Profilname : default
Datei : C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wp4l5jes.default\prefs.js
Gefunden : user_pref("CT2304157.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gefunden : user_pref("CT2304157.CTID", "CT2304157");
Gefunden : user_pref("CT2304157.CurrentServerDate", "4-3-2010");
Gefunden : user_pref("CT2304157.DialogsAlignMode", "LTR");
Gefunden : user_pref("CT2304157.FeedLastCount129078895246717929", 20);
Gefunden : user_pref("CT2304157.FeedLastCount129095439763593837", 20);
Gefunden : user_pref("CT2304157.FeedPollDate129078895250311712", "Thu Mar 04 2010 15:06:07 GMT+0100");
Gefunden : user_pref("CT2304157.FeedPollDate129095439763593837", "Thu Mar 04 2010 15:06:07 GMT+0100");
Gefunden : user_pref("CT2304157.FeedTTL129078895250311712", 40);
Gefunden : user_pref("CT2304157.FirstServerDate", "4-3-2010");
Gefunden : user_pref("CT2304157.FirstTime", true);
Gefunden : user_pref("CT2304157.FirstTimeFF3", true);
Gefunden : user_pref("CT2304157.GroupingServerCheckInterval", 1440);
Gefunden : user_pref("CT2304157.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gefunden : user_pref("CT2304157.Initialize", true);
Gefunden : user_pref("CT2304157.InitializeCommonPrefs", true);
Gefunden : user_pref("CT2304157.InstalledDate", "Thu Mar 04 2010 15:06:13 GMT+0100");
Gefunden : user_pref("CT2304157.IsGrouping", false);
Gefunden : user_pref("CT2304157.IsMulticommunity", false);
Gefunden : user_pref("CT2304157.IsOpenThankYouPage", true);
Gefunden : user_pref("CT2304157.IsOpenUninstallPage", true);
Gefunden : user_pref("CT2304157.LanguagePackLastCheckTime", "Thu Mar 04 2010 15:06:12 GMT+0100");
Gefunden : user_pref("CT2304157.LanguagePackReloadIntervalMM", 1440);
Gefunden : user_pref("CT2304157.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gefunden : user_pref("CT2304157.LastLogin_2.5.6.0", "Thu Mar 04 2010 15:06:15 GMT+0100");
Gefunden : user_pref("CT2304157.LatestVersion", "2.1.0.18");
Gefunden : user_pref("CT2304157.Locale", "en");
Gefunden : user_pref("CT2304157.LoginCache", 4);
Gefunden : user_pref("CT2304157.MCDetectTooltipHeight", "83");
Gefunden : user_pref("CT2304157.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gefunden : user_pref("CT2304157.MCDetectTooltipWidth", "295");
Gefunden : user_pref("CT2304157.SHRINK_TOOLBAR", 1);
Gefunden : user_pref("CT2304157.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Gefunden : user_pref("CT2304157.SearchFromAddressBarIsInit", true);
Gefunden : user_pref("CT2304157.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT230[...]
Gefunden : user_pref("CT2304157.SearchInNewTabEnabled", true);
Gefunden : user_pref("CT2304157.SearchInNewTabIntervalMM", 1440);
Gefunden : user_pref("CT2304157.SearchInNewTabLastCheckTime", "Thu Mar 04 2010 15:06:15 GMT+0100");
Gefunden : user_pref("CT2304157.SearchInNewTabServiceUrl", "hxxp://hosting.conduit-services.com/newtab/?ctid=EB[...]
Gefunden : user_pref("CT2304157.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Gefunden : user_pref("CT2304157.SettingsCheckIntervalMin", 120);
Gefunden : user_pref("CT2304157.SettingsLastCheckTime", "Thu Mar 04 2010 15:06:06 GMT+0100");
Gefunden : user_pref("CT2304157.SettingsLastUpdate", "1267047404");
Gefunden : user_pref("CT2304157.ThirdPartyComponentsInterval", 504);
Gefunden : user_pref("CT2304157.ThirdPartyComponentsLastCheck", "Thu Mar 04 2010 15:06:06 GMT+0100");
Gefunden : user_pref("CT2304157.ThirdPartyComponentsLastUpdate", "1267047404");
Gefunden : user_pref("CT2304157.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]
Gefunden : user_pref("CT2304157.Uninstall", true);
Gefunden : user_pref("CT2304157.UserID", "UN98113723905454135");
Gefunden : user_pref("CT2304157.alertChannelId", "700614");
Gefunden : user_pref("CT2304157.clientLogIsEnabled", false);
Gefunden : user_pref("CT2304157.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Gefunden : user_pref("CT2304157.myStuffEnabled", true);
Gefunden : user_pref("CT2304157.myStuffPublihserMinWidth", 400);
Gefunden : user_pref("CT2304157.myStuffSearchUrl", "hxxp://search.conduit.com/Results.aspx?q=SEARCH_TERM&ctid=E[...]
Gefunden : user_pref("CT2304157.myStuffServiceIntervalMM", 1440);
Gefunden : user_pref("CT2304157.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gefunden : user_pref("CT2304157.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Gefunden : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Gefunden : user_pref("CommunityToolbar.ToolbarsList", "CT2304157");
Gefunden : user_pref("CommunityToolbar.ToolbarsList2", "CT2304157");
Gefunden : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2304157");
Gefunden : user_pref("CommunityToolbar.twitter.user_21817319.LastCheckTime", "Thu Mar 04 2010 15:06:07 GMT+0100[...]
Gefunden : user_pref("FlashVD.cache.video", "hxxp://vids.myspace.com\nhxxp://www.yourfilehost.com\nhxxp://www.m[...]
Gefunden : user_pref("extensions.BabylonToolbar.admin", false);
Gefunden : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gefunden : user_pref("extensions.BabylonToolbar.babExt", "");
Gefunden : user_pref("extensions.BabylonToolbar.babTrack", "affID=109683&tt=010712_7");
Gefunden : user_pref("extensions.BabylonToolbar.bbDpng", 9);
Gefunden : user_pref("extensions.BabylonToolbar.dfltSrch", false);
Gefunden : user_pref("extensions.BabylonToolbar.hmpg", false);
Gefunden : user_pref("extensions.BabylonToolbar.id", "74f0d57a000000000000e0cb4ec3aad7");
Gefunden : user_pref("extensions.BabylonToolbar.instlDay", "15530");
Gefunden : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gefunden : user_pref("extensions.BabylonToolbar.lastDP", 9);
Gefunden : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1719:40:13");
Gefunden : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "13.0");
Gefunden : user_pref("extensions.BabylonToolbar.newTab", true);
Gefunden : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");
Gefunden : user_pref("extensions.BabylonToolbar.noFFXTlbr", false);
Gefunden : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gefunden : user_pref("extensions.BabylonToolbar.propectorlck", 80415650);
Gefunden : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gefunden : user_pref("extensions.BabylonToolbar.ptch_0717", true);
Gefunden : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Gefunden : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Gefunden : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Gefunden : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");
Gefunden : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1719:40:13");
Gefunden : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");
Gefunden : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Gefunden : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gefunden : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109683&tt=010712_7");
Gefunden : user_pref("extensions.BabylonToolbar_i.hardId", "74f0d57a000000000000e0cb4ec3aad7");
Gefunden : user_pref("extensions.BabylonToolbar_i.id", "74f0d57a000000000000e0cb4ec3aad7");
Gefunden : user_pref("extensions.BabylonToolbar_i.instlDay", "15530");
Gefunden : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Gefunden : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Gefunden : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Gefunden : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gefunden : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gefunden : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Gefunden : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Gefunden : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1719:40:13");
Gefunden : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
*************************
AdwCleaner[R1].txt - [14415 octets] - [18/09/2012 16:00:12]
########## EOF - C:\AdwCleaner[R1].txt - [14476 octets] ##########
AdwCleaner[S1] Code:
ATTFilter # AdwCleaner v2.002 - Datei am 09/18/2012 um 16:00:56 erstellt
# Aktualisiert am 16/09/2012 von Xplode
# Betriebssystem : Windows 7 Professional (64 bits)
# Benutzer : Lukas - LUKAS-PC
# Bootmodus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\Lukas\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\user.js
Ordner Gelöscht : C:\Program Files (x86)\Yontoo
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Users\Lukas\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\Lukas\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wp4l5jes.default\Conduit
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\b
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Products\3192AA38321C641458DBDAF83979D193
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2304157
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Tarma Installer
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.7600.16385
Wiederhergestellt : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
-\\ Mozilla Firefox v15.0 (de)
Profilname : default
Datei : C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wp4l5jes.default\prefs.js
C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wp4l5jes.default\user.js ... Gelöscht !
Gelöscht : user_pref("CT2304157.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gelöscht : user_pref("CT2304157.CTID", "CT2304157");
Gelöscht : user_pref("CT2304157.CurrentServerDate", "4-3-2010");
Gelöscht : user_pref("CT2304157.DialogsAlignMode", "LTR");
Gelöscht : user_pref("CT2304157.FeedLastCount129078895246717929", 20);
Gelöscht : user_pref("CT2304157.FeedLastCount129095439763593837", 20);
Gelöscht : user_pref("CT2304157.FeedPollDate129078895250311712", "Thu Mar 04 2010 15:06:07 GMT+0100");
Gelöscht : user_pref("CT2304157.FeedPollDate129095439763593837", "Thu Mar 04 2010 15:06:07 GMT+0100");
Gelöscht : user_pref("CT2304157.FeedTTL129078895250311712", 40);
Gelöscht : user_pref("CT2304157.FirstServerDate", "4-3-2010");
Gelöscht : user_pref("CT2304157.FirstTime", true);
Gelöscht : user_pref("CT2304157.FirstTimeFF3", true);
Gelöscht : user_pref("CT2304157.GroupingServerCheckInterval", 1440);
Gelöscht : user_pref("CT2304157.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gelöscht : user_pref("CT2304157.Initialize", true);
Gelöscht : user_pref("CT2304157.InitializeCommonPrefs", true);
Gelöscht : user_pref("CT2304157.InstalledDate", "Thu Mar 04 2010 15:06:13 GMT+0100");
Gelöscht : user_pref("CT2304157.IsGrouping", false);
Gelöscht : user_pref("CT2304157.IsMulticommunity", false);
Gelöscht : user_pref("CT2304157.IsOpenThankYouPage", true);
Gelöscht : user_pref("CT2304157.IsOpenUninstallPage", true);
Gelöscht : user_pref("CT2304157.LanguagePackLastCheckTime", "Thu Mar 04 2010 15:06:12 GMT+0100");
Gelöscht : user_pref("CT2304157.LanguagePackReloadIntervalMM", 1440);
Gelöscht : user_pref("CT2304157.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gelöscht : user_pref("CT2304157.LastLogin_2.5.6.0", "Thu Mar 04 2010 15:06:15 GMT+0100");
Gelöscht : user_pref("CT2304157.LatestVersion", "2.1.0.18");
Gelöscht : user_pref("CT2304157.Locale", "en");
Gelöscht : user_pref("CT2304157.LoginCache", 4);
Gelöscht : user_pref("CT2304157.MCDetectTooltipHeight", "83");
Gelöscht : user_pref("CT2304157.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gelöscht : user_pref("CT2304157.MCDetectTooltipWidth", "295");
Gelöscht : user_pref("CT2304157.SHRINK_TOOLBAR", 1);
Gelöscht : user_pref("CT2304157.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Gelöscht : user_pref("CT2304157.SearchFromAddressBarIsInit", true);
Gelöscht : user_pref("CT2304157.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT230[...]
Gelöscht : user_pref("CT2304157.SearchInNewTabEnabled", true);
Gelöscht : user_pref("CT2304157.SearchInNewTabIntervalMM", 1440);
Gelöscht : user_pref("CT2304157.SearchInNewTabLastCheckTime", "Thu Mar 04 2010 15:06:15 GMT+0100");
Gelöscht : user_pref("CT2304157.SearchInNewTabServiceUrl", "hxxp://hosting.conduit-services.com/newtab/?ctid=EB[...]
Gelöscht : user_pref("CT2304157.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Gelöscht : user_pref("CT2304157.SettingsCheckIntervalMin", 120);
Gelöscht : user_pref("CT2304157.SettingsLastCheckTime", "Thu Mar 04 2010 15:06:06 GMT+0100");
Gelöscht : user_pref("CT2304157.SettingsLastUpdate", "1267047404");
Gelöscht : user_pref("CT2304157.ThirdPartyComponentsInterval", 504);
Gelöscht : user_pref("CT2304157.ThirdPartyComponentsLastCheck", "Thu Mar 04 2010 15:06:06 GMT+0100");
Gelöscht : user_pref("CT2304157.ThirdPartyComponentsLastUpdate", "1267047404");
Gelöscht : user_pref("CT2304157.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]
Gelöscht : user_pref("CT2304157.Uninstall", true);
Gelöscht : user_pref("CT2304157.UserID", "UN98113723905454135");
Gelöscht : user_pref("CT2304157.alertChannelId", "700614");
Gelöscht : user_pref("CT2304157.clientLogIsEnabled", false);
Gelöscht : user_pref("CT2304157.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Gelöscht : user_pref("CT2304157.myStuffEnabled", true);
Gelöscht : user_pref("CT2304157.myStuffPublihserMinWidth", 400);
Gelöscht : user_pref("CT2304157.myStuffSearchUrl", "hxxp://search.conduit.com/Results.aspx?q=SEARCH_TERM&ctid=E[...]
Gelöscht : user_pref("CT2304157.myStuffServiceIntervalMM", 1440);
Gelöscht : user_pref("CT2304157.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gelöscht : user_pref("CT2304157.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT2304157");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2304157");
Gelöscht : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2304157");
Gelöscht : user_pref("CommunityToolbar.twitter.user_21817319.LastCheckTime", "Thu Mar 04 2010 15:06:07 GMT+0100[...]
Gelöscht : user_pref("FlashVD.cache.video", "hxxp://vids.myspace.com\nhxxp://www.yourfilehost.com\nhxxp://www.m[...]
Gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar.babTrack", "affID=109683&tt=010712_7");
Gelöscht : user_pref("extensions.BabylonToolbar.bbDpng", 9);
Gelöscht : user_pref("extensions.BabylonToolbar.dfltSrch", false);
Gelöscht : user_pref("extensions.BabylonToolbar.hmpg", false);
Gelöscht : user_pref("extensions.BabylonToolbar.id", "74f0d57a000000000000e0cb4ec3aad7");
Gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15530");
Gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar.lastDP", 9);
Gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1719:40:13");
Gelöscht : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "13.0");
Gelöscht : user_pref("extensions.BabylonToolbar.newTab", true);
Gelöscht : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");
Gelöscht : user_pref("extensions.BabylonToolbar.noFFXTlbr", false);
Gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar.propectorlck", 80415650);
Gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar.ptch_0717", true);
Gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1719:40:13");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");
Gelöscht : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109683&tt=010712_7");
Gelöscht : user_pref("extensions.BabylonToolbar_i.hardId", "74f0d57a000000000000e0cb4ec3aad7");
Gelöscht : user_pref("extensions.BabylonToolbar_i.id", "74f0d57a000000000000e0cb4ec3aad7");
Gelöscht : user_pref("extensions.BabylonToolbar_i.instlDay", "15530");
Gelöscht : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1719:40:13");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
*************************
AdwCleaner[R1].txt - [14530 octets] - [18/09/2012 16:00:12]
AdwCleaner[S1].txt - [15234 octets] - [18/09/2012 16:00:56]
########## EOF - C:\AdwCleaner[S1].txt - [15295 octets] ##########
Lg jar31 |
|
19.09.2012, 17:37
| #4 |
| /// Helfer-Team | BKA-Trojaner V. 1.15 - Windows 7 64bit Sehr gut!  Wie laeuft der Rechner? Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html |
|
20.09.2012, 15:41
| #5 |
| | BKA-Trojaner V. 1.15 - Windows 7 64bit Pc läuft soweit gut und ohne Probleme im normalen Windows Modus. Hier der Log: Code:
ATTFilter Emsisoft Anti-Malware - Version 7.0
Letztes Update: 20.09.2012 14:08:53
Scan Einstellungen:
Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, E:\, Q:\
Riskware-Erkennung: Aus
Archiv Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus
Scan Beginn: 20.09.2012 14:09:22
Gescannt 776315
Gefunden 0
Scan Ende: 20.09.2012 16:25:04
Scan Zeit: 2:15:42
|
|
21.09.2012, 19:40
| #6 |
| /// Helfer-Team | BKA-Trojaner V. 1.15 - Windows 7 64bit Sehr gut! Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
__________________ --> BKA-Trojaner V. 1.15 - Windows 7 64bit |
|
22.09.2012, 17:06
| #7 |
| | BKA-Trojaner V. 1.15 - Windows 7 64bit ESET Log: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=02a5596acd97d741b2de70536559432d
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-22 04:01:55
# local_time=2012-09-22 06:01:55 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=4096 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776573 100 94 176648 99948853 0 0
# compatibility_mode=8192 67108863 100 0 350 350 0 0
# scanned=606613
# found=1
# cleaned=1
# scan_time=10712
C:\_OTL\MovedFiles\09182012_141045\C_Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\1620ca11-4f0ac0a9 multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
lg, jar31 |
|
22.09.2012, 20:05
| #8 |
| /// Helfer-Team | BKA-Trojaner V. 1.15 - Windows 7 64bit Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck Java deaktivieren Aufgrund derezeitigen Sicherheitsluecke: http://www.trojaner-board.de/122961-...ktivieren.html Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck |
|
22.09.2012, 22:22
| #9 |
| | BKA-Trojaner V. 1.15 - Windows 7 64bit Hallo, Code:
ATTFilter PluginCheck
Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.
Firefox 15.0.1 ist aktuell
Flash 11,0,1,152 ist veraltet!
Aktualisieren Sie bitte auf die neueste Version!
Java (1,7,0,7) ist aktuell.
Adobe Reader 9,4,3,231 ist veraltet!
Aktualisieren Sie bitte auf die neueste Version: 10,1,3
Code:
ATTFilter PluginCheck
Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.
Firefox 15.0.1 ist aktuell
Flash 11,0,1,152 ist veraltet!
Aktualisieren Sie bitte auf die neueste Version!
Java ist Installiert aber nicht aktiviert.
Adobe Reader 9,4,3,231 ist veraltet!
Aktualisieren Sie bitte auf die neueste Version: 10,1,3
Ich nehme mal an, ich soll meine Flash & Adobe Reader Version aktualisieren? // Edit: Habe jetzt mal alles aktualisiert: Code:
ATTFilter PluginCheck
Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.
Firefox 15.0.1 ist aktuell
Flash (11,4,402,278) ist aktuell.
Java ist Installiert aber nicht aktiviert.
Adobe Reader 10,1,4,38 ist aktuell.
Geändert von jar31 (22.09.2012 um 22:35 Uhr) |
|
25.09.2012, 11:20
| #10 |
| /// Helfer-Team | BKA-Trojaner V. 1.15 - Windows 7 64bit Sehr gut! damit bist Du sauber und entlassen!  adwCleaner entfernen
Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Zurücksetzen der Sicherheitszonen Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen. Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html Systemwiederherstellungen leeren Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein: Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7 Danach wieder aktivieren. Aufräumen mit CCleaner Lasse mit CCleaner (Download) (Anleitung) Fehler in der
Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html PC wird immer langsamer - was tun? |
|
25.09.2012, 12:05
| #11 |
| | BKA-Trojaner V. 1.15 - Windows 7 64bit Super! - vielen Dank :-) |
|
| Themen zu BKA-Trojaner V. 1.15 - Windows 7 64bit |
| 7-zip, antivirus, audacity, bankguard, bho, bildschirm, black, bonjour, canon, converter, error, failed, fehler, festplatte, firefox, flash player, grand theft auto, install.exe, jdownloader, logfile, mozilla, ntdll.dll, object, plug-in, progressive, realtek, recuva, registry, richtlinie, safer networking, scan, security, sierra, software, spotify web helper, starten, svchost.exe, system, taskmanager, trojaner, usb 2.0, vdeck.exe, windows, yontoo |
Linear-Darstellung
