| |
| |||||||
Log-Analyse und Auswertung: Ransom.Gen bzw Computer blockert 100 EURWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
27.10.2012, 22:33
| #1 |
| |  Ransom.Gen bzw Computer blockert 100 EUR Erstmal ein Hallo, aufgrund der anderen Beiträge in diesem Board wurde mir schon deutlich weitergeholfen, da ich nun nicht mehr im abgesicherten Modus rumkrepeln muss um überhaupt meinen Brwoser zu benutzen. Vielen Dank, dass Ihr euch diese Arbeit macht und uns helft. Vor einigen Tagen ist mein Avira beim Besuch einer Website kurz angesprungen und mein Rechner startete sich direkt neu. Vermutlich ist der Trojaner so auf meinen Rechner gelangt und nun nach einigen Tagen hat er seine nervige blockierende Wirkung gezeigt. Nichts ging mehr. Leider hat eine Rescue-CD von Avira nichts geholfen und ich bin daraufhin auf ähnliche Threads bei euch gestossen. Habe bereits Malwarebytes ausgeführt und gelöscht/Quarantäne verschoben wie es dort erklärt wurde. Nur weil die nervige Blockierung nun weg ist heisst das ja nicht dass der Trojaner auch wirklich entfernt wurde, daher bitte ich um eure Hilfe. Anbei die erforderlichen Logs von Malwarebytes, Gmer und OTL. |
|
28.10.2012, 06:37
| #2 | |||||
| /// Helfer-Team    | Ransom.Gen bzw Computer blockert 100 EUR Hallo und Herzlich Willkommen!
__________________ Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]: Zitat:
Zitat:
Hilfeleistung - geplante Vorgehensweise:
Für Vista und Win7: Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen! 1. Zitat:
Code:
ATTFilter :OTL
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.selectedEngine: "FileConverter 1.3 Customized Web Search"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&q="
[2012.10.11 01:22:29 | 000,001,034 | ---- | M] () -- C:\Users\feddi\AppData\Roaming\mozilla\firefox\profiles\zh4tj08l.default\searchplugins\fileconverter-13-customized-web-search.xml
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SETUP.EXE /AUTORUN
O33 - MountPoints2\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\Shell\configure\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\Shell\install\command - "" = D:\SETUP.EXE
[2012.10.27 22:02:11 | 083,023,306 | ---- | M] () -- C:\ProgramData\0tbpw.pad
[2012.10.27 20:13:56 | 083,023,306 | ---- | C] () -- C:\ProgramData\0tbpw.pad
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
Zitat:
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:
3. erneut einen Scan mit OTL:
Zitat:
Nur bei Probleme inzwischen melden! ** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw grußkira
__________________ |
|
28.10.2012, 13:51
| #3 |
| | Ransom.Gen bzw Computer blockert 100 EUR Vielen Dank für die schnelle Antwort.
__________________Habe die Schritte durchgeführt: 1. Fix von OTL: Code:
ATTFilter All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "FileConverter 1.3 Customized Web Search" removed from browser.search.selectedEngine
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&q=" removed from keyword.URL
C:\Users\feddi\AppData\Roaming\mozilla\firefox\profiles\zh4tj08l.default\searchplugins\fileconverter-13-customized-web-search.xml moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\ not found.
File D:\SETUP.EXE /AUTORUN not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\ not found.
File D:\SETUP.EXE not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5d21eee-ed35-11e1-ada6-806e6f6e6963}\ not found.
File D:\SETUP.EXE not found.
C:\ProgramData\0tbpw.pad moved successfully.
File C:\ProgramData\0tbpw.pad not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\feddi\Desktop\cmd.bat deleted successfully.
C:\Users\feddi\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41620 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: feddi
->Temp folder emptied: 747275679 bytes
->Temporary Internet Files folder emptied: 21245301 bytes
->FireFox cache emptied: 100835727 bytes
->Google Chrome cache emptied: 376991601 bytes
->Flash cache emptied: 22974 bytes
User: Public
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16152349 bytes
RecycleBin emptied: 20348975 bytes
Total Files Cleaned = 1.223,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 10282012_112748
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Code:
ATTFilter Acrobat.com Adobe Systems Incorporated 23.08.2012 1,67MB 1.1.377 Adobe AIR Adobe Systems Inc. 23.08.2012 1.5.3.9120 Adobe Community Help Adobe Systems Incorporated 23.08.2012 2,52MB 3.0.0.400 Adobe Flash Player 11 Plugin Adobe Systems Incorporated 13.10.2012 2,69MB 11.4.402.287 Adobe Media Player Adobe Systems Incorporated 23.08.2012 2,69MB 1.8 Adobe Photoshop CS5 Adobe Systems Incorporated 23.08.2012 1,52GB 12.0 Adobe Reader 9 Adobe Systems Incorporated 23.08.2012 202MB 9.0.0 Applian FLV and Media Player 3.1.1.12 Applian Technologies 09.10.2012 56,8MB 3.1.1.12 ASRock IES v2.0.8 23.08.2012 7,90MB ASRock InstantBoot v1.23 23.08.2012 4,06MB ASRock OC Tuner v2.2.93 23.08.2012 20,7MB Avira Free Antivirus Avira 12.09.2012 194MB 12.0.0.1199 CCleaner Piriform 24.10.2012 4,93MB 3.24 DAEMON Tools Lite DT Soft Ltd 27.10.2012 25,7MB 4.45.4.0314 FLV Player 2.0 (build 25) Martijn de Visser 09.10.2012 1,94MB 2.0 (build 25) Google Chrome Google Inc. 24.08.2012 313MB 22.0.1229.94 HP Customer Participation Program 8.0 HP 23.08.2012 222MB 8.0 HP Imaging Device Functions 8.0 HP 23.08.2012 1,53MB 8.0 HP OCR Software 8.0 HP 23.08.2012 1,52MB 8.0 HP Photosmart Essential HP 23.08.2012 10,1MB 1.12.0.46 HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B HP 23.08.2012 75,8MB 8.0 HPSSupply Ihr Firmenname 23.08.2012 987KB 2.1.3.0000 ImgBurn LIGHTNING UK! 27.10.2012 2,92MB 2.5.7.0 MAESTIA Version 201207 RocWorks 19.10.2012 11,3GB 201207 Malwarebytes Anti-Malware Version 1.65.1.1000 Malwarebytes Corporation 27.10.2012 12,7MB 1.65.1.1000 Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 23.08.2012 36,9MB Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 23.08.2012 36,9MB Microsoft Office Professional Edition 2003 Microsoft Corporation 23.08.2012 605MB 11.0.5614.0 Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Corporation 09.10.2012 1,41MB 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 23.08.2012 590KB 9.0.30729.4148 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 23.08.2012 11,1MB 10.0.40219 Mozilla Firefox 16.0.1 (x86 de) Mozilla 12.10.2012 38,7MB 16.0.1 Mozilla Maintenance Service Mozilla 12.10.2012 204KB 16.0.1 NVIDIA 3D Vision Controller-Treiber 305.67 NVIDIA Corporation 23.08.2012 4,16MB 305.67 NVIDIA 3D Vision Treiber 305.67 NVIDIA Corporation 23.08.2012 25,6MB 305.67 NVIDIA Grafiktreiber 305.67 NVIDIA Corporation 23.08.2012 120MB 305.67 NVIDIA Update 1.10.8 NVIDIA Corporation 23.08.2012 1,00MB 1.10.8 PDFCreator Frank Heindörfer, Philip Chinery 23.08.2012 30,1MB 1.2.2 Realtek 8169 8168 8101E 8102E Ethernet Driver Realtek 23.08.2012 1,61MB 1.00.0000 Realtek High Definition Audio Driver Realtek Semiconductor Corp. 23.08.2012 9,28MB 6.0.1.5730 VideoPerformer PerformerSoft LLC 09.10.2012 24,3MB WinRAR 4.01 (32-Bit) win.rar GmbH 23.08.2012 4,02MB 4.01.0 World of Warcraft Blizzard Entertainment 21.09.2012 19,2GB 5.0.5.16057 xp-AntiSpy 3.98-2 Christian Taubenheim 23.08.2012 704KB OTL.txt Code:
ATTFilter OTL logfile created on: 28.10.2012 11:42:07 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\feddi\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,19 Gb Total Physical Memory | 2,23 Gb Available Physical Memory | 70,04% Memory free 6,59 Gb Paging File | 5,57 Gb Available in Paging File | 84,56% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 465,76 Gb Total Space | 328,75 Gb Free Space | 70,58% Space Free | Partition Type: NTFS Drive E: | 87,85 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: FEDDI-PC | User Name: feddi | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.10.27 21:36:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\feddi\Desktop\OTL.exe PRC - [2012.10.13 08:56:21 | 001,807,800 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe PRC - [2012.10.12 21:03:42 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2012.08.24 18:09:01 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.08.09 00:18:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.08.08 17:25:03 | 000,864,104 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe PRC - [2012.08.08 17:24:49 | 001,820,520 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe PRC - [2012.08.08 10:30:02 | 000,382,312 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.05.02 00:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.01 23:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.04.24 01:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.04.11 10:54:22 | 003,672,384 | ---- | M] (DT Soft Ltd) -- C:\Programme\DAEMON Tools Lite\DTLite.exe PRC - [2009.04.11 14:18:30 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2003.06.19 22:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\VS7DEBUG\MDM.EXE ========== Modules (No Company Name) ========== MOD - [2012.10.13 08:56:21 | 009,814,968 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_287.dll MOD - [2012.10.12 21:03:42 | 002,294,240 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2012.08.08 10:29:44 | 000,373,608 | ---- | M] () -- C:\Programme\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll MOD - [2011.05.28 21:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll MOD - [2008.05.07 20:33:46 | 000,417,792 | ---- | M] () -- C:\Programme\Adobe\Reader 9.0\Reader\AdobeXMP.dll MOD - [2007.11.16 15:02:18 | 000,479,232 | R--- | M] () -- C:\Programme\Adobe\Reader 9.0\Reader\ccme_base.dll MOD - [2007.11.16 15:02:18 | 000,401,408 | R--- | M] () -- C:\Programme\Adobe\Reader 9.0\Reader\cryptocme2.dll MOD - [2006.12.10 20:51:08 | 000,077,824 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmltok.dll MOD - [2006.12.10 20:51:08 | 000,065,536 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmlparse.dll ========== Services (SafeList) ========== SRV - [2012.10.13 08:56:21 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.10.12 21:03:42 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.08.09 00:18:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.08.08 10:30:02 | 000,382,312 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.05.02 00:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.01 23:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.02.19 12:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2008.01.21 03:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2003.07.28 11:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) SRV - [2003.06.19 22:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\VS7DEBUG\MDM.EXE -- (MDM) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - [2012.10.27 19:41:36 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2012.08.09 00:18:00 | 010,782,568 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2012.04.27 09:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.04.24 23:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.04.16 20:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.08.06 09:26:08 | 000,124,928 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\SearchScopes,DefaultScope = IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..CT3241949.browser.search.defaultthis.engineName: true FF - prefs.js..browser.search.selectedEngine: "" FF - prefs.js..browser.search.useDBForOrder: true FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\feddi\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\feddi\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.12 21:03:42 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.12 21:03:42 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.23 17:57:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\feddi\AppData\Roaming\mozilla\Extensions [2012.10.23 16:17:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\feddi\AppData\Roaming\mozilla\Firefox\Profiles\zh4tj08l.default\extensions [2012.09.07 17:56:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.10.12 21:03:42 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.07.14 01:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.08.29 18:26:39 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.07.14 01:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.07.14 01:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.14 01:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.14 01:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\feddi\AppData\Local\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\feddi\AppData\Local\Google\Chrome\Application\22.0.1229.94\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\feddi\AppData\Local\Google\Chrome\Application\22.0.1229.94\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [ASRockIES] File not found O4 - HKCU..\Run: [ASRockOCTuner] File not found O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [zASRockInstantBoot] File not found O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{00019FBA-7F86-419B-A08E-D1F1F919AA5F}: DhcpNameServer = 192.168.2.1 192.168.2.1 O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img23.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img23.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.10.28 11:38:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2012.10.28 11:38:39 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2012.10.28 11:27:48 | 000,000,000 | ---D | C] -- C:\_OTL [2012.10.27 21:36:41 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\feddi\Desktop\OTL.exe [2012.10.27 21:09:07 | 000,000,000 | ---D | C] -- C:\Users\feddi\AppData\Roaming\Malwarebytes [2012.10.27 21:08:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.10.27 21:08:54 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.10.27 21:08:54 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.10.27 21:08:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.10.27 20:15:09 | 000,000,000 | ---D | C] -- C:\Users\feddi\AppData\Roaming\ImgBurn [2012.10.27 20:12:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn [2012.10.27 20:12:46 | 000,000,000 | ---D | C] -- C:\Program Files\ImgBurn [2012.10.27 19:41:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite [2012.10.27 19:41:36 | 000,242,240 | ---- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys [2012.10.27 19:41:33 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite [2012.10.27 19:31:15 | 000,000,000 | ---D | C] -- C:\Users\feddi\AppData\Roaming\DAEMON Tools Pro [2012.10.27 19:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Pro [2012.10.19 22:12:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAESTIA [2012.10.19 22:02:27 | 000,000,000 | ---D | C] -- C:\MAESTIA [2012.10.19 21:59:23 | 000,000,000 | ---D | C] -- C:\Users\feddi\Maestia [2012.10.09 19:56:29 | 000,000,000 | ---D | C] -- C:\Users\feddi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoPerformer [2012.10.09 19:56:06 | 000,000,000 | ---D | C] -- C:\Program Files\VideoPerformer [2012.10.09 19:54:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Applian Technologies [2012.10.09 19:54:27 | 000,000,000 | ---D | C] -- C:\Program Files\Applian Technologies [2012.10.09 19:52:31 | 000,000,000 | ---D | C] -- C:\Program Files\FLV Player [2012.10.08 09:24:49 | 000,000,000 | ---D | C] -- C:\Users\feddi\AppData\Roaming\NVIDIA [2012.09.28 21:00:54 | 000,000,000 | ---D | C] -- C:\Users\feddi\AppData\Local\Facebook ========== Files - Modified Within 30 Days ========== [2012.10.28 11:38:39 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012.10.28 11:37:30 | 000,618,130 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.10.28 11:37:30 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.10.28 11:37:30 | 000,122,624 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.10.28 11:37:30 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.10.28 11:30:13 | 000,003,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.10.28 11:30:13 | 000,003,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.10.28 11:30:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.10.27 22:34:31 | 003,587,288 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.10.27 22:03:54 | 000,302,592 | ---- | M] () -- C:\Users\feddi\Desktop\hx6gth1i.exe [2012.10.27 21:36:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\feddi\Desktop\OTL.exe [2012.10.27 21:08:55 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.10.27 20:12:46 | 000,001,650 | ---- | M] () -- C:\Users\Public\Desktop\ImgBurn.lnk [2012.10.27 19:42:09 | 000,001,735 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk [2012.10.27 19:41:36 | 000,242,240 | ---- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys [2012.10.27 19:38:44 | 000,001,356 | ---- | M] () -- C:\Users\feddi\AppData\Local\d3d9caps.dat [2012.10.25 22:45:15 | 000,001,542 | ---- | M] () -- C:\Users\feddi\Documents\news [2012.10.21 19:34:57 | 000,007,168 | ---- | M] () -- C:\Users\feddi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.10.19 22:12:24 | 000,000,542 | ---- | M] () -- C:\Users\Public\Desktop\MAESTIA.lnk [2012.10.13 08:56:22 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.10.13 08:56:21 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2012.10.13 08:56:21 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2012.10.10 22:01:35 | 000,002,042 | ---- | M] () -- C:\Users\feddi\Desktop\Google Chrome.lnk [2012.10.10 16:14:03 | 003,837,257 | ---- | M] () -- C:\Users\feddi\Documents\Vertrag-REWE.pdf [2012.10.10 16:13:40 | 001,781,384 | ---- | M] () -- C:\Users\feddi\Documents\Anschr-REWE.pdf [2012.10.08 09:23:32 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\AdobeAAMUpdater-1.0-feddi-PC-feddi.job [2012.09.29 18:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys ========== Files Created - No Company Name ========== [2012.10.28 11:38:39 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012.10.27 22:03:54 | 000,302,592 | ---- | C] () -- C:\Users\feddi\Desktop\hx6gth1i.exe [2012.10.27 21:08:55 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.10.27 20:12:46 | 000,001,662 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk [2012.10.27 20:12:46 | 000,001,650 | ---- | C] () -- C:\Users\Public\Desktop\ImgBurn.lnk [2012.10.27 19:42:09 | 000,001,735 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk [2012.10.25 22:45:12 | 000,001,542 | ---- | C] () -- C:\Users\feddi\Documents\news [2012.10.19 22:12:24 | 000,000,542 | ---- | C] () -- C:\Users\Public\Desktop\MAESTIA.lnk [2012.10.10 16:13:58 | 003,837,257 | ---- | C] () -- C:\Users\feddi\Documents\Vertrag-REWE.pdf [2012.10.10 16:13:33 | 001,781,384 | ---- | C] () -- C:\Users\feddi\Documents\Anschr-REWE.pdf [2012.10.08 09:23:32 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\AdobeAAMUpdater-1.0-feddi-PC-feddi.job [2012.08.29 18:42:11 | 000,007,168 | ---- | C] () -- C:\Users\feddi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.08.23 18:42:07 | 000,164,274 | ---- | C] () -- C:\Windows\hpoins19.dat [2012.08.23 18:38:45 | 000,026,952 | ---- | C] () -- C:\Windows\hpomdl19.dat [2012.08.23 17:54:59 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2012.08.23 17:52:03 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2012.08.23 16:24:20 | 000,001,356 | ---- | C] () -- C:\Users\feddi\AppData\Local\d3d9caps.dat [2012.08.23 16:18:05 | 003,587,288 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2012.08.08 10:30:18 | 000,428,904 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe ========== ZeroAccess Check ========== [2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2011.01.21 17:35:22 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 14:18:30 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 14:18:20 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.10.27 19:42:30 | 000,000,000 | ---D | M] -- C:\Users\feddi\AppData\Roaming\DAEMON Tools Lite [2012.10.27 19:34:49 | 000,000,000 | ---D | M] -- C:\Users\feddi\AppData\Roaming\DAEMON Tools Pro [2012.08.23 17:40:22 | 000,000,000 | ---D | M] -- C:\Users\feddi\AppData\Roaming\DeviceVm [2012.10.27 20:16:16 | 000,000,000 | ---D | M] -- C:\Users\feddi\AppData\Roaming\ImgBurn ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 28.10.2012 11:42:07 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\feddi\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,19 Gb Total Physical Memory | 2,23 Gb Available Physical Memory | 70,04% Memory free
6,59 Gb Paging File | 5,57 Gb Available in Paging File | 84,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465,76 Gb Total Space | 328,75 Gb Free Space | 70,58% Space Free | Partition Type: NTFS
Drive E: | 87,85 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: FEDDI-PC | User Name: feddi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistApplianMP] -- "C:\Program Files\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithApplianMP] -- "C:\Program Files\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{061D8E3F-C443-4053-B17C-E275E4E24D6A}" = protocol=6 | dir=in | app=c:\program files\daemon tools pro\dtpro.exe |
"{21FDC837-F623-4AFF-BAE3-25B9BBF296F4}" = protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvidia update core\daemonu.exe |
"{57788CED-EA35-46E1-876E-961816595E63}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{7666A5D1-403C-47A6-BE4E-2FF37081DA4F}" = protocol=17 | dir=in | app=c:\world of warcraft\world of warcraft-101212\launcher.patch.exe |
"{796F30DA-9302-45FD-8616-4232F629898F}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{813C7F17-4B12-4DEE-95F8-305736AAF22D}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{823F51FC-836D-4D83-A3BC-2B39D264935D}" = protocol=17 | dir=in | app=c:\program files\daemon tools pro\dtpro.exe |
"{844B7BC2-D448-47E8-BB4C-27DED5EF1561}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{8DF023C9-CFB4-43BC-9E56-DD33E87170F7}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{B24724B8-4A86-4A73-8127-CC5B2DA965A9}" = protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvidia update core\daemonu.exe |
"{B5CE3532-753B-452F-BE9F-F9D88A5031A8}" = protocol=6 | dir=in | app=c:\world of warcraft\world of warcraft-101212\launcher.patch.exe |
"{D4AF809C-2567-4209-B98D-2F556008EE3B}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"TCP Query User{83476FFF-9074-42C9-B7C9-1DA91F24E607}C:\world of warcraft\world of warcraft-101212\temp\wow-4.3-5.0.15890-enus-downloader.exe" = protocol=6 | dir=in | app=c:\world of warcraft\world of warcraft-101212\temp\wow-4.3-5.0.15890-enus-downloader.exe |
"TCP Query User{9C200130-3B23-4E6D-901F-C5A1A9BC7680}C:\world of warcraft\world of warcraft-101212\temp\wow-4.2.1.2756-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\world of warcraft\world of warcraft-101212\temp\wow-4.2.1.2756-enus-tools-downloader.exe |
"TCP Query User{CA009AA6-D30D-40BF-BF14-A28CDA90072C}C:\world of warcraft\world of warcraft-101212\launcher.exe" = protocol=6 | dir=in | app=c:\world of warcraft\world of warcraft-101212\launcher.exe |
"UDP Query User{6820117C-47D6-4925-A819-963E5F56CF48}C:\world of warcraft\world of warcraft-101212\temp\wow-4.3-5.0.15890-enus-downloader.exe" = protocol=17 | dir=in | app=c:\world of warcraft\world of warcraft-101212\temp\wow-4.3-5.0.15890-enus-downloader.exe |
"UDP Query User{72948D27-4D09-4D6B-BDA0-605D7999025E}C:\world of warcraft\world of warcraft-101212\launcher.exe" = protocol=17 | dir=in | app=c:\world of warcraft\world of warcraft-101212\launcher.exe |
"UDP Query User{D2D3B30D-CCBC-4624-9DCF-6FD6BB7877B6}C:\world of warcraft\world of warcraft-101212\temp\wow-4.2.1.2756-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\world of warcraft\world of warcraft-101212\temp\wow-4.2.1.2756-enus-tools-downloader.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{09F25F86-F957-4051-8AB2-0E0D948BBB5D}" = 1310
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6D4553DF-2095-4D10-92C0-17934733B51D}" = 1310_Help
"{6D7E031C-4C05-4265-854A-FE9FDEA9984D}" = 1310Trb
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{8F50EC3D-C482-4445-9E4B-991A766047D5}_is1" = MAESTIA Version 201207
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 305.67
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 305.67
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 305.67
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 305.67
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Applian FLV and Media Player" = Applian FLV and Media Player 3.1.1.12
"ASRock IES_is1" = ASRock IES v2.0.8
"ASRock InstantBoot_is1" = ASRock InstantBoot v1.23
"ASRock OC Tuner_is1" = ASRock OC Tuner v2.2.93
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"DAEMON Tools Lite" = DAEMON Tools Lite
"FLV Player" = FLV Player 2.0 (build 25)
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"ImgBurn" = ImgBurn
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 16.0.1 (x86 de)" = Mozilla Firefox 16.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"VideoPerformer" = VideoPerformer
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
"World of Warcraft" = World of Warcraft
"xp-AntiSpy" = xp-AntiSpy 3.98-2
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 27.10.2012 16:33:51 | Computer Name = feddi-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.10.2012 16:33:54 | Computer Name = feddi-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.10.2012 16:33:54 | Computer Name = feddi-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.10.2012 16:33:54 | Computer Name = feddi-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.10.2012 16:33:54 | Computer Name = feddi-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.10.2012 16:33:56 | Computer Name = feddi-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.10.2012 16:33:56 | Computer Name = feddi-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.10.2012 16:33:58 | Computer Name = feddi-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.10.2012 16:33:58 | Computer Name = feddi-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.10.2012 17:07:53 | Computer Name = feddi-PC | Source = Perflib | ID = 1010
Description =
[ System Events ]
Error - 27.10.2012 16:04:41 | Computer Name = feddi-PC | Source = DCOM | ID = 10005
Description =
Error - 27.10.2012 16:04:43 | Computer Name = feddi-PC | Source = DCOM | ID = 10005
Description =
Error - 27.10.2012 16:05:36 | Computer Name = feddi-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 27.10.2012 16:05:36 | Computer Name = feddi-PC | Source = Service Control Manager | ID = 7026
Description =
Error - 27.10.2012 16:05:49 | Computer Name = feddi-PC | Source = DCOM | ID = 10005
Description =
Error - 27.10.2012 16:31:29 | Computer Name = feddi-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description =
Error - 27.10.2012 17:33:20 | Computer Name = feddi-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description =
Error - 28.10.2012 05:40:45 | Computer Name = feddi-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description =
Error - 28.10.2012 06:27:48 | Computer Name = feddi-PC | Source = Service Control Manager | ID = 7034
Description =
Error - 28.10.2012 06:29:59 | Computer Name = feddi-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description =
< End of report >
|
|
29.10.2012, 11:19
| #4 |
| /// Helfer-Team | Ransom.Gen bzw Computer blockert 100 EUR Systemreinigung und Prüfung: ► Wenn Du nun alle Schritte erledigt hast, melde dich mit die gewünschten Ergebnisse zurück! Nur bei Probleme inzwischen melden! 1. Aktualisieren: Code:
ATTFilter Adobe Reader 9
- Während der Installation aufpassen/mitlesen!: Wenn irgendeine Software, Toolbar etc angeboten wird, bitte abwählen! - (z.B "McAfee Security Scan Plus") 2. Tipps - Der Internet Explorer von Microsoft gehört zur Grundausstattung unter Windows, somit wie alle andere installierte Software muss gepflegt werden! Auch bei Nicht-Verwendung!: -> Tipps zu Internet Explorer -> Standard Suchmaschine des Explorers ändern -> Ändern oder Auswählen eines Suchanbieters in Internet Explorer 7/8 -> Wie kann ich den Cache im Internet Explorer leeren? 3. Alle Programme/Fenster schliessen reinige dein System mit CCleaner:
4. Vorbereitung
Den PC NUR online scannen und NICHT ein zweites Antivirenprogramm installieren!!!
► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?
__________________ Warnung!: Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein! Anhang nicht öffnen, in unserem Forum erst nachfragen! Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten! Bitte diese Warnung weitergeben, wo Du nur kannst! |
|
29.10.2012, 18:23
| #5 |
| | Ransom.Gen bzw Computer blockert 100 EUR erledigt Die Funde von ESET scheinen zwar nichts mit dem o.g. Virus zu tun zu haben, aber ich poste sie Dir trotzdem mal. Es waren sehr sehr viele Windows- und IE-updates notwendig. Code:
ATTFilter C:\Program Files\PDFCreator\Toolbar\pdfforge Toolbar-4_4_0_setup.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined
C:\Users\feddi\Documents\dl\PDFCreator-1_2_2_setup.exe multiple threats cleaned by deleting - quarantined
C:\Users\feddi\Downloads\DTLite4454-0314.exe Win32/OpenCandy application cleaned by deleting - quarantined
C:\Users\feddi\Downloads\VideoPerformer.exe a variant of Win32/InstallBrain.L application cleaned by deleting - quarantined
LG orient |
|
29.10.2012, 18:39
| #6 | ||
| /// Helfer-Team | Ransom.Gen bzw Computer blockert 100 EUR ** Lass dein System in der nächste Zeit noch unter Beobachtung! wenn alles gut verlaufen ist und dein System läuft stabil,mache folgendes: 1. Programme deinstallieren/entfernen, die wir verwendet haben und nicht brauchst, bis auf: Code:
ATTFilter CCleaner
2. Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
3. Windows legt beispielsweise regelmäßig Schattenkopien an (mindestens einmal täglich), die im Notfall zur Wiederherstellung des Systems und zum Zugriff auf ältere Dateiversionen dienen. Diese Funktion belegt sehr viel Speicherplatz. Standardmäßig beträgt der für Schattenkopien reservierte Speicherplatz 15 % der Volumegröße, so dass die Systemleistung auch beeinträchtigt wird. Außerdem gelöschte und ev. schädliche Objekte, die in der Systemwiederherstellung sitzen, müssen auch entfernt werden: Also mach bitte folgendes:
4. Ich würde Dir vorsichtshalber raten, dein Passwort zu ändern (man sollte alle 3-4 Monate machen) z.B. Login-, Mail- oder Website-Passwörter Tipps: Die sichere Passwort-Wahl - (sollte man eigentlich regelmäßigen Abständen ca. alle 3-5 Monate ändern) auch noch hier unter: Sicheres Kennwort (Password) 5. ► Schaue bitte nach, ob für Windows neue Update gibt?!:-> - Microsoft Update hält Ihren Computer auf dem neuesten Stand! -> Installiere jedes Update das Dir angeboten wird, wiederhole den Vorgang so oft, bis nicht mehr gibt Lesestoff Nr.1: Gib Kriminellen Handlungen keine Chance! Zitat:
** Der gesunde Menschenverstand, Windows und Internet-Software sicher konfigurieren ist der beste Weg zur Sicherheit im Webverkehr ist !! Zitat:
► Kann sich auf Dauer eine Menge Datenmüll ansammeln, sich Fehlermeldungen häufen, der PC ist wahrscheinlich nicht mehr so schnell, wie früher:
Wenn Du uns unterstützen möchtest→ Spendekonto gruß kira
__________________ --> Ransom.Gen bzw Computer blockert 100 EUR |
|
29.10.2012, 20:05
| #7 |
| | Ransom.Gen bzw Computer blockert 100 EUR Vielen Dank Kira für die kompetente und schnelle Hilfe |
|
| Themen zu Ransom.Gen bzw Computer blockert 100 EUR |
| abgesicherten, anderen, arbeit, avira, beiträge, besuch, blocker, board, computer, direkt, entfernt, gmer, malwarebytes, modus, nervige, nicht mehr, nichts, rechner, starte, threads, trojaner, verschoben, website, wirklich, überhaupt |
.
) Eine weitere höchst unsichere Quelle ist das File-Sharing der sog. (Musik-)Tauschbörse. 
Linear-Darstellung
