![]() |
|
Plagegeister aller Art und deren Bekämpfung: Windows Vista: Erst BKA und jetzt GVU Trojaner....Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #1 |
![]() | ![]() Windows Vista: Erst BKA und jetzt GVU Trojaner.... Hallo ihr lieben ![]() Ich habe mich hier angemeldet, weil sich meine Freundin auf Ihrem Laptop 2 Trojaner eingefangen hat. Es fing plötzlich am Montag an. Da tauchte dieser BKA Trojaner auf, der gerne eine Zahlung mit Ukash hätte. Nach einer längeren Internet Recherche, habe ich gelesen das dort eine Systemwiederherstellung helfen würde. Also habe ich mich im abgesicherten Modus mit Eingabeaufforderung angemeldet und rstrui.exe ausgeführt. Das hat auch funktioniert, der Laptop lief danach wieder wie vorher ohne Probleme. Jetzt wollte meine Freundin gestern etwas am Laptop machen und hatte ihn hochgefahren. Nachdem kompletten hochfahren, kam dann einfach der GVU Trojaner Sperrbildschirm.... Also hatte ich es wieder mit einer Wiederherstellung probiert, klappte auch, aber der Trojaner kam wieder. Danach habe ich mir die Kaspersky Windows Unlocker Software besorgt, ausgeführt und neu gestartet. Es dauerte leider nicht lange und der Bildschirm wurde wieder gesperrt. Ich kann nicht verstehen, wieso der Laptop aufeinmal so anfällig ist. Wir nutzen beide Norton 360 Online, und diese Software sagte vorher noch es wäre alles okay. Beim Scan wurde auch nichts gefunden. Jetzt habe ich mich hier etwas erkundigt, und mir im abgesicherten Modus OTL und Malwarebytes runtergeladen. Beide Programme habe ich bereits durchlaufen lassen und Malwarebytes hat 7 Infizierte Dateien gefunden, die ich dann gelöscht habe. Hier die Log Files: USER & PC Name = XXX Code:
ATTFilter OTL.txt OTL logfile created on: 04.10.2012 08:00:49 - Run 1 OTL by OldTimer - Version 3.2.70.2 Folder = C:\Users\XXX\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,50 Gb Total Physical Memory | 2,89 Gb Available Physical Memory | 82,50% Memory free 7,18 Gb Paging File | 6,79 Gb Available in Paging File | 94,56% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 149,04 Gb Total Space | 88,30 Gb Free Space | 59,24% Space Free | Partition Type: NTFS Drive D: | 137,33 Gb Total Space | 136,42 Gb Free Space | 99,34% Space Free | Partition Type: NTFS Computer Name: XXX | User Name: XXX | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\XXX\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe (Adobe Systems, Inc.) PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) ========== Modules (No Company Name) ========== MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_278.dll () MOD - C:\Program Files\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files\WinRAR\rarext.dll () MOD - C:\Program Files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll () MOD - C:\Program Files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll () ========== Services (SafeList) ========== SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (N360) -- C:\Program Files\Norton 360\Engine\3.8.3.6\ccSvcHst.exe (Symantec Corporation) SRV - (ICQ Service) -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe () SRV - (SearchAnonymizer) -- C:\Users\XXX\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe () SRV - (SRS_VolSync_Service) -- C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe (SRS Labs, Inc.) SRV - (ASLDRService) -- C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe () SRV - (ADSMService) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.) SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (EPSON_EB_RPCV4_01) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE (SEIKO EPSON CORPORATION) SRV - (ATKGFNEXSrv) -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe () SRV - (EPSON_PM_RPCV4_01) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION) ========== Driver Services (SafeList) ========== DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20121003.002\NAVEX15.SYS File not found DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20121003.002\NAVENG.SYS File not found DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation) DRV - (IDSVix86) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20121002.001\IDSvix86.sys (Symantec Corporation) DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation) DRV - (ccHP) -- C:\Windows\System32\drivers\N360\0308030.006\cchpx86.sys (Symantec Corporation) DRV - (SYMTDI) -- C:\Windows\System32\drivers\N360\0308030.006\symtdi.sys (Symantec Corporation) DRV - (SYMFW) -- C:\Windows\System32\drivers\N360\0308030.006\symfw.sys (Symantec Corporation) DRV - (SYMNDISV) -- C:\Windows\System32\drivers\N360\0308030.006\symndisv.sys (Symantec Corporation) DRV - (SymEvent) -- C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation) DRV - (SymEFA) -- C:\Windows\System32\drivers\N360\0308030.006\SymEFA.sys (Symantec Corporation) DRV - (SRTSP) -- C:\Windows\System32\drivers\N360\0308030.006\srtsp.sys (Symantec Corporation) DRV - (BHDrvx86) -- C:\Windows\System32\drivers\N360\0308030.006\BHDrvx86.sys (Symantec Corporation) DRV - (SRTSPX) -- C:\Windows\System32\drivers\N360\0308030.006\srtspx.sys (Symantec Corporation) DRV - (SymIM) -- C:\Windows\System32\drivers\SymIMV.sys (Symantec Corporation) DRV - (AsDsm) -- C:\Windows\System32\drivers\AsDsm.sys (ASUSTek Computer Inc) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (SRS_PremiumSound_Service) -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys () DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation ) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation) DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100) DRV - (nvstor32) -- C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation) DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( ) DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation) DRV - (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys () DRV - (CRFILTER) -- C:\Windows\System32\drivers\CRFILTER.sys (Generic) DRV - (ASMMAP) -- C:\Program Files\ATKGFNEX\ASMMAP.sys () DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUS IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E6C6976652E636F6D2F726573756C74732E617370783F713D7B7365617263685465726D737D267372633D7B72656665727265723A736F757263653F7D&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=YYYYYYYYDE&apn_uid=2A60E630-E73C-480E-9831-A29AC924F35A&apn_sauid=FB9639B9-C3E6-4579-8934-E442DD948EA1 IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{1AC7DA71-3D8E-451E-AE4C-D541B0903131}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{3FE9274E-3933-4216-9FC2-49C5895F66B0}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{5EB1BBAE-0F87-461A-9CFE-4A3F525036EB}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{661EED24-9CCC-4EF0-A939-0A472EB7AFEA}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUS_deDE342 IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{8ADA9A31-0070-4D0D-BD1F-9955DA92DB51}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{F5B3B830-613E-427F-B6F6-775EA251D1B6}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaulturl: "hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q=" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.meinvz.net/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.7 FF - prefs.js..extensions.enabledItems: {AA994882-F391-4d2e-806F-8908DA4814ED}:2.11.9 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.7&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_278.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: c:\Program Files\Sony\Media Go\npmediago.dll (Sony Creative Software Inc) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2011.10.11 13:46:13 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.08 12:54:11 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.08 12:54:02 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.08 12:54:11 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.08 12:54:02 | 000,000,000 | ---D | M] [2009.08.29 22:05:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions [2012.06.25 17:53:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\ozrd7br3.default\extensions [2010.04.28 21:27:13 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\ozrd7br3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012.06.24 17:21:33 | 000,002,408 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\askcom.xml [2012.06.20 06:44:32 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-1.xml [2011.12.06 06:09:12 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-10.xml [2012.06.24 17:21:28 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-11.xml [2012.06.24 17:51:38 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-12.xml [2011.03.15 20:37:46 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-2.xml [2011.03.29 14:00:27 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-3.xml [2011.03.29 19:41:31 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-4.xml [2011.06.15 11:18:04 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-5.xml [2011.06.28 18:24:34 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-6.xml [2011.08.29 13:25:55 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-7.xml [2011.10.20 19:29:18 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-8.xml [2011.11.04 15:27:55 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-9.xml [2010.12.08 07:51:30 | 000,001,056 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin.xml [2011.01.01 17:57:11 | 000,001,218 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\kikin-search.xml [2010.05.14 07:44:05 | 000,002,041 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\{A3D7305C-0C49-4C43-93F4-E42E7FE945E2}.xml [2010.05.14 07:44:05 | 000,002,152 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\{D3717DB6-E0B2-4656-B572-C26AB1C0F23E}.xml [2010.05.14 07:44:05 | 000,001,834 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\{DB44FC55-F071-45EF-A618-6D557C85E264}.xml [2012.10.04 00:16:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions [2012.09.08 12:53:59 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\mozilla firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.09.08 12:54:11 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.06.15 00:46:57 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.01 17:07:56 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.06.15 00:46:57 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.06.15 00:46:57 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.15 00:46:57 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.15 00:46:56 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.3.6\coIEPlg.dll (Symantec Corporation) O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.3.6\IPSBHO.DLL (Symantec Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files\kikin\ie_kikin.dll (kikin) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.3.6\coIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) O3 - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.3.6\coIEPlg.dll (Symantec Corporation) O4 - HKLM..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe (ATK) O4 - HKLM..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (AlcorMicro Co., Ltd.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe () O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS) O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS) O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [DisableS3S4] c:\DisableS3S4.cmd File not found O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.) O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe (ASUS) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [Ocs_SM] C:\Users\Miri\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS) O4 - HKLM..\Run: [P2Go_Menu] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files\ASUS\Wireless Console 3\wcourier.exe () O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000..\Run: [ALBATTTOOL] C:\Program Files\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe (AkkuLine.de) O4 - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000..\Run: [ICQ] C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.) O4 - Startup: C:\Users\Miri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk = C:\ProgramData\lsass.exe (Microsoft Corporation) O4 - Startup: C:\Users\Miri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll (kikin) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{156BAF28-F88F-4754-AC5D-370EA53622DA}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.3.6\coIEPlg.dll (Symantec Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Miri\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Miri\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{189a3b69-6a90-11df-963b-0026189eadce}\Shell - "" = AutoRun O33 - MountPoints2\{189a3b69-6a90-11df-963b-0026189eadce}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O33 - MountPoints2\{7a38294f-a3a0-11df-b9a8-806e6f6e6963}\Shell\AutoRun\command - "" = F:\programs\nu2menu\nu2menu.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.10.04 07:54:20 | 000,601,088 | ---- | C] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe [2012.10.04 07:49:59 | 010,524,080 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\XXX\Desktop\mbam-setup-1.65.0.1400.exe [2012.10.03 23:06:22 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders [2012.10.03 23:06:19 | 000,000,000 | ---D | C] -- C:\4ed1fa912e6d986eeaf033225816dd [2012.10.03 19:04:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2012.10.03 19:04:17 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe [2012.10.03 19:03:54 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe [2012.10.03 19:03:54 | 000,093,672 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll [2012.10.03 19:03:53 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe [2012.10.01 12:21:08 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\lsass.exe [2012.10.01 11:15:15 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\hellomoto [2012.09.23 15:39:24 | 000,000,000 | ---D | C] -- C:\Users\XXX\Application Data [2012.09.08 12:53:58 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2012.09.06 13:13:45 | 000,028,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mdimon.dll [2012.09.05 14:36:33 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell Inc [2012.09.05 14:36:07 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\Deployment [2012.09.05 14:36:07 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\Apps [2012.09.05 11:14:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PE Builder [2012.09.05 11:14:42 | 000,000,000 | ---D | C] -- C:\pebuilder3110a [2012.09.04 15:27:11 | 000,000,000 | ---D | C] -- C:\UBCD4Win [2012.09.04 11:42:29 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Canneverbe Limited [2012.09.04 11:42:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited [2012.09.04 11:42:11 | 000,000,000 | ---D | C] -- C:\Program Files\CDBurnerXP ========== Files - Modified Within 30 Days ========== [2012.10.04 07:54:20 | 000,601,088 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe [2012.10.04 07:50:06 | 010,524,080 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\XXX\Desktop\mbam-setup-1.65.0.1400.exe [2012.10.04 07:38:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.10.04 00:25:24 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.10.04 00:25:24 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.10.04 00:21:22 | 000,031,776 | ---- | M] () -- C:\ProgramData\nvModes.dat [2012.10.04 00:16:45 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe [2012.10.04 00:16:34 | 000,031,776 | ---- | M] () -- C:\ProgramData\nvModes.001 [2012.10.04 00:01:20 | 083,023,306 | ---- | M] () -- C:\ProgramData\0tbpw.pad [2012.10.03 22:34:19 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.10.03 20:05:36 | 000,000,680 | ---- | M] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat [2012.10.03 19:03:43 | 000,093,672 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll [2012.10.03 19:03:35 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe [2012.10.03 19:03:35 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe [2012.10.03 19:03:34 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe [2012.10.03 19:03:32 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npdeployJava1.dll [2012.10.03 19:03:32 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll [2012.10.03 18:07:16 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{EABF226A-D64D-4372-B904-43E4DC0EA6E1}.job [2012.10.02 17:39:01 | 000,000,238 | ---- | M] () -- C:\Windows\tasks\Epson Printer Software Downloader.job [2012.10.01 12:21:36 | 000,000,761 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.10.01 12:21:08 | 000,044,544 | ---- | M] (Microsoft Corporation) -- C:\ProgramData\lsass.exe [2012.09.22 18:34:16 | 000,696,240 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2012.09.22 18:34:16 | 000,073,136 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2012.09.06 18:45:02 | 000,397,352 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.09.06 13:13:47 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI [2012.09.05 23:24:27 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.09.05 23:24:27 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.09.05 23:24:27 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.09.05 23:24:27 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.09.05 15:20:02 | 000,033,280 | ---- | M] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.09.04 11:42:17 | 000,001,741 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk [2012.09.04 11:39:50 | 000,001,770 | ---- | M] () -- C:\Users\XXX\Desktop\Continue SweetIM Installation.lnk [2012.09.04 11:27:33 | 011,470,848 | ---- | M] () -- C:\Users\XXX\Desktop\KNOPPIX_V7.0.4bootonly-2012-08-20-DE.iso ========== Files Created - No Company Name ========== [2012.10.01 12:21:36 | 000,000,761 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.10.01 12:21:31 | 083,023,306 | ---- | C] () -- C:\ProgramData\0tbpw.pad [2012.09.06 13:13:47 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2012.09.04 11:42:17 | 000,001,741 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk [2012.09.04 11:42:17 | 000,001,691 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk [2012.09.04 11:39:36 | 000,001,770 | ---- | C] () -- C:\Users\XXX\Desktop\Continue SweetIM Installation.lnk [2012.09.04 11:27:18 | 011,470,848 | ---- | C] () -- C:\Users\XXX\Desktop\KNOPPIX_V7.0.4bootonly-2012-08-20-DE.iso [2012.08.26 19:47:40 | 000,013,054 | ---- | C] () -- C:\Users\XXX\Gesa.ods [2012.08.19 20:02:25 | 000,022,221 | ---- | C] () -- C:\Users\XXX\1. Mahnung Nintendo 3DS.odt [2012.06.15 07:44:34 | 000,243,637 | ---- | C] () -- C:\Users\XXX\Bestellung bei Mac.ods [2012.06.08 15:10:20 | 000,036,175 | ---- | C] () -- C:\Users\XXX\Seraps Kredit.ods [2011.06.20 19:12:19 | 000,008,142 | ---- | C] () -- C:\Users\XXX\ESt2010_XXX_XXX.elfo [2011.06.20 18:58:15 | 000,008,876 | ---- | C] () -- C:\Users\XXX\ESt2009_XXX_XXX.elfo [2011.04.19 09:49:04 | 000,001,940 | ---- | C] () -- C:\Users\XXX\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini [2010.11.06 15:28:08 | 000,004,096 | -H-- | C] () -- C:\Users\XXX\AppData\Local\keyfile3.drm [2010.10.21 06:29:53 | 000,000,680 | ---- | C] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat [2009.10.02 16:05:32 | 000,031,776 | ---- | C] () -- C:\ProgramData\nvModes.001 [2009.10.02 16:04:21 | 000,031,776 | ---- | C] () -- C:\ProgramData\nvModes.dat [2009.08.30 17:39:40 | 000,033,280 | ---- | C] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== ZeroAccess Check ========== [2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2011.01.21 17:46:32 | 011,582,464 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.08.05 10:55:07 | 000,615,424 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2008.01.21 04:24:03 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.09.04 11:42:29 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Canneverbe Limited [2010.05.14 07:46:57 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Desktopicon [2011.10.27 11:24:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\elsterformular [2012.08.28 13:49:10 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Epson [2012.10.01 11:15:25 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\hellomoto [2012.06.27 18:06:11 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ICQ [2012.10.03 19:38:13 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\kikin [2009.08.30 18:46:27 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\McLoad [2010.05.14 07:44:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\OCS [2011.02.02 22:04:11 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\OpenOffice.org [2010.05.14 07:44:06 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Opera [2010.03.31 13:16:48 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Sony [2010.03.31 13:12:29 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Sony Setup ========== Purity Check ========== < End of report > Code:
ATTFilter Extras.txt OTL Extras logfile created on: 04.10.2012 08:00:49 - Run 1 OTL by OldTimer - Version 3.2.70.2 Folder = C:\Users\XXX\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,50 Gb Total Physical Memory | 2,89 Gb Available Physical Memory | 82,50% Memory free 7,18 Gb Paging File | 6,79 Gb Available in Paging File | 94,56% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 149,04 Gb Total Space | 88,30 Gb Free Space | 59,24% Space Free | Partition Type: NTFS Drive D: | 137,33 Gb Total Space | 136,42 Gb Free Space | 99,34% Space Free | Partition Type: NTFS Computer Name: XXX | User Name: XXX | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l [HKEY_USERS\S-1-5-21-1510155998-2412716386-4037089523-1000\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Unable to open value key hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Unable to open value key scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Unable to open value key Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{1051584D-DBF7-42CB-83C0-D8A1E220272B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{151208DE-A18D-4F11-A84D-AF36A31D931B}" = lport=3390 | protocol=6 | dir=in | app=system | "{181AB666-8F89-4965-829E-039887060EF7}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | "{1F5C3E3E-3729-4D4B-899D-EB44685D0346}" = lport=3390 | protocol=6 | dir=in | app=system | "{22E50670-BB2E-463E-8554-4787EBF73862}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{2C26C34F-1BFE-49E4-96EA-32CF36A437A2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{376BA189-5C37-450C-A1DE-4BA30A19379C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{43211A80-C1D2-4D6F-9502-B2615BBD951F}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | "{4E57C697-1E2E-452B-8A5C-57F1693B6878}" = rport=137 | protocol=17 | dir=out | app=system | "{57108E19-5404-4726-A74F-90406A31C7D1}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{63F3B047-3F0F-4CCA-A8C9-B47D3E14E05A}" = lport=139 | protocol=6 | dir=in | app=system | "{66CF180B-6F8B-4570-BEE5-7630CB82A6F6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{68417C0E-58F5-49C4-A1CA-2509E731F64C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{6FAE2B0B-202F-4DF0-BAC6-018275CE0EEF}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{78E494E6-239C-4BB1-BDEE-6343DECED24F}" = lport=2869 | protocol=6 | dir=in | app=system | "{7C3CB7F3-9689-4C95-A2AD-DBF20A971581}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | "{82E82782-E56E-4251-92C3-E78BED291D5A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{83BBAB47-AF41-4B12-A41A-A1B71B59B10D}" = rport=10243 | protocol=6 | dir=out | app=system | "{848B17EF-2CB4-4809-8741-6AFD61C8968B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{9C25C8EB-A7D7-46DB-B9E6-18F04927F56C}" = lport=445 | protocol=6 | dir=in | app=system | "{9DBCD191-C015-4807-BA0D-C6AD4A3E32D6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{9E10A108-A3E5-4261-95F4-69AB7402ABE2}" = rport=138 | protocol=17 | dir=out | app=system | "{A719CF19-89A2-4A72-87C9-B99D9F2A9E7E}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{A8DEC781-3D17-4CA8-9EF0-DF4EA5C96A41}" = rport=139 | protocol=6 | dir=out | app=system | "{AC1781DC-19D8-4357-B872-D3895EE2DDB1}" = lport=10244 | protocol=6 | dir=in | app=system | "{AC28EF28-852E-4671-A9BD-3FE2E36E7857}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{AD0F3A5A-668B-411D-99EA-2CD0416C31BD}" = lport=10244 | protocol=6 | dir=in | app=system | "{B5CC27FC-623E-4B4E-98BF-478EDBD3A365}" = lport=10243 | protocol=6 | dir=in | app=system | "{B6BBC4FF-0421-4F10-9F66-DD0C6660DBD3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{B750A3DB-C6FB-45B9-B837-01320B5D08E2}" = rport=445 | protocol=6 | dir=out | app=system | "{B8898A27-A33E-41BE-9F5F-6032E7874FC5}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | "{BCBB4BCC-FD46-40ED-904D-A426FC9B0635}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{BEABC88E-051F-4BDE-9983-9876969740B3}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | "{CBFAD0E0-AEF9-49D4-98EB-E3D5D34ADAEE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{D985AE71-8C36-4983-8F23-236AE25810B4}" = lport=137 | protocol=17 | dir=in | app=system | "{E174E308-E945-4ACF-B112-9E2D2C61D474}" = lport=138 | protocol=17 | dir=in | app=system | "{E497F5BE-F959-46D8-AE89-E5F50986DD2B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{E4D5104F-F809-4550-A14A-16B1FFEC8C56}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{EB4512F6-76FD-4896-B6C9-D8747960869C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{EE525947-B792-44C0-9F7F-23025ACB3302}" = rport=10244 | protocol=6 | dir=out | app=system | "{F2488319-7721-4A99-A92F-C3B3CB5A0B1F}" = rport=10244 | protocol=6 | dir=out | app=system | "{F2874292-07B7-4F70-A616-E2E17AEC551E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{F96746C3-51B7-4373-B65B-1355F3F3DA22}" = lport=2869 | protocol=6 | dir=in | app=system | "{FA048CBF-AD70-49DB-8F58-8CED5E531E68}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{05785197-1FB8-4377-932F-26D0E72A4DC5}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | "{0BF5D8CE-A74A-40DD-9735-FC3D3B27693E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{101E655B-6A77-4B3F-A728-4511F632C38C}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | "{2A4C372F-A3ED-4EA7-B449-274560D42360}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | "{2ED611F3-1D2A-4E27-9C07-8C9629E6A3F5}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | "{2F61DF70-00DC-45FA-ADDD-B4FC3E204D38}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | "{3ECA4C95-3A34-4490-82EF-438409EAAC23}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{3EFDC893-D4FE-418B-92F3-E5336A9B8665}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{4B7E2252-C93A-47AE-B0F3-E2735D0FF917}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | "{50ABDB24-FC97-49D9-B113-27F37B3E5960}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{527CECDB-0D82-4F4B-AE17-EBA0F28D8A42}" = dir=in | app=c:\program files\itunes\itunes.exe | "{5D7276AE-8F92-440F-9DE0-A9A103725772}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{641B0709-37C0-4701-92EF-7BA0D0E52606}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{683E987B-F5E0-45A4-BF5A-F02ED78BE4EA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{6C775624-04BF-45C2-8312-2991AC2588DE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{6D77B83E-790F-4A64-82BC-49A488C52FA2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{6EEFB2D7-8E27-4B69-A9D6-8D004A1B74FC}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | "{7188CA24-E794-4802-A127-D72EF080F6F3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{781F75C1-F343-4604-9DE0-8317AD2D9113}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{7A996AEF-318B-4424-8CB8-C6CE386D40AB}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{7EA80B0E-7C06-4880-9675-F5034166874F}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{839D2B0F-BB9C-4877-818E-342B68B5A5DE}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | "{8663DE92-6508-4C67-B39C-3599E75CB13E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{8AC7C78A-83A9-42F5-8CDB-41E2C57337C1}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{92F38F8E-D86F-4BA8-BDDB-EB7A3F4B88D2}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | "{935F72A1-74E9-484A-BBD6-191379144BDF}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | "{940C28AA-685C-470E-9440-D9866525B28B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{99856D25-F696-4921-A4A1-1B4D22DD1799}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | "{9AE88D2E-49E2-4F7A-AE13-ADF20D171AC8}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | "{A6489000-AF05-4DFA-A6AA-89F72BEF34E9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{AA5E05D0-B0F0-4B97-998A-087C4E1F29E7}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{AC4187F1-4D60-4E0C-9819-31D06488D701}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | "{B08FDFD0-690D-49EA-BAFB-49276B1944D8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{B671CF12-5386-477A-A88E-AE5882D158E2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{BF9C96B8-5F89-4DBD-96EC-CB0F82E4F46D}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{C0A0CD1F-11A2-4A4B-8788-BF5134342662}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{E9B9917A-2CF3-4CCE-93BF-4882ADA3F41A}" = protocol=6 | dir=out | app=system | "{F242E047-97E7-4E5B-AFBA-F34B536EA9E2}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu "{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology "{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store "{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1 "{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3 "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3 "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{23B8A91D-680B-462B-87AD-3D70F7341731}" = iTunes "{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7 "{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program "{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform "{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2 "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3 "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4B6B024F-F6D4-4A7B-8ADA-F9F8370320CC}" = SRS Premium Sound "{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync "{5FF02438-DDE5-4D8E-8291-577CC1A2C014}" = AkkuLine Batterie-Tool "{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites "{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2 "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour "{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security "{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime "{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey "{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP "{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent "{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 "{87C2248A-C7DD-49ED-9BCD-B312A9D0819E}" = Epson Easy Photo Print 2 "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007 "{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007 "{90120000-0015-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0015-0410-0000-0000000FF1CE}" = Microsoft Office Access MUI (Italian) 2007 "{90120000-0015-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0015-0413-0000-0000000FF1CE}" = Microsoft Office Access MUI (Dutch) 2007 "{90120000-0015-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007 "{90120000-0016-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-0410-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Italian) 2007 "{90120000-0016-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-0413-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Dutch) 2007 "{90120000-0016-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007 "{90120000-0018-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0410-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Italian) 2007 "{90120000-0018-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0413-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Dutch) 2007 "{90120000-0018-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007 "{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007 "{90120000-0019-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0019-0410-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Italian) 2007 "{90120000-0019-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0019-0413-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Dutch) 2007 "{90120000-0019-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007 "{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007 "{90120000-001A-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001A-0410-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Italian) 2007 "{90120000-001A-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001A-0413-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Dutch) 2007 "{90120000-001A-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007 "{90120000-001B-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0410-0000-0000000FF1CE}" = Microsoft Office Word MUI (Italian) 2007 "{90120000-001B-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0413-0000-0000000FF1CE}" = Microsoft Office Word MUI (Dutch) 2007 "{90120000-001B-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007 "{90120000-001F-0401-0000-0000000FF1CE}_PROHYBRIDR_{3E8EA473-ECCE-405F-A9CA-59446AEADD3A}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007 "{90120000-001F-0413-0000-0000000FF1CE}_PROHYBRIDR_{2C95E7EE-FEA7-4B3A-A6E5-DF90A88B816A}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007 "{90120000-002C-0410-0000-0000000FF1CE}" = Microsoft Office Proofing (Italian) 2007 "{90120000-002C-0413-0000-0000000FF1CE}" = Microsoft Office Proofing (Dutch) 2007 "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007 "{90120000-006E-040C-0000-0000000FF1CE}_PROHYBRIDR_{8283FD64-6A3B-4104-9E12-7CA25EF29A1A}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-006E-0410-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Italian) 2007 "{90120000-006E-0410-0000-0000000FF1CE}_PROHYBRIDR_{C0C7E58F-D0A1-4102-855B-0B7AA2E8F1C1}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-006E-0413-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Dutch) 2007 "{90120000-006E-0413-0000-0000000FF1CE}_PROHYBRIDR_{1D12BC91-360E-424C-97C4-813651313660}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007 "{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007 "{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3) "{91130407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Basic Edition 2003 "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{95120000-0122-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector "{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame "{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker "{A9FEB6D7-9C52-49FC-B956-7AB275B78890}" = ASUS FancyStart "{AC76BA86-7AD7-1031-7B44-A90100000001}" = Adobe Reader 9.0.1 - Deutsch "{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger "{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader "{B6A98E5F-D6A7-46FB-9E9D-1F7BF4434001}" = Epson Printer Software Downloader "{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun "{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint "{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D16A31F9-276D-4968-A753-FFEAC56995D0}" = Epson Print CD "{D1E5870E-E3E5-4475-98A6-ADD614524ADF}" = ATK Media "{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call "{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service "{DA41F9E9-B878-467F-95E7-27E4D1943533}" = Multimedia Card Reader "{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash "{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer "{E4A71A41-BCC8-480a-9E69-0DA29CBA7ECA}" = kikin plugin (murb.com Edition) 2.2 "{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update "{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support "{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera "{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support "{EFCEF949-9821-4759-A573-3EB8C857DF46}" = Windows Live Family Safety "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5 "{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{FA2092C5-7979-412D-A962-6485274AE1EE}" = ASUS Data Security Manager "{FBE5AA96-22F0-4C4A-8E92-4BE3498D4CCB}" = Media Go "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver "Elantech" = ETDWare PS/2-x86 7.0.5.3 WHQL "ElsterFormular für Privatanwender 12.2.1.6570p" = ElsterFormular für Privatanwender "Epson Printer Software Downloader" = Epson Printer Software Downloader "EPSON PX650 Series" = EPSON PX650 Series Printer Uninstall "EPSON Scanner" = EPSON Scan "Epson Stylus Photo PX650_TX650 Benutzerhandbuch" = Epson Stylus Photo PX650_TX650 Handbuch "ICQ Password" = ICQ Password "ICQToolbar" = ICQ Toolbar "Icy Tower v1.4_is1" = Icy Tower v1.4 "InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "InstallShield_{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun "McLoad Preinstaller" = McLoad Preinstaller "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de) "MozillaMaintenanceService" = Mozilla Maintenance Service "N360" = Norton 360 "NVIDIA Drivers" = NVIDIA Drivers "PE Builder_is1" = PE Builder 3.1.10a "Picasa 3" = Picasa 3 "PROHYBRIDR" = 2007 Microsoft Office system "SearchAnonymizer" = SearchAnonymizer "USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam "USB Mass Storage Filter Driver" = Multimedia Card Reader "VLC media player" = VLC media player 1.0.2 "WinLiveSuite_Wave3" = Windows Live Essentials "WinRAR archiver" = WinRAR ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-1510155998-2412716386-4037089523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "bd4d3a0508d364f5" = Dell Driver Download Manager "Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de) ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013 Description = Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013 Description = Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013 Description = Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013 Description = Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013 Description = Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013 Description = Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013 Description = Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013 Description = Error - 16.08.2011 00:41:34 | Computer Name = XXX| Source = Microsoft-Windows-CAPI2 | ID = 131083 Description = Error - 16.08.2011 00:41:54 | Computer Name = XXX| Source = WinMgmt | ID = 10 Description = [ Media Center Events ] Error - 12.06.2010 18:58:55 | Computer Name = XXX| Source = Mcx2Dvcs | ID = 401 Description = [ System Events ] Error - 04.10.2012 01:39:03 | Computer Name = XXX| Source = DCOM | ID = 10005 Description = Error - 04.10.2012 01:39:08 | Computer Name = XXX| Source = DCOM | ID = 10005 Description = Error - 04.10.2012 01:39:07 | Computer Name = XXX| Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000 Description = Error - 04.10.2012 01:39:13 | Computer Name = XXX| Source = DCOM | ID = 10005 Description = Error - 04.10.2012 01:40:13 | Computer Name = XXX| Source = Service Control Manager | ID = 7001 Description = Error - 04.10.2012 01:40:13 | Computer Name = XXX| Source = Service Control Manager | ID = 7001 Description = Error - 04.10.2012 01:40:13 | Computer Name = XXX| Source = Service Control Manager | ID = 7001 Description = Error - 04.10.2012 01:40:13 | Computer Name = XXX| Source = Service Control Manager | ID = 7026 Description = Error - 04.10.2012 01:40:49 | Computer Name = XXX| Source = Service Control Manager | ID = 7001 Description = Error - 04.10.2012 01:55:42 | Computer Name = XXX| Source = DCOM | ID = 10005 Description = < End of report > Code:
ATTFilter Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Datenbank Version: v2012.10.04.03 Windows Vista Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 7.0.6001.18000 XXX :: XXX [Administrator] 04.10.2012 08:19:25 mbam-log-2012-10-04 (08-24-07).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 194815 Laufzeit: 3 Minute(n), 56 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 1 C:\Users\XXX\AppData\Roaming\hellomoto (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt. Infizierte Dateien: 6 C:\Users\XXX\AppData\Local\Temp\wpbt0.dll (Trojan.FakeMS) -> Keine Aktion durchgeführt. C:\Users\XXX\Downloads\PDFCreatorSetup.exe (Adware.Agent) -> Keine Aktion durchgeführt. C:\ProgramData\lsass.exe (Trojan.Delf) -> Keine Aktion durchgeführt. C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt. C:\Users\XXX\AppData\Roaming\hellomoto\TujP.dat (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt. C:\Users\XXX\AppData\Roaming\hellomoto\BukF.dat (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt. (Ende) Gibt es eine Methode um das System zu prüfen, ob es noch irgendwelche Löcher gibt ? Wir müssen nämlich noch Updates installieren, da meine Freundin das leider NIE gemacht hat. Eine Frage hätte ich noch; Mein Desktop Rechner und der Laptop von meiner Freundin, laufen über einen W-Lan Router von Alice. Mein Desktop Rechner ist immer auf den neusten Stand, habe ihn vor kurzem erst neu auspielen müssen wegen HDD Defekt. Ist es möglich das sich mein Rechner auch Infiziert ? Der Laptop und mein Rechner sind ja übers Netzwerk verbunden. Schonmal vielen Dank für die Hilfe ![]() |
Themen zu Windows Vista: Erst BKA und jetzt GVU Trojaner.... |
bho, bonjour, continue, error, excel, firefox, flash player, frage, gfnexsrv.exe, home, infizierte dateien, install.exe, internet, kaspersky, logfile, mozilla, object, office 2007, plug-in, realtek, registry, scan, security, software, svchost.exe, sweetim, symantec, tower, trojaner, usb, usb 2.0, vista, windows, zahlung |