| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Wie bekomme ich ChatZum von meinem Computer?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
02.10.2012, 13:32
| #1 |
 |  Wie bekomme ich ChatZum von meinem Computer? Ich habe mir wohl ChatZum eingefangen. Leider kann ich es unter Systemsteuerung nicht deinstallieren, dort kommt als Option nur ändern. Habe schon versucht alle Dateien, die mit chatzum zu tun haben zu löschen, aber die tool bar ist noch immer da und zwar sowohl im firefox als auch im explorer. Hier mein OTL:OTL Logfile: Code:
ATTFilter OTL logfile created on: 10/2/2012 2:01:51 PM - Run 1 OTL by OldTimer - Version 3.2.70.1 Folder = C:\Users\Svenja\Desktop Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2.99 Gb Total Physical Memory | 1.73 Gb Available Physical Memory | 58.00% Memory free 5.98 Gb Paging File | 4.00 Gb Available in Paging File | 66.88% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 141.49 Gb Total Space | 53.61 Gb Free Space | 37.89% Space Free | Partition Type: NTFS Drive D: | 141.50 Gb Total Space | 67.08 Gb Free Space | 47.40% Space Free | Partition Type: NTFS Computer Name: AINHOA | User Name: Svenja | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Svenja\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Users\Svenja\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) PRC - C:\Program Files\ChatZum Toolbar\tbunsvF45B.tmp\TbHelper2.exe () PRC - C:\Program Files\PDF24\pdf24.exe (Geek Software GmbH) PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation) PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Windows\System32\HPSIsvc.exe (HP) PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10h_ActiveX.exe (Adobe Systems, Inc.) PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\PROGRA~1\samsung\SAMSUN~2\SUPNOT~1.EXE () PRC - C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (SEC) PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.) PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (SAMSUNG Electronics) PRC - C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone) PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Optimization Client\bmctl.exe (Bytemobile, Inc.) PRC - C:\Windows\System32\Rezip.exe () PRC - C:\Windows\System32\spool\drivers\w32x86\3\E_FATIBEE.EXE (SEIKO EPSON CORPORATION) PRC - C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE (SEIKO EPSON CORPORATION) ========== Modules (No Company Name) ========== MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8b7a7f9c607e09bfa03c07b5ff3a8ae3\System.ServiceProcess.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\3f9dee1ce0ccb42145293a5bfcbe7205\System.Management.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\61fbbd8bc7d76972115b292b132ff2d1\System.Transactions.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\294d439cfe959b5528ca81d37d3d502f\System.Data.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\61af058c2bc079f28397a29ed145fbc7\System.Security.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll () MOD - C:\Program Files\ChatZum Toolbar\tbunsvF45B.tmp\TbHelper2.exe () MOD - C:\Program Files\ChatZum Toolbar\tbunsvF45B.tmp\TbCommonUtils.dll () MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll () MOD - C:\windows\assembly\GAC\Interop.SHDocVw\1.1.0.0__4b827ebe229d539f\Interop.SHDocVw.dll () MOD - C:\windows\assembly\GAC_32\Asz.Citavi.IEPicker\1.0.0.0__f59eabe05cc67589\Asz.Citavi.IEPicker.dll () MOD - C:\Program Files\OpenOffice.org 3\program\libxslt.dll () MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll () MOD - C:\PROGRA~1\samsung\SAMSUN~2\SUPNOT~1.EXE () MOD - C:\PROGRA~1\samsung\SAMSUN~2\HMXML.dll () MOD - C:\windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll () MOD - C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Windows\System32\msjetoledb40.dll () MOD - C:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll () MOD - C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll () MOD - C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll () MOD - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll () MOD - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () ========== Services (SafeList) ========== SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (HPSIService) -- C:\Windows\System32\HPSIsvc.exe (HP) SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.) SRV - (VMCService) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (Rezip) -- C:\Windows\System32\Rezip.exe () SRV - (EPSON_PM_RPCV4_01) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE (SEIKO EPSON CORPORATION) ========== Driver Services (SafeList) ========== DRV - (vpnva) -- system32\DRIVERS\vpnva.sys File not found DRV - (hwusbfake) -- system32\DRIVERS\ewusbfake.sys File not found DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (mvusbews) -- C:\Windows\System32\drivers\mvusbews.sys (Marvell Semiconductor, Inc.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.) DRV - (Impcd) -- C:\Windows\System32\drivers\Impcd.sys (Intel Corporation) DRV - (hwusbdev) -- C:\Windows\System32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.) DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys () DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation) DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (CryptOSD) -- C:\Windows\System32\drivers\CryptOSD.sys (Phoenix Technologies Ltd.) DRV - (BMLoad) -- C:\Windows\System32\drivers\BMLoad.sys (Bytemobile, Inc.) DRV - (tcpipBM) -- C:\windows\System32\drivers\tcpipBM.sys (Bytemobile, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.chatzum.com/ IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://search.chatzum.com/?q={searchTerms} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=TJ&userid=c4bb1c42-6afa-4aa9-a69d-769c87fd7ed1&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=TJ&userid=c4bb1c42-6afa-4aa9-a69d-769c87fd7ed1&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.chatzum.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=TJ&userid=c4bb1c42-6afa-4aa9-a69d-769c87fd7ed1&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=TJ&userid=c4bb1c42-6afa-4aa9-a69d-769c87fd7ed1&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\ChatZum Toolbar\tbunsvF45B.tmp\tbhelper.dll () IE - HKCU\..\SearchScopes,DefaultScope = {96bd48dd-741b-41ae-ac4a-aff96ba00f7e} IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://search.chatzum.com/?q={searchTerms} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = hxxp://search.chatzum.com/?q={SearchTerms} IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\..\SearchScopes\{DBDFC5E5-E6ED-4A2B-A093-889253A7FAD2}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=87837D07-3F70-45E9-B5DC-3701AAB357B7&apn_sauid=B4096E54-DEC7-48A4-AEDD-C981C0ED6058 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://searchsafer.com/" FF - prefs.js..extensions.enabledItems: helperbar@helperbar.com:1.0 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198 FF - prefs.js..extensions.enabledItems: {8AA36F4F-6DC7-4c06-77AF-5035170634FE}:2010.01.21 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6 FF - prefs.js..keyword.URL: "hxxp://utils.chatzum.com/?url=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\Vodafone\Vodafone Mobile Connect\Optimization Client\addon\ [2011/08/12 20:15:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/06/22 20:18:29 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010/06/10 18:06:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Svenja\AppData\Roaming\mozilla\Extensions [2012/10/02 13:05:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Svenja\AppData\Roaming\mozilla\Firefox\Profiles\fqelcgji.default\extensions [2012/07/31 14:03:54 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Svenja\AppData\Roaming\mozilla\Firefox\Profiles\fqelcgji.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012/07/26 08:36:52 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Svenja\AppData\Roaming\mozilla\firefox\profiles\fqelcgji.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012/09/03 17:39:51 | 000,002,299 | ---- | M] () -- C:\Users\Svenja\AppData\Roaming\mozilla\firefox\profiles\fqelcgji.default\searchplugins\askcom.xml [2010/06/08 11:29:10 | 000,000,927 | ---- | M] () -- C:\Users\Svenja\AppData\Roaming\mozilla\firefox\profiles\fqelcgji.default\searchplugins\conduit.xml [2012/10/02 12:34:05 | 000,000,642 | ---- | M] () -- C:\Users\Svenja\AppData\Roaming\mozilla\firefox\profiles\fqelcgji.default\searchplugins\search-safer.xml [2012/09/05 15:28:58 | 000,015,677 | ---- | M] () -- C:\Users\Svenja\AppData\Roaming\mozilla\firefox\profiles\fqelcgji.default\searchplugins\Web Search.xml [2012/10/02 13:25:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions [2010/06/20 12:59:45 | 000,000,000 | ---D | M] ("Citavi Picker") -- C:\Program Files\mozilla firefox\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE} [2010/06/10 18:13:36 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} ========== Chrome ========== CHR - default_search_provider: () CHR - default_search_provider: search_url = CHR - default_search_provider: suggest_url = CHR - Extension: No name found = C:\Users\Svenja\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnpmlnedpdikbgdghljdepnljfpkhccn\1.0.0_0\ CHR - Extension: No name found = C:\Users\Svenja\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.0.900_0\ CHR - Extension: No name found = C:\Users\Svenja\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbpcjmidkkgldeplajgnbpjkfpmpeepb\1.0.6_0\ CHR - Extension: No name found = C:\Users\Svenja\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.0.900_0\ O1 HOSTS File: ([2012/06/20 12:48:32 | 000,000,861 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 134.95.7.4 vpngate.uni-koeln.de O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (TBSB09850 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\ChatZum Toolbar\tbunsvF45B.tmp\tbcore3.dll () O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll () O3 - HKLM\..\Toolbar: (ChatZum Toolbar) - {37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} - C:\Program Files\ChatZum Toolbar\tbunsvF45B.tmp\tbcore3.dll () O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [APLangApp] C:\Program Files\AnyPC Client\APLangApp.exe (DoctorSoft) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DivX Download Manager] "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start File not found O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.) O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PDFPrint] C:\Program Files\PDF24\pdf24.exe (Geek Software GmbH) O4 - HKCU..\Run: [EPSON Stylus DX4000 Series] C:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE (SEIKO EPSON CORPORATION) O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\windows\System32\Macromed\Flash\FlashUtil11g_Plugin.exe (Adobe Systems, Inc.) O4 - Startup: C:\Users\Svenja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Svenja\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O4 - Startup: C:\Users\Svenja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: &Citavi Picker... - C:\Program Files\Internet Explorer\PLUGINS\Citavi Picker\ShowContextMenu.html () O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Free YouTube Download - C:\Users\Svenja\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.7.2) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Unable to open value key) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{25E5EC99-7CB0-4BB6-8BCE-20C4774EC441}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2F25D5C4-4424-4C27-87BC-F4D72E857695}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3269D983-67ED-432E-81E0-FB82FE7FD53C}: NameServer = 193.189.244.225 193.189.244.206 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CC1D0B97-808D-4314-B978-D70926A2E3CF}: NameServer = 193.189.244.225 193.189.244.206 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EBDFAB2B-910A-440B-9C10-99BB89CE3500}: NameServer = 193.189.244.225 193.189.244.206 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{16cc7e69-02eb-11e1-86a6-98b2ad46e3f0}\Shell - "" = AutoRun O33 - MountPoints2\{16cc7e69-02eb-11e1-86a6-98b2ad46e3f0}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{2568d08a-bac8-11e1-96f4-959cd4929d8c}\Shell - "" = AutoRun O33 - MountPoints2\{2568d08a-bac8-11e1-96f4-959cd4929d8c}\Shell\AutoRun\command - "" = F:\Startme.exe O33 - MountPoints2\{67670b30-f4e1-11e0-971b-c2e30368c5f6}\Shell - "" = AutoRun O33 - MountPoints2\{67670b30-f4e1-11e0-971b-c2e30368c5f6}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{71a17970-3d5a-11e1-914f-9cf8d9222817}\Shell - "" = AutoRun O33 - MountPoints2\{71a17970-3d5a-11e1-914f-9cf8d9222817}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{71a17986-3d5a-11e1-914f-9cf8d9222817}\Shell - "" = AutoRun O33 - MountPoints2\{71a17986-3d5a-11e1-914f-9cf8d9222817}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{73538194-41e8-11e1-a285-a07adf532287}\Shell - "" = AutoRun O33 - MountPoints2\{73538194-41e8-11e1-a285-a07adf532287}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{735381b8-41e8-11e1-a285-a07adf532287}\Shell - "" = AutoRun O33 - MountPoints2\{735381b8-41e8-11e1-a285-a07adf532287}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{958a3554-c502-11e0-b9a2-c426a42505fd}\Shell - "" = AutoRun O33 - MountPoints2\{958a3554-c502-11e0-b9a2-c426a42505fd}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{ef622c49-c5e2-11e0-8f8b-da345cb110e6}\Shell - "" = AutoRun O33 - MountPoints2\{ef622c49-c5e2-11e0-8f8b-da345cb110e6}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012/10/02 13:55:14 | 000,600,064 | ---- | C] (OldTimer Tools) -- C:\Users\Svenja\Desktop\OTL.exe [2012/10/02 12:51:35 | 000,000,000 | ---D | C] -- C:\Users\Svenja\eTeks [2012/10/02 12:41:36 | 000,000,000 | ---D | C] -- C:\Program Files\Softonic [2012/10/02 12:40:06 | 032,741,848 | ---- | C] (eTeks ) -- C:\Users\Svenja\Desktop\SweetHome3D-3.6-windows-oc.exe [2012/10/02 12:33:00 | 000,000,000 | ---D | C] -- C:\Program Files\ChatZum Toolbar [2012/10/02 12:32:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IKEA HomePlanner [2012/10/02 12:32:35 | 000,000,000 | ---D | C] -- C:\Program Files\IKEA HomePlanner [2012/10/02 12:32:06 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2012/09/23 13:18:07 | 000,000,000 | -H-D | C] -- C:\windows\AxInstSV [2012/09/22 12:52:15 | 000,627,200 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeeds.dll [2012/09/22 12:52:13 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mstime.dll [2012/09/22 12:52:13 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iedkcs32.dll [2012/09/22 12:52:13 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieui.dll [2012/09/22 12:52:12 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iepeers.dll [2012/09/22 12:52:12 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeedsbs.dll [2012/09/22 12:52:11 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtml.tlb [2012/09/22 12:52:11 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\html.iec [2012/09/22 12:52:11 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\url.dll [2012/09/22 12:52:11 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jsproxy.dll [2012/09/22 12:52:11 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\licmgr10.dll [2012/09/22 12:52:11 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeedssync.exe [2012/09/13 08:14:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012/09/13 08:14:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2012/09/05 15:26:14 | 000,197,632 | ---- | C] (CANON INC.) -- C:\windows\System32\CNMLM78.DLL [2012/09/03 17:29:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Ask [2012/09/03 17:29:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2012/09/03 17:24:39 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\windows\System32\javaws.exe [2012/09/03 17:24:29 | 000,093,672 | ---- | C] (Oracle Corporation) -- C:\windows\System32\WindowsAccessBridge.dll [1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/10/02 14:00:24 | 000,302,592 | ---- | M] () -- C:\Users\Svenja\Desktop\qqgy4u6z.exe [2012/10/02 13:55:21 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Svenja\Desktop\OTL.exe [2012/10/02 13:55:00 | 000,001,098 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job [2012/10/02 13:53:44 | 000,000,120 | ---- | M] () -- C:\Users\Svenja\Desktop\redirect-to.htm [2012/10/02 12:41:39 | 000,000,109 | ---- | M] () -- C:\user.js [2012/10/02 12:40:23 | 032,741,848 | ---- | M] (eTeks ) -- C:\Users\Svenja\Desktop\SweetHome3D-3.6-windows-oc.exe [2012/10/02 12:32:40 | 000,002,523 | ---- | M] () -- C:\Users\Public\Desktop\IKEA Home Planner.lnk [2012/10/02 12:32:03 | 020,488,704 | ---- | M] () -- C:\Users\Svenja\Desktop\IKEA_Home_Planner_FY10.exe [2012/10/02 10:30:53 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2012/10/01 18:55:00 | 000,001,094 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2012/09/27 15:50:16 | 000,643,866 | ---- | M] () -- C:\windows\System32\perfh007.dat [2012/09/27 15:50:16 | 000,607,190 | ---- | M] () -- C:\windows\System32\perfh009.dat [2012/09/27 15:50:16 | 000,126,394 | ---- | M] () -- C:\windows\System32\perfc007.dat [2012/09/27 15:50:16 | 000,103,568 | ---- | M] () -- C:\windows\System32\perfc009.dat [2012/09/27 12:07:34 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/09/27 12:07:34 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/09/24 15:30:56 | 000,015,494 | ---- | M] () -- C:\Users\Svenja\Desktop\wohnungen.odt [2012/09/24 13:50:51 | 3209,216,000 | -HS- | M] () -- C:\hiberfil.sys [2012/09/18 12:07:25 | 000,025,594 | ---- | M] () -- C:\Users\Svenja\Desktop\auswertung_vos5_Svenja.odt [2012/09/17 19:13:07 | 000,021,624 | ---- | M] () -- C:\Users\Svenja\Desktop\Protokoll Rück III Kreisau neu.odt [2012/09/17 15:05:46 | 000,049,524 | ---- | M] () -- C:\Users\Svenja\Desktop\120313ausschreibung-teamer-1.pdf [2012/09/17 09:38:43 | 000,021,786 | ---- | M] () -- C:\Users\Svenja\Desktop\Protokoll Rück III Kreisau.odt [2012/09/07 21:14:28 | 000,016,490 | ---- | M] () -- C:\Users\Svenja\Desktop\protokollmaske_vossen.odt [2012/09/03 17:24:20 | 000,093,672 | ---- | M] (Oracle Corporation) -- C:\windows\System32\WindowsAccessBridge.dll [2012/09/03 17:24:19 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\windows\System32\javaws.exe [2012/09/03 17:24:19 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\windows\System32\javaw.exe [2012/09/03 17:24:18 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\windows\System32\deployJava1.dll [2012/09/03 17:24:18 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\windows\System32\java.exe [1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/10/02 14:00:20 | 000,302,592 | ---- | C] () -- C:\Users\Svenja\Desktop\qqgy4u6z.exe [2012/10/02 13:53:43 | 000,000,120 | ---- | C] () -- C:\Users\Svenja\Desktop\redirect-to.htm [2012/10/02 12:41:39 | 000,000,109 | ---- | C] () -- C:\user.js [2012/10/02 12:32:40 | 000,002,523 | ---- | C] () -- C:\Users\Public\Desktop\IKEA Home Planner.lnk [2012/10/02 12:31:55 | 020,488,704 | ---- | C] () -- C:\Users\Svenja\Desktop\IKEA_Home_Planner_FY10.exe [2012/09/24 15:24:00 | 000,015,494 | ---- | C] () -- C:\Users\Svenja\Desktop\wohnungen.odt [2012/09/18 11:58:57 | 000,025,594 | ---- | C] () -- C:\Users\Svenja\Desktop\auswertung_vos5_Svenja.odt [2012/09/17 19:13:05 | 000,021,624 | ---- | C] () -- C:\Users\Svenja\Desktop\Protokoll Rück III Kreisau neu.odt [2012/09/17 15:05:46 | 000,049,524 | ---- | C] () -- C:\Users\Svenja\Desktop\120313ausschreibung-teamer-1.pdf [2012/09/07 21:14:46 | 000,021,786 | ---- | C] () -- C:\Users\Svenja\Desktop\Protokoll Rück III Kreisau.odt [2012/07/24 12:00:44 | 001,511,424 | ---- | C] () -- C:\windows\System32\HP1100SM.EXE [2012/07/24 12:00:43 | 000,151,552 | ---- | C] () -- C:\windows\System32\HP1100LM.DLL [2012/07/24 12:00:28 | 000,284,160 | ---- | C] () -- C:\windows\System32\mvhlewsi.dll [2012/07/24 12:00:22 | 000,081,920 | ---- | C] () -- C:\windows\System32\mvusbews.dll [2012/07/24 12:00:21 | 000,054,272 | ---- | C] () -- C:\windows\System32\HP1100SMs.dll [2012/05/06 23:25:46 | 000,000,432 | ---- | C] () -- C:\windows\BRWMARK.INI [2012/05/06 23:25:46 | 000,000,034 | ---- | C] () -- C:\windows\System32\BD5280DW.DAT [2011/12/20 13:23:00 | 000,006,656 | ---- | C] () -- C:\Users\Svenja\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011/11/25 11:45:02 | 000,001,473 | ---- | C] () -- C:\Users\Svenja\.recently-used.xbel [2010/06/10 23:11:27 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe [2010/06/10 18:15:24 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2009/06/16 13:25:02 | 000,121,512 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4 ========== ZeroAccess Check ========== [2009/07/14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 06:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both < End of report > Danke! Und hier das Ergebnis aus Adw Cleaner Scan Code:
ATTFilter # AdwCleaner v2.003 - Datei am 10/02/2012 um 16:08:21 erstellt
# Aktualisiert am 23/09/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium (32 bits)
# Benutzer : Svenja - AINHOA
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Svenja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BZIINCEX\2-adwcleaner[1].exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gefunden : C:\user.js
Datei Gefunden : C:\Users\Svenja\AppData\Roaming\Mozilla\Firefox\Profiles\fqelcgji.default\searchplugins\Askcom.xml
Datei Gefunden : C:\Users\Svenja\AppData\Roaming\Mozilla\Firefox\Profiles\fqelcgji.default\searchplugins\Conduit.xml
Datei Gefunden : C:\Users\Svenja\AppData\Roaming\Mozilla\Firefox\Profiles\fqelcgji.default\searchplugins\Web Search.xml
Ordner Gefunden : C:\Program Files\ChatZum Toolbar
Ordner Gefunden : C:\Program Files\Conduit
Ordner Gefunden : C:\Program Files\Softonic
Ordner Gefunden : C:\ProgramData\Ask
Ordner Gefunden : C:\ProgramData\Partner
Ordner Gefunden : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\dq4vluvq.default\extensions\staged
Ordner Gefunden : C:\Users\Svenja\AppData\LocalLow\boost_interprocess
Ordner Gefunden : C:\Users\Svenja\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Svenja\AppData\LocalLow\PriceGong
Ordner Gefunden : C:\Users\Svenja\AppData\LocalLow\Softonic
Ordner Gefunden : C:\Users\Svenja\AppData\LocalLow\Toolbar4
Ordner Gefunden : C:\Users\Svenja\AppData\Roaming\Mozilla\Firefox\Profiles\fqelcgji.default\Conduit
Ordner Gefunden : C:\Users\Svenja\AppData\Roaming\OpenCandy
***** [Registrierungsdatenbank] *****
Schlüssel Gefunden : HKCU\Software\{ADFA33FD-16F5-4355-8504-DF4D664CFE83}
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{96BD48DD-741B-41AE-AC4A-AFF96BA00F7E}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D433A9D0-8267-40CB-8AD5-24F22FA5373F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbTask
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TBSB09850.IEToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TBSB09850.IEToolbar.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TBSB09850.TBSB09850
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TBSB09850.TBSB09850.3
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.eb_explorerbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.eb_explorerbar.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.ipm_printlistitem
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.ipm_printlistitem.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.pm_launcher
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.pm_launcher.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.pm_printmanager
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.pm_printmanager.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.pr_bindstatuscallback
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.pr_bindstatuscallback.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.pr_cancelbuttoneventhandler
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.pr_cancelbuttoneventhandler.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.tbtoolband
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.tbtoolband.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.useroptions
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\toolband.useroptions.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2431245
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.TBSB09850
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.TBSB09850.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{EC4085F2-8DB3-45A6-AD0B-CA289F3C5D7E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook.1
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKU\S-1-5-21-2339853823-2107313754-116825072-1001\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKU\S-1-5-21-2339853823-2107313754-116825072-1001\Software\Microsoft\Internet Explorer\SearchScopes\{96BD48DD-741B-41AE-AC4A-AFF96BA00F7E}
Schlüssel Gefunden : HKU\S-1-5-21-2339853823-2107313754-116825072-1001\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{CA3EB689-8F09-4026-AA10-B9534C691CE0}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.7600.16385
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.chatzum.com/
[HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=TJ&userid=c4bb1c42-6afa-4aa9-a69d-769c87fd7ed1&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.chatzum.com/
[HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=TJ&userid=c4bb1c42-6afa-4aa9-a69d-769c87fd7ed1&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.chatzum.com/
[HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=TJ&userid=c4bb1c42-6afa-4aa9-a69d-769c87fd7ed1&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
[HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=TJ&userid=c4bb1c42-6afa-4aa9-a69d-769c87fd7ed1&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
-\\ Mozilla Firefox v [Version kann nicht ermittelt werden]
Profilname : default
Datei : C:\Users\Svenja\AppData\Roaming\Mozilla\Firefox\Profiles\fqelcgji.default\prefs.js
Gefunden : user_pref("CT2431245.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gefunden : user_pref("CT2431245.CTID", "CT2431245");
Gefunden : user_pref("CT2431245.CurrentServerDate", "22-8-2010");
Gefunden : user_pref("CT2431245.DialogsAlignMode", "LTR");
Gefunden : user_pref("CT2431245.DownloadReferralCookieData", "");
Gefunden : user_pref("CT2431245.EMailNotifierPollDate", "Sun Aug 22 2010 18:47:25 GMT+0200");
Gefunden : user_pref("CT2431245.FeedLastCount129009402595187825", 494);
Gefunden : user_pref("CT2431245.FeedPollDate7470634014180506963", "Sun Aug 22 2010 18:47:27 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634014269327586", "Sun Aug 22 2010 18:47:25 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634014329599698", "Sun Aug 22 2010 18:47:26 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634014537505092", "Sun Aug 22 2010 18:47:25 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634014970726540", "Sun Aug 22 2010 18:47:26 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634015410831318", "Sun Aug 22 2010 18:47:27 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634015483395460", "Sun Aug 22 2010 18:47:27 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634015636754705", "Sun Aug 22 2010 18:47:27 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634015768347545", "Sun Aug 22 2010 18:47:26 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634015855543602", "Sun Aug 22 2010 18:47:26 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016030710453", "Sun Aug 22 2010 18:47:25 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016114705611", "Sun Aug 22 2010 18:47:27 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016129205152", "Sun Aug 22 2010 18:47:27 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016143724791", "Sun Aug 22 2010 18:47:27 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016271239162", "Sun Aug 22 2010 18:47:28 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016568520719", "Sun Aug 22 2010 18:47:27 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016726993788", "Sun Aug 22 2010 18:47:25 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017109031809", "Sun Aug 22 2010 18:47:26 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017132743740", "Sun Aug 22 2010 18:47:26 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017299547668", "Sun Aug 22 2010 18:47:27 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017302327846", "Sun Aug 22 2010 18:47:26 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017344111490", "Sun Aug 22 2010 18:47:26 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017478360748", "Sun Aug 22 2010 18:47:28 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017732797593", "Sun Aug 22 2010 18:47:26 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017821686064", "Sun Aug 22 2010 18:47:27 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634018090228721", "Sun Aug 22 2010 18:47:27 GMT+0200");
Gefunden : user_pref("CT2431245.FeedTTL7470634014269327586", 5);
Gefunden : user_pref("CT2431245.FeedTTL7470634014537505092", 5);
Gefunden : user_pref("CT2431245.FeedTTL7470634014970726540", 2);
Gefunden : user_pref("CT2431245.FeedTTL7470634015636754705", 5);
Gefunden : user_pref("CT2431245.FeedTTL7470634016568520719", 30);
Gefunden : user_pref("CT2431245.FirstServerDate", "22-8-2010");
Gefunden : user_pref("CT2431245.FirstTime", true);
Gefunden : user_pref("CT2431245.FirstTimeFF3", true);
Gefunden : user_pref("CT2431245.FirstTimeSettingsDone", true);
Gefunden : user_pref("CT2431245.FixPageNotFoundErrors", true);
Gefunden : user_pref("CT2431245.GroupingServerCheckInterval", 1440);
Gefunden : user_pref("CT2431245.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gefunden : user_pref("CT2431245.Initialize", true);
Gefunden : user_pref("CT2431245.InitializeCommonPrefs", true);
Gefunden : user_pref("CT2431245.InstallationAndCookieDataSentCount", 1);
Gefunden : user_pref("CT2431245.InstallationType", "UnknownIntegration");
Gefunden : user_pref("CT2431245.InstalledDate", "Sun Aug 22 2010 18:47:25 GMT+0200");
Gefunden : user_pref("CT2431245.InvalidateCache", false);
Gefunden : user_pref("CT2431245.IsGrouping", false);
Gefunden : user_pref("CT2431245.IsMulticommunity", false);
Gefunden : user_pref("CT2431245.IsOpenThankYouPage", false);
Gefunden : user_pref("CT2431245.IsOpenUninstallPage", true);
Gefunden : user_pref("CT2431245.LanguagePackLastCheckTime", "Sun Aug 22 2010 18:47:41 GMT+0200");
Gefunden : user_pref("CT2431245.LanguagePackReloadIntervalMM", 1440);
Gefunden : user_pref("CT2431245.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gefunden : user_pref("CT2431245.LastLogin_2.7.1.3", "Sun Aug 22 2010 18:47:34 GMT+0200");
Gefunden : user_pref("CT2431245.LatestVersion", "2.7.2.0");
Gefunden : user_pref("CT2431245.Locale", "de-de");
Gefunden : user_pref("CT2431245.LoginCache", 4);
Gefunden : user_pref("CT2431245.MCDetectTooltipHeight", "83");
Gefunden : user_pref("CT2431245.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gefunden : user_pref("CT2431245.MCDetectTooltipWidth", "295");
Gefunden : user_pref("CT2431245.PublisherContainerWidth", 1354);
Gefunden : user_pref("CT2431245.RadioIsPodcast", false);
Gefunden : user_pref("CT2431245.RadioLastCheckTime", "Sun Aug 22 2010 18:47:26 GMT+0200");
Gefunden : user_pref("CT2431245.RadioLastUpdateIPServer", "3");
Gefunden : user_pref("CT2431245.RadioLastUpdateServer", "129167771525870000");
Gefunden : user_pref("CT2431245.RadioMediaID", "20503672");
Gefunden : user_pref("CT2431245.RadioMediaType", "Media Player");
Gefunden : user_pref("CT2431245.RadioMenuSelectedID", "EBRadioMenu_CT243124520503672");
Gefunden : user_pref("CT2431245.RadioStationName", "Team%20Radio%20Deutschland");
Gefunden : user_pref("CT2431245.RadioStationURL", "hxxp://trd.stream.w-u-s.org:6666/dsl.m3u");
Gefunden : user_pref("CT2431245.SHRINK_TOOLBAR", 1);
Gefunden : user_pref("CT2431245.SavedHomepage", "resource:/browserconfig.properties");
Gefunden : user_pref("CT2431245.SearchEngine", "Suchen||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Gefunden : user_pref("CT2431245.SearchFromAddressBarIsInit", true);
Gefunden : user_pref("CT2431245.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT243[...]
Gefunden : user_pref("CT2431245.SearchInNewTabEnabled", true);
Gefunden : user_pref("CT2431245.SearchInNewTabIntervalMM", 1440);
Gefunden : user_pref("CT2431245.SearchInNewTabLastCheckTime", "Sun Aug 22 2010 18:47:36 GMT+0200");
Gefunden : user_pref("CT2431245.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Gefunden : user_pref("CT2431245.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Gefunden : user_pref("CT2431245.SettingsCheckIntervalMin", 120);
Gefunden : user_pref("CT2431245.SettingsLastCheckTime", "Sun Aug 22 2010 18:47:25 GMT+0200");
Gefunden : user_pref("CT2431245.SettingsLastUpdate", "1281127908");
Gefunden : user_pref("CT2431245.ThirdPartyComponentsInterval", 504);
Gefunden : user_pref("CT2431245.ThirdPartyComponentsLastCheck", "Sun Aug 22 2010 18:47:24 GMT+0200");
Gefunden : user_pref("CT2431245.ThirdPartyComponentsLastUpdate", "1255348257");
Gefunden : user_pref("CT2431245.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]
Gefunden : user_pref("CT2431245.UserID", "UN25634283069414143");
Gefunden : user_pref("CT2431245.ValidationData_Toolbar", 2);
Gefunden : user_pref("CT2431245.WeatherNetwork", "");
Gefunden : user_pref("CT2431245.WeatherPollDate", "Sun Aug 22 2010 18:47:39 GMT+0200");
Gefunden : user_pref("CT2431245.WeatherUnit", "C");
Gefunden : user_pref("CT2431245.alertChannelId", "825452");
Gefunden : user_pref("CT2431245.backendstorage.hxxp://cmg1_conduit-widgets_com/pitsi.state", "4F50454E");
Gefunden : user_pref("CT2431245.clientLogIsEnabled", false);
Gefunden : user_pref("CT2431245.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Gefunden : user_pref("CT2431245.myStuffEnabled", true);
Gefunden : user_pref("CT2431245.myStuffPublihserMinWidth", 400);
Gefunden : user_pref("CT2431245.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Gefunden : user_pref("CT2431245.myStuffServiceIntervalMM", 1440);
Gefunden : user_pref("CT2431245.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gefunden : user_pref("CT2431245.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Gefunden : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Gefunden : user_pref("CommunityToolbar.ToolbarsList", "CT2431245");
Gefunden : user_pref("CommunityToolbar.ToolbarsList2", "CT2431245");
Gefunden : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2431245");
Gefunden : user_pref("browser.newtab.url", "search.chatzum.com");
Gefunden : user_pref("browser.search.defaultengine", "Ask.com");
Gefunden : user_pref("browser.search.defaultenginename", "Ask.com");
Gefunden : user_pref("browser.search.defaultthis.engineName", "softonic-de3 Customized Web Search");
Gefunden : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&Sea[...]
Gefunden : user_pref("browser.search.order.1", "Ask.com");
Gefunden : user_pref("extensions.Softonic.admin", false);
Gefunden : user_pref("extensions.Softonic.aflt", "SD");
Gefunden : user_pref("extensions.Softonic.autoRvrt", "false");
Gefunden : user_pref("extensions.Softonic.cntry", "DE");
Gefunden : user_pref("extensions.Softonic.cv", "cv5");
Gefunden : user_pref("extensions.Softonic.dfltLng", "de");
Gefunden : user_pref("extensions.Softonic.envrmnt", "production");
Gefunden : user_pref("extensions.Softonic.excTlbr", false);
Gefunden : user_pref("extensions.Softonic.hdrMd5", "D0E24192EFCF0A01C22990CA1BA7C439");
Gefunden : user_pref("extensions.Softonic.hmpg", false);
Gefunden : user_pref("extensions.Softonic.id", "42cad5fe0000000000007ee4001834a4");
Gefunden : user_pref("extensions.Softonic.instlDay", "15615");
Gefunden : user_pref("extensions.Softonic.instlRef", "MON00015");
Gefunden : user_pref("extensions.Softonic.isdcmntcmplt", true);
Gefunden : user_pref("extensions.Softonic.lastVrsnTs", "1.6.7.412:41:37");
Gefunden : user_pref("extensions.Softonic.mntrvrsn", "1.3.0");
Gefunden : user_pref("extensions.Softonic.newTab", false);
Gefunden : user_pref("extensions.Softonic.prdct", "Softonic");
Gefunden : user_pref("extensions.Softonic.prtnrId", "softonic");
Gefunden : user_pref("extensions.Softonic.rvrtMsg", "Click Yes to keep current home page and default search set[...]
Gefunden : user_pref("extensions.Softonic.sg", "az");
Gefunden : user_pref("extensions.Softonic.smplGrp", "none");
Gefunden : user_pref("extensions.Softonic.tlbrId", "base");
Gefunden : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MON00015/tb_v1?SearchSource[...]
Gefunden : user_pref("extensions.Softonic.vrsn", "1.6.7.4");
Gefunden : user_pref("extensions.Softonic.vrsnTs", "1.6.7.412:41:37");
Gefunden : user_pref("extensions.Softonic.vrsni", "1.6.7.4");
Gefunden : user_pref("extensions.Softonic_i.newTab", false);
Gefunden : user_pref("extensions.Softonic_i.smplGrp", "none");
Gefunden : user_pref("extensions.Softonic_i.vrsnTs", "1.6.7.412:41:37");
Gefunden : user_pref("id_chatzum_installed_version", "1.0.17");
Gefunden : user_pref("id_chatzum_tabpage", "hxxp%3A//searchsafer.com/");
Gefunden : user_pref("keyword.URL", "hxxp://utils.chatzum.com/?url=");
Profilname : default
Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\dq4vluvq.default\prefs.js
Gefunden : user_pref("browser.startup.homepage", "hxxp://search.chatzum.com/");
Gefunden : user_pref("browser.newtab.url", "search.chatzum.com");
-\\ Google Chrome v [Version kann nicht ermittelt werden]
Datei : C:\Users\Svenja\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [26176 octets] - [02/10/2012 16:07:11]
AdwCleaner[R2].txt - [26106 octets] - [02/10/2012 16:08:21]
########## EOF - C:\AdwCleaner[R2].txt - [26167 octets] ##########
Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.65.0.1400 www.malwarebytes.org Datenbank Version: v2012.10.02.05 Windows 7 x86 NTFS Internet Explorer 8.0.7600.16385 Svenja :: AINHOA [Administrator] Schutz: Aktiviert 02.10.2012 16:20:37 mbam-log-2012-10-02 (16-20-37).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 217488 Laufzeit: 7 Minute(n), 32 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) [code] GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-10-02 17:09:13
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.11.0
Running: qqgy4u6z.exe; Driver: C:\Users\Svenja\AppData\Local\Temp\uwldrpow.sys
---- System - GMER 1.0.15 ----
SSDT 91E6898E ZwCreateSection
SSDT 91E68993 ZwSetContextThread
SSDT 91E6892F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwRollbackTransaction + 13E9 83E56599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 83E7B092 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!RtlSidHashLookup + 340 83E82990 4 Bytes [8E, 89, E6, 91]
.text ntkrnlpa.exe!RtlSidHashLookup + 6E0 83E82D30 4 Bytes [93, 89, E6, 91] {XCHG EBX, EAX; MOV ESI, ESP; XCHG ECX, EAX}
.text ntkrnlpa.exe!RtlSidHashLookup + 7B8 83E82E08 4 Bytes [2F, 89, E6, 91] {DAS ; MOV ESI, ESP; XCHG ECX, EAX}
.text autochk.exe 004211D1 5 Bytes [8B, 35, 34, E2, 48]
.text autochk.exe 004211D7 20 Bytes [4E, 8D, 4E, 01, 8B, C1, 99, ...]
.text autochk.exe 004211ED 33 Bytes [80, 89, 45, F4, 79, 05, 4A, ...]
.text autochk.exe 00421210 45 Bytes [00, 83, CA, FF, D3, E2, F7, ...]
.text autochk.exe 0042123E 38 Bytes [00, 80, 79, 05, 4E, 83, CE, ...]
.text ...
---- Devices - GMER 1.0.15 ----
Device \Driver\ACPI_HAL \Device\0000009c halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b654edff
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b654f652
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b66b6864
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Bind ?????????????????????????????a???e????N??????3??????????????????BthEnum??????$???????????????????????????????????p???????????????????????@??????????????????{4d36e97d-e325-11ce-bfc1-08002be10318}?7?????????????????????m?????????sA????????????????????????????????????????????????????????????????????????????????9????????????????????????????????????6??????8???????????????????????????????????????!????????????????????????6?????? ???????????????????????????#?????????????????????????5?????9????????????????????????????????????5??????"???????????????????????????????8???????????????????????????????????????!????????????????????????5?????? ??????????????????????????? ???????????????????????????6???????????????????????????????????????????????????????????????0???5??????????????????????????????????0???????????????????????????????????????????????????????0???? ???????????????????????????6???????????????????????????????????????????????????????????????6???5??????????????????????????????????6??????????????????????????????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Route ??????????????????N????????????D??????????????????????????????????????????????????????????????<?????????????LAN-Verbindung* 9????????k???????????????k????????????N??????g?????Dlb??????????????????????????????????????????????????????????????????????????????t???????#?????????????????????????????????????????6?????{*}S 720x480x8,16,32,64 1280x800x8,16,32,64 1920x1440x32,64 2048x1536x8,16=1;1400x1050x32,64 1440x900x32,64 1600x1024x32,64 1600x1200x32,64 1680x1050x32,64 1920x1200x8,16=1F;1920x1200x32,64=3;1400x1050x8,16 1440x900x8,16 1600x1024x8,16 1600x1200x8,16 1680x1050x8,16=3F;640x480x8,16,32,64 800x600x8,16,32,64 1024x768x8,16,32,64 1152x864x8,16,32,64 1280x960x8,16,32,64 1280x1024x8,16,32,64=7F;720x576x8,16,32,64=8032;1280x800x8,16,32,64=8039;1920x1440x8,16=F;????????)???????F????????????????????6CB5???.???????1???????????????????????????????????????????????????????????@????????????????????6?????????????16??????????????????????????????*6to4mp??????????????.??????????????????????{413a2be6-74da-11df-9940-002454
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Export ???n?????|?v?|??????????????t????????????n???o???o??????????@%systemroot%\system32\browser.dll,-103???????????????????????????N??{?????????n????Microsoft???????c????????????????????????P???o??*6to4mp???????????????8??n????????h?????Boot File System?????|???t??????????????t????????????????????????u????????????????????????????????????????F????????????e?????????????5???0??????????system32\DRIVERS\bowser.sys???????"??o??????p????????????o?o?o??.NT???????P??n?????????n????cpu.inf???????R???????????h????????????????????????????????????????????g????system32\DRIVERS\bthpan.sys??????????????????????????????o????R??n?????????e????????????????e????q??????? ???????o???????????n?,????????R?;??????m???l?n?n?n?n??USB-Treiber f?r Bluetooth-Funkger?t?F}??Bluetooth Device (Personal Area Network)??????????????????????????4??n????????h?????????????? ???????o?????????????,????????R?=??????????????????o???o??????????????\SystemRoot\system32\DRIVERS\amdsata.sys?5??SCSI miniport????n?n?n?n?n?o?????o????R??o???????????d??amdsata.inf
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Bind ?????B???????u???????????????????????????????????e????????N??????????????????????i??tunnel??????6.1.7600.16385?425???????????.??????????0????????~??? ???????????????????????????????????????????????????????????????????????????????????????????????????????????????>???????????????????????????????????????????<???????????????????????????????????????????<???????????????????????????????????????????=??????????????????????????????????????}????=???????????????????????????????????????????=??????????????????????????????????????}????????f???????|???7???????????????????????????????????}??@nettun.inf,%msft%;Microsoft????????????????????????????? 0??????????????????>?????????????????????????????????????????????????????????????????????????????????????????????6??????????????????????????????????????????????????6?????????????????????????????6????#?????????????????????????6????? ??????????????????????????????D???????????????????????D???????????????????????? ??D???????????????????????????D???????????????????0??????????????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Route ????????????????????????*6to4mp??D???????????? ??????????|?????????????????????????????????????????????????????????????????????????????????5?????&???????????????????????????????&?????????????????????????????????????????????????????6????\\?\Root#*6TO4MP#0024#{cac88484-7515-4c03-82e6-71a87abac361}?????.???????????????????????????????????????????????j????V?????????p???????????????????????????????????????????????????????????????????????????0???????????????????????A????????????f?????????????????????????????????????????????????????????????????????6????????????????????????????????USB?????????????????????AD???????????e??????{4d36e96e-e325-11ce-bfc1-08002be10318}?_Fa??????????????????????????????????s?????????????????????N??????d??????????{8ECC055D-047F-11D1-A537-0000F8753ED1}??????????????Microsoft???????????????????????????????????E????????????????????????????????????????????????7??Root\*6TO4MP\0055???\\?\Root#*6TO4MP#0025#{cac88484-7515-4c03-82e6-71a87abac361}?9???9???????????????h??? D??????3?????p?!?????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export ???v?|??Root\*6TO4MP\0010????y??Microsoft???????????? ???????u?????????????????????????? ??????????????u???u????? ???????o???????????p???????????????????y???????z??system32\DRIVERS\rdbss.sys???????????????-?????????????????????????u?/??????????WmiOpenPerfData?????????????????????????? ???????o?????u???????,????????:????????S??@%systemroot%\system32\DRIVERS\RDPCDD.sys,-100??????? ???o??? ??????????System32\drivers\partmgr.sys?????????t?????????e???????y?{??????????*6to4mp?????Microsoft?????????????X??????7???t????????????????????????8???????????h??????????u????????????$??u???_??????? ??????\A??????????? ???????u???????????????????????????????e??@%SystemRoot%\system32\drivers\partmgr.sys,-100??????????|??System32\DRIVERS\srv2.sys????????????????????????????????v??????????MSC_DSC?????????????????t????u???????????????????u???????????????{??Net??????????p??Video Save??????????16??????????????????????????????????????????????????????Root\*6TO4MP\0009?????N???????????D?????Net??????????????5??C:?????????????????????
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b654edff (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b654f652 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b66b6864 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Bind ???`?s????????????????????????????????????????????????????????????@polstore.dll,-5013???????@polstore.dll,-5014???????Policyagent????????????????????????? ??????????? ????(??????P????????????(??????P????????????(??????P????????????(??????P????????????(??????P????????????(??????P?????????????P???????????????????????*6to4mp???????f??p????????????f??p?????????e????????????igfx????????? ???????o???????????l????????L?????????????????????????????????? 4??p??????????????NT AUTHORITY\LocalService?????????????????????????`??p??????????????????? ??????????????????????????SeChangeNotifyPrivilege?SeImpersonatePrivilege???????o?o?p?p?p???????????y?yos??t?????,??p???????????????????????p???e???????e???p?q?q??????? ???????o?????p??????????????$???/????????????? ??????g????????????????????????.NT?????@%SystemRoot%\system32\wevtsvc.dll,-200??????????p????????h???????P??p?????????n?????? ??p???????t???????????0??&d??LocalSystem?????@%SystemRoot%\system32\qmgr.dll,-1001?????V??q?????????e?????????????????????v???v???????????p?
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Route ???j???????j????? ???????j?????j???????1?????????????????????j??????????????\??\PCI#VEN_8086&DEV_3B34&SUBSYS_C06A144D&REV_06#3&11583659&0&E8#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}??4??? ???????j?????j???????-??4????????????????????????????j????? ???????j?????????????-???????????????????????????j????? ???????j???????????g????????"??????????f??????????????????????????????????????????????????????????????????????????????????????????? 4??j???e?????vA2???????????????????????????????????????n??sh???j?j???????????????j?????j??? ???????j?????j???????1??L????????? ??????5?G?????j???j???j????????? ???????j?????j???????1????????????&???????????????????????? ???????j?????????????1????????????????????? ???????j?????????????1?????????????????????j?j?????j??? ???????j?????????????1?????????????????????j?j?????j?j?????j??? ???????j?????????????1????????????????????? ???????j?????????????1?????????????????????????????b?????????j????????nt??? ???????j?????????????1????????????????????? ???????j?????????????1???????????????????
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Export ???q?q??????????Extended Base????????j??????????Keyboard Port????q???????u??@%SystemRoot%\system32\drivers\http.sys,-1???????????????o???????????q??text?v???????????????????????????????????????t???+???+????`??u?????????e?????q????????????N????????????D???????????????????????g????????????????????????????g?????d??s???0??s???????????????????????cpu.inf???????????????h?????????????acpi\acpi0003???Svenja???????????????????%???}???????q???????q??????t????????????q?q?????q???t?t?z???|???????????????|??Net??????g??to???t?~????????????????????????????????? ???????qs????q?????p????z???&?f??????????n????%SystemRoot%\system32\srvsvc.dll?????????????????v????????????????????????????????????????????????????????$??q??????????????Root\*6TO4MP\0007????????????????z???|???q?q?q???q???????????????????q??.NTx86????????????????????????????????m?????Microsoft???? ???????q???????????q?,?????? ?@?????????????????????????????????????@??q??????????????C:\Windows\system32\mscoree.dll??????q?q????? ???????q???????????q?,?????? ?@???!??
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Bind ???`?????????????????????e????????????????n?????@%SystemRoot%\system32\drivers\fltmgr.sys,-10000??????<??p????????h???????X??????????e???u???u????P??p?????????e??????X??????i???t??system32\DRIVERS\iaStor.sys??????????o??????p?????????????????????????8??p???.????h?????????????????t????????????????????/???????????0???8?z????0.???????q??cpu.inf?:a??? ???????p?????????????,???????????? ???????????? ???????o?????p?????p????????$???C????????c????@%SystemRoot%\System32\certprop.dll,-11???????Z??p????????h?????%SystemRoot%\system32\svchost.exe -k netsvcs??????P??p?????????n????@%SystemRoot%\System32\certprop.dll,-12?????? ???p??????????????LocalSystem?????RpcSs???????????????????????????????????????t???????????????t??????? ????????????????p???????????e????,??p???????????????????????????????????????p???????????????????p?p?p?p?p?p?p?p?p?p?p??????????????????????????? ???????p???????????p????????,?F??? ???????????? F??p???????????????????p???????????p??????????????SeCreateGlobalPrivilege?SeTcbPrivilege?SeChangeNotifyPr
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Route ???k?s??????????????????? ???????fg????l??????????*?????????????????? ???????k?????k???????????????????????????????k?&??? ???????k?????k?? ???????"?????b????????????????????????????????????k???n??si????X??l???2???????k??????????????avgntflt?????????k???D??sE???????????j?k?k?k????????? ??l?????????2?????????????????1???????k???2??? ???????1???????????????s???????????????????????i????????????:????????g?????????j???????????????????????????????????????????????????D???????????????????D?????s-0???????????????????????l?l?1???????????8???0???????????????????????????k??????s????????????}???????????????C???6???????????????????????k??????s??????????????????s?????????g???????e??LegacyDriver?????????????2???????????????????E?????s&D??????????????????volsnap??????k?k?k??? ???k???b?????;1w?????k?&??? ???????k?????k??????????(???????????????????s??????????$??? ???????k?????k???????-???????????????????????????????k????? ???????k?????????????-?????????????????????y?????k????? ???????k???????????????????????????????f??PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Export ?????3??F:\?Dateisystem-Volumetreiber?????`?????????????????????????????????????????????????????????????????????????????????????????????????7????????`??????????????????6????????`??????????????????????????????????????????????7????????????????????????????????%??????????????????????????r?????????????????????????6???????????????????????????6?????? ???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????2???????????????????????????2????????????????????????X??????????????????A??????????????????? ????????????????????$??????C???????"???$??????????????????????????????? ???k???????????????????????*????????????????????????????????????N??????d??????????????????????nettun.inf??0???? ?????????????????????6????????????????????{4d36e972-e325-11ce-bfc1-08002be10318}???????????????????????????????*???????????????????????????????????????????????????????????????????????.???????????????6???$??????? ??????????????????????Int
---- EOF - GMER 1.0.15 ----
|
| Themen zu Wie bekomme ich ChatZum von meinem Computer? |
| 4d36e972-e325-11ce-bfc1-08002be10318, adobe, adw cleaner, antivir, appdatalow, application/pdf:, autorun, avira, bho, bonjour, canon, chatzum, computer, defender, download, error, firefox, format, home, installation, internet browser, lanmanworkstation, logfile, löschen, microsoft, nvidia, object, pdf, plug-in, policyagent, registrierungsdatenbank, registry, scan, security, software, taskhost.exe, trojaner, tunnel, vodafone, windows |
Baum-Darstellung