| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Claro Search auf Windows Vista entfernenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
23.12.2012, 16:04
| #16 | |
| /// TB-Ausbilder  |  Claro Search auf Windows Vista entfernen So ein letzte Fix: Fix mit OTL # Kontrollscan mit OTL
__________________  Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 17:09
| #17 |
 | Claro Search auf Windows Vista entfernen Ich nehme an, dass beim Fix die Optionen von OTL nicht so wichtig sind
__________________und dass beim Kontrollscan die gleichen Optionen genommen werden sollen wie beim letzten Mal ? |
|
23.12.2012, 17:17
| #18 |
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen Ja es geht nur um die Kontrolle.
__________________
__________________ |
|
23.12.2012, 17:29
| #19 |
| | Claro Search auf Windows Vista entfernen Hier nun die Ausgabe von OTL nach dem Fix. Der Kontrollscan wird jetzt gleich gestartet. Code:
ATTFilter All processes killed
========== OTL ==========
Service BrowserProtect stopped successfully!
Service BrowserProtect deleted successfully!
File move failed. C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe scheduled to be moved on reboot.
Prefs.js: "Claro Search" removed from browser.search.selectedEngine
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\COMPONENTS folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\chrome\skin folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\chrome\LOCALE\EN-US folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\chrome\LOCALE folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\chrome\CONTENT folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\chrome folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CA6319C0-31B7-401E-A518-A07C3DB8F777}\ deleted successfully.
C:\Program Files\Google BAE\BAE.dll moved successfully.
C:\Program Files\Enigma Software Group\SpyHunter\Log folder moved successfully.
C:\Program Files\Enigma Software Group\SpyHunter folder moved successfully.
C:\Program Files\Enigma Software Group folder moved successfully.
Folder move failed. C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\BrowserProtect\2.5.1005.80 scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\BrowserProtect scheduled to be moved on reboot.
C:\ProgramData\䗈Ǔ䉸Ǔ0 folder moved successfully.
Folder C:\ProgramData\䗈Ǔ䉸Ǔ0\ not found.
Folder C:\ProgramData\䗈Ǔ䉸Ǔ0\ not found.
C:\ProgramData\䗈ǩ䉸ǩ0 folder moved successfully.
Folder C:\ProgramData\䗈ǩ䉸ǩ0\ not found.
Folder C:\ProgramData\䗈ǩ䉸ǩ0\ not found.
C:\ProgramData\䗈ø䉸ø0 folder moved successfully.
Folder C:\ProgramData\䗈ø䉸ø0\ not found.
Folder C:\ProgramData\䗈ø䉸ø0\ not found.
C:\ProgramData\䗈Ǥ䉸Ǥ0 folder moved successfully.
Folder C:\ProgramData\䗈Ǥ䉸Ǥ0\ not found.
Folder C:\ProgramData\䗈Ǥ䉸Ǥ0\ not found.
C:\ProgramData\䗈ē䉸ē0 folder moved successfully.
Folder C:\ProgramData\䗈ē䉸ē0\ not found.
Folder C:\ProgramData\䗈ē䉸ē0\ not found.
C:\ProgramData\䗈þ䉸þ0 folder moved successfully.
Folder C:\ProgramData\䗈þ䉸þ0\ not found.
Folder C:\ProgramData\䗈þ䉸þ0\ not found.
C:\ProgramData\䗈¢䉸¢0 folder moved successfully.
Folder C:\ProgramData\䗈¢䉸¢0\ not found.
Folder C:\ProgramData\䗈¢䉸¢0\ not found.
C:\ProgramData\䗈x䉸x0 folder moved successfully.
Folder C:\ProgramData\䗈x䉸x0\ not found.
Folder C:\ProgramData\䗈x䉸x0\ not found.
C:\ProgramData\䗈ë䉸ë0 folder moved successfully.
Folder C:\ProgramData\䗈ë䉸ë0\ not found.
Folder C:\ProgramData\䗈ë䉸ë0\ not found.
C:\ProgramData\䗈Ĥ䉸Ĥ0 folder moved successfully.
Folder C:\ProgramData\䗈Ĥ䉸Ĥ0\ not found.
Folder C:\ProgramData\䗈Ĥ䉸Ĥ0\ not found.
C:\ProgramData\䗈Ȉ䉸Ȉ0 folder moved successfully.
Folder C:\ProgramData\䗈Ȉ䉸Ȉ0\ not found.
Folder C:\ProgramData\䗈Ȉ䉸Ȉ0\ not found.
C:\ProgramData\䗈ƴ䉸ƴ0 folder moved successfully.
Folder C:\ProgramData\䗈ƴ䉸ƴ0\ not found.
Folder C:\ProgramData\䗈ƴ䉸ƴ0\ not found.
C:\ProgramData\䗈D䉸D0 folder moved successfully.
Folder C:\ProgramData\䗈D䉸D0\ not found.
Folder C:\ProgramData\䗈D䉸D0\ not found.
C:\ProgramData\䗈ǒ䉸ǒ0 folder moved successfully.
Folder C:\ProgramData\䗈ǒ䉸ǒ0\ not found.
Folder C:\ProgramData\䗈ǒ䉸ǒ0\ not found.
ADS C:\ProgramData\TEMP:5F64C164 deleted successfully.
========== FILES ==========
========== COMMANDS ==========
[EMPTYTEMP]
User: Admin
->Temp folder emptied: 65536 bytes
->Temporary Internet Files folder emptied: 15175285 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 1510918 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 405 bytes
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 29119 bytes
Total Files Cleaned = 16,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 12232012_171258
Files\Folders moved on Reboot...
C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe moved successfully.
C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings folder moved successfully.
C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content folder moved successfully.
C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components folder moved successfully.
C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension folder moved successfully.
C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} folder moved successfully.
C:\ProgramData\BrowserProtect\2.5.1005.80 folder moved successfully.
C:\ProgramData\BrowserProtect folder moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.settings moved successfully.
File\Folder C:\Windows\temp\JET2AA8.tmp not found!
C:\Windows\temp\JETB357.tmp moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Code:
ATTFilter OTL logfile created on: 23.12.2012 17:31:26 - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Admin\Desktop Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,04 Gb Available Physical Memory | 52,23% Memory free 4,23 Gb Paging File | 2,94 Gb Available in Paging File | 69,63% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 86,31 Gb Total Space | 6,61 Gb Free Space | 7,65% Space Free | Partition Type: NTFS Drive D: | 100,00 Gb Total Space | 45,71 Gb Free Space | 45,71% Space Free | Partition Type: NTFS Drive F: | 43,65 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: XXXXXXX | User Name: Admin | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: On | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Admin\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files\Personal\bin\Personal.exe (Technology Nexus AB) PRC - C:\Program Files\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (ACD Systems) PRC - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe () PRC - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe () PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (Western Digital Technologies, Inc.) PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC) PRC - C:\Program Files\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.) PRC - C:\Users\Admin\AppData\Roaming\T-Mobile Internet Manager\ouc.exe (Huawei Technologies Co., Ltd.) PRC - C:\Program Files\WinTV\WinTV7\WinTVTray.exe (Hauppauge Computer Works, Inc.) PRC - C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe (Hauppauge Computer Works) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Program Files\Sony\WiseWan\NovatelDetection\VAIODetection.exe ( Sony VOE) PRC - C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe (Sony Corporation) PRC - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation) PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.) PRC - C:\Program Files\FRITZ!DSL\StCenter.exe (AVM Berlin) PRC - C:\Program Files\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin) PRC - C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe (Sony Corporation) PRC - C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation) PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.) PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.) PRC - C:\Program Files\Protector Suite QL\upeksvr.exe (UPEK Inc.) PRC - C:\Program Files\Protector Suite QL\psqltray.exe (UPEK Inc.) PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation) PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe (Sony Corporation) PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation) PRC - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation) PRC - C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation) PRC - C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe (Sony Corporation) PRC - C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation) PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION) PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe (TOSHIBA CORPORATION.) PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\Apoint\ApMsgFwd.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.) PRC - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.) ========== Modules (No Company Name) ========== MOD - C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll () MOD - C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll () MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\Program Files\WinTV\TVServer\HauppaugeTVServerps.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll () MOD - C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll () MOD - C:\Program Files\Sony\VAIO Camera Utility\VCULib.dll () MOD - C:\Windows\System32\TosCommAPI.dll () ========== Services (SafeList) ========== SRV - (CLTNetCnService) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon File not found SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (WDFME) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe () SRV - (WDSC) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe () SRV - (WDDMService) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC) SRV - (HauppaugeTVServer) -- C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe (Hauppauge Computer Works) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (BcmSqlStartupSvc) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation) SRV - (IGDCTRL) -- C:\Program Files\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin) SRV - (SSScsiSV) -- C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe (Sony Corporation) SRV - (SonicStage Back-End Service) -- C:\Program Files\Common Files\Sony Shared\AvLib\SsBeSvc.exe (Sony Corporation) SRV - (VAIOMediaPlatform-IntegratedServer-AppServer) -- C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe (Sony Corporation) SRV - (VAIOMediaPlatform-UCLS-UPnP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe (Sony Corporation) SRV - (VAIOMediaPlatform-IntegratedServer-UPnP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe (Sony Corporation) SRV - (VAIOMediaPlatform-UCLS-AppServer) -- C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe (Sony Corporation) SRV - (VAIO Entertainment TV Device Arbitration Service) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe (Sony Corporation) SRV - (VAIOMediaPlatform-UCLS-HTTP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe (Sony Corporation) SRV - (VAIOMediaPlatform-IntegratedServer-HTTP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe (Sony Corporation) SRV - (VAIOMediaPlatform-Mobile-Gateway) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe (Sony Corporation) SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AvLib\MSCSPTISRV.exe (Sony Corporation) SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AvLib\SPTISRV.exe (Sony Corporation) SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AvLib\PACSPTISVR.exe () SRV - (Vcsw) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation) SRV - (VzFw) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe (Sony Corporation) SRV - (VzCdbSvc) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation) SRV - (VAIO Event Service) -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation) SRV - (TOSHIBA Bluetooth Service) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION) ========== Driver Services (SafeList) ========== DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found DRV - (hwusbfake) -- system32\DRIVERS\ewusbfake.sys File not found DRV - (catchme) -- C:\Users\Admin\AppData\Local\Temp\catchme.sys File not found DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation) DRV - (hcwAVD2) -- C:\Windows\System32\drivers\HCWUSB2AV.sys (Conexant Systems, Inc.) DRV - (FTDIBUS) -- C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (hwusbdev) -- C:\Windows\System32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.) DRV - (WDC_SAM) -- C:\Windows\System32\drivers\wdcsam.sys (Western Digital Technologies) DRV - (BMLoad) -- C:\Windows\System32\drivers\BMLoad.sys (Bytemobile, Inc.) DRV - (tcpipBM) -- C:\Windows\System32\drivers\tcpipBM.sys (Bytemobile, Inc.) DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.) DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation) DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION) DRV - (tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (shpf) -- C:\Windows\System32\drivers\shpf.sys (Sony Corporation) DRV - (tosrfbnp) -- C:\Windows\System32\drivers\tosrfbnp.sys (TOSHIBA Corporation) DRV - (R5U870FLx86) -- C:\Windows\System32\drivers\R5U870FLx86.sys (Ricoh) DRV - (R5U870FUx86) -- C:\Windows\System32\drivers\R5U870FUx86.sys (Ricoh) DRV - (NWADI) -- C:\Windows\System32\drivers\NWADIenum.sys (Novatel Wireless Inc) DRV - (ti21sony) -- C:\Windows\System32\drivers\ti21sony.sys (Texas Instruments) DRV - (NETw3v32) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation) DRV - (DMICall) -- C:\Windows\System32\drivers\DMICall.sys (Sony Corporation) DRV - (SNC) -- C:\Windows\System32\drivers\SonyNC.sys (Sony Corporation) DRV - (tosporte) -- C:\Windows\System32\drivers\tosporte.sys (TOSHIBA Corporation) DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.) DRV - (SPI) -- C:\Windows\System32\drivers\SonyPI.sys (Sony Corporation) DRV - (SonyImgF) -- C:\Windows\System32\drivers\SonyImgF.sys (Sony Corporation) DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.) DRV - (iComp) -- C:\Windows\System32\drivers\HCWUSB2.sys (Hauppauge Computer Works, Inc.) DRV - (Tosrfcom) -- C:\Windows\System32\drivers\tosrfcom.sys (TOSHIBA Corporation) DRV - (tosrfnds) -- C:\Windows\System32\drivers\tosrfnds.sys (TOSHIBA Corporation.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://partnerpage.google.com/eu.s [Binary data over 200 bytes] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://partnerpage.google.com/eu.s [Binary data over 200 bytes] IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 45 E3 2E C7 DF DF CD 01 [binary data] IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..\SearchScopes\{631D8DC9-02BE-4B93-994E-569D0AA83624}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=caa1ac93-d441-4705-bb9f-4bca8ba052e4&apn_sauid=5E7C3CF7-EEFA-4614-BA26-EE50AE5A82CD IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Claro Search" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@se.nexus/Personal: C:\Program Files\Personal\bin\np_prsnl.dll (Technology Nexus AB) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.05 15:12:42 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.12.05 15:12:33 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.05 15:12:42 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.12.05 15:12:33 | 000,000,000 | ---D | M] [2009.06.25 06:29:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions [2012.12.22 20:41:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\3dznt9xt.default-1356134083305\Extensions [2012.12.23 17:13:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2012.12.05 15:12:31 | 000,000,000 | ---D | M] (pdfforge Toolbar Plugin) -- C:\Program Files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402} [2012.12.05 15:12:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012.12.05 15:12:42 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.06.29 19:05:58 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.08.30 09:05:09 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.06.29 19:05:58 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.06.29 19:05:58 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.29 19:05:58 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.29 19:05:58 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: () CHR - default_search_provider: search_url = CHR - default_search_provider: suggest_url = CHR - homepage: hxxp://www.claro-search.com/?affID=114506&tt=5112_8&babsrc=HP_clro&mntrId=8866423e0000000000000019d2b5669a CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\ CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\ CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\ CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2012.12.22 23:35:49 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Germany GmbH) O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Germany GmbH) O3 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Germany GmbH) O4 - HKLM..\Run: [ACSW14DE] C:\Program Files\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (ACD Systems) O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.) O4 - HKLM..\Run: [DataCardMonitor] C:\Program Files\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.) O4 - HKLM..\Run: [DRCU] C:\Program Files\Sony\DRCU\DRCU.exe (Sony Corporation) O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.) O4 - HKLM..\Run: [VAIOCameraUtility] C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe (Sony Corporation) O4 - HKLM..\Run: [VAIODetection] C:\Program Files\Sony\WiseWan\NovatelDetection\VAIODetection.exe ( Sony VOE) O4 - HKU\S-1-5-21-934988780-789137344-2609288493-1004..\Run: [HW_OPENEYE_OUC_T-Mobile Internet Manager] C:\Program Files\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..Trusted Domains: fritz.box ([]* in Lokales Intranet) O15 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..Trusted Domains: localhost ([]http in Lokales Intranet) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9BFEB1E5-4DDC-4C56-BFE7-D42653BA50AF}: DhcpNameServer = 192.168.0.1 O20 - AppInit_DLLs: (c:\PROGRA~2\BROWSE~1\251005~1.80\{C16C1~1\BrowserProtect.dll) - File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.) O20 - Winlogon\Notify\psfus: DllName - (C:\Windows\system32\psqlpwd.dll) - C:\Windows\System32\psqlpwd.dll (UPEK Inc.) O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: VIDC.ACDV - ACDV.dll File not found Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: VIDC.dvsd - C:\Program Files\Common Files\Sony Shared\VideoLib\sonydv.dll (Sony Corporation) SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.12.23 17:12:58 | 000,000,000 | ---D | C] -- C:\_OTL [2012.12.23 14:44:22 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe [2012.12.23 14:18:47 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2012.12.23 14:00:30 | 000,000,000 | ---D | C] -- C:\ComboFix [2012.12.23 13:58:51 | 005,012,898 | R--- | C] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe [2012.12.23 12:56:51 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\mbar-1.01.0.1009 [2012.12.22 23:19:43 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2012.12.22 23:19:43 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2012.12.22 23:19:42 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2012.12.22 23:19:16 | 000,000,000 | ---D | C] -- C:\Qoobox [2012.12.22 23:18:40 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2012.12.22 22:31:42 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\Admin\Desktop\dds.com [2012.12.22 22:14:08 | 000,448,512 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\TFC.exe [2012.12.22 20:06:14 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\DoNotTrackPlus [2012.12.22 19:22:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2012.12.22 14:26:44 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\ProcAlyzer Dumps [2012.12.21 23:18:51 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes [2012.12.21 23:18:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.12.21 23:18:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.12.21 23:18:29 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.12.21 23:18:28 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.12.21 23:04:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\searchplugins [2012.12.21 23:04:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\Extensions [2012.12.21 00:22:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2012.12.21 00:22:30 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2 [2012.12.19 23:17:08 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect [2012.12.19 23:15:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\PerformerSoft [2012.12.19 23:15:43 | 000,017,464 | ---- | C] (PerformerSoft LLC) -- C:\Windows\System32\roboot.exe [2012.12.19 23:14:51 | 000,000,000 | ---D | C] -- C:\Program Files\IcoFX 2 [2012.12.19 22:16:54 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\aicon [2012.12.19 22:16:49 | 000,000,000 | ---D | C] -- C:\Program Files\aicon [2012.12.19 22:16:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\@icon sushi [2012.12.15 17:58:50 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\XXXXXXXXX [2012.12.14 15:55:02 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\XXXXXXXXXXX [2012.12.12 21:57:01 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.12.12 21:57:00 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.12.12 21:57:00 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2012.12.12 21:57:00 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.12.12 21:56:59 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2012.12.12 21:56:58 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.12.12 21:56:58 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.12.12 21:56:55 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.12.12 21:53:17 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll [2012.12.12 21:53:09 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll [2012.12.12 21:53:09 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winusb.dll [2012.12.12 21:53:07 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys [2012.12.12 21:53:06 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll [2012.12.12 21:53:05 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll [2012.12.12 21:21:21 | 002,048,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012.12.12 21:21:18 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnet.dll [2012.12.12 21:21:18 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnsvr.exe [2012.12.12 21:21:03 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2012.12.05 15:12:30 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox ========== Files - Modified Within 30 Days ========== [2012.12.23 17:18:19 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics [2012.12.23 17:18:02 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.12.23 17:17:27 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.23 17:17:27 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.23 17:17:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.12.23 17:15:13 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.12.23 14:44:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe [2012.12.23 13:58:53 | 005,012,898 | R--- | M] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe [2012.12.22 23:35:49 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts [2012.12.22 22:31:42 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\Admin\Desktop\dds.com [2012.12.22 22:14:09 | 000,448,512 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\TFC.exe [2012.12.22 21:10:07 | 000,000,000 | ---- | M] () -- C:\Users\Admin\defogger_reenable [2012.12.22 18:08:04 | 000,752,008 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.12.22 18:08:04 | 000,697,526 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.12.22 18:08:04 | 000,179,980 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.12.22 18:08:04 | 000,144,632 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.12.21 23:18:35 | 000,000,866 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.21 21:41:08 | 000,547,175 | ---- | M] () -- C:\Users\Admin\Desktop\adwcleaner.exe [2012.12.21 07:53:04 | 000,496,968 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.12.19 22:16:49 | 000,000,674 | ---- | M] () -- C:\Users\Admin\Desktop\@icon sushi.lnk [2012.12.12 18:49:03 | 000,001,931 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2012.12.07 00:36:09 | 000,011,443 | ---- | M] () -- C:\Users\Admin\gsview32.ini [2012.11.26 14:41:16 | 000,015,872 | ---- | M] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.11.24 18:05:54 | 001,062,736 | ---- | M] () -- C:\Users\Admin\Documents\GARtrip.pdf ========== Files Created - No Company Name ========== [2012.12.22 23:19:43 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2012.12.22 23:19:43 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2012.12.22 23:19:43 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2012.12.22 23:19:43 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2012.12.22 23:19:43 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2012.12.22 21:10:07 | 000,000,000 | ---- | C] () -- C:\Users\Admin\defogger_reenable [2012.12.21 23:18:35 | 000,000,866 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.21 21:41:08 | 000,547,175 | ---- | C] () -- C:\Users\Admin\Desktop\adwcleaner.exe [2012.12.19 22:16:49 | 000,000,674 | ---- | C] () -- C:\Users\Admin\Desktop\@icon sushi.lnk [2012.12.12 21:53:48 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf [2012.12.12 21:53:48 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2012.11.04 21:31:57 | 000,011,443 | ---- | C] () -- C:\Users\Admin\gsview32.ini [2010.02.13 23:08:37 | 000,000,923 | -H-- | C] () -- C:\Users\Admin\AppData\Roaming\eSReg.ini [2009.12.09 14:29:26 | 000,001,356 | ---- | C] () -- C:\Users\Admin\AppData\Local\d3d9caps.dat [2009.03.27 16:10:37 | 000,015,872 | ---- | C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== ZeroAccess Check ========== [2006.11.02 13:54:18 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.01.10 20:20:55 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ACD Systems [2012.12.19 22:16:54 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\aicon [2012.05.16 15:56:08 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Audacity [2009.09.01 11:21:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\becker [2009.03.27 10:06:38 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Bytemobile [2009.12.01 00:30:10 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DassaultSystemes [2009.12.01 00:36:22 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\EDrawings [2009.11.30 20:40:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FreeCAD [2009.04.07 21:50:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FRITZ! [2012.03.10 23:44:26 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GARMIN [2009.12.01 00:33:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GuthCAD [2009.09.18 18:20:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\HCM Updater [2009.06.19 07:34:04 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\InterTrust [2010.05.24 09:39:43 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\InterVideo [2010.02.13 23:19:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\NAVI [2012.12.19 23:15:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PerformerSoft [2009.09.03 21:07:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Personal [2009.11.30 23:52:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\RibbonSoft [2011.07.27 21:59:12 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SolidDocuments [2011.11.15 16:41:48 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SumatraPDF [2009.09.18 18:32:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\T-Mobile [2010.09.13 15:16:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\T-Mobile Internet Manager [2012.11.14 13:31:57 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\VSO [2010.02.21 17:09:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\WIB2 ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2012.12.23 14:18:47 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2009.06.25 09:11:24 | 000,000,000 | ---D | M] -- C:\Boot [2012.12.23 14:19:56 | 000,000,000 | ---D | M] -- C:\ComboFix [2012.12.22 22:59:42 | 000,000,000 | ---D | M] -- C:\Config.Msi [2007.03.09 15:17:24 | 000,000,000 | ---D | M] -- C:\Documentation [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2007.03.09 06:23:14 | 000,000,000 | ---D | M] -- C:\Drivers [2012.06.28 09:52:07 | 000,000,000 | ---D | M] -- C:\Garmin [2010.05.24 10:44:45 | 000,000,000 | ---D | M] -- C:\Hauppauge [2009.03.26 15:31:07 | 000,000,000 | ---D | M] -- C:\Infineon [2009.12.09 14:33:05 | 000,000,000 | ---D | M] -- C:\Intel [2007.03.09 15:22:33 | 000,000,000 | R--D | M] -- C:\MSOCache [2009.03.27 09:39:19 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.12.23 17:13:43 | 000,000,000 | ---D | M] -- C:\Program Files [2012.12.23 17:18:28 | 000,000,000 | ---D | M] -- C:\ProgramData [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\Programme [2012.12.23 14:19:56 | 000,000,000 | ---D | M] -- C:\Qoobox [2012.12.23 17:36:30 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2010.03.08 10:34:27 | 000,000,000 | ---D | M] -- C:\temp [2010.03.08 10:34:11 | 000,000,000 | ---D | M] -- C:\tmp [2009.03.27 14:08:02 | 000,000,000 | ---D | M] -- C:\Update [2009.03.26 15:15:00 | 000,000,000 | R--D | M] -- C:\Users [2009.03.27 11:12:25 | 000,000,000 | ---D | M] -- C:\VAIO Entertainment [2012.12.23 14:15:54 | 000,000,000 | ---D | M] -- C:\Windows [2009.07.06 09:47:46 | 000,000,000 | ---D | M] -- C:\YPC_VIEW [2012.12.23 17:12:58 | 000,000,000 | ---D | M] -- C:\_OTL < %SYSTEMDRIVE%\*.* > [2012.12.21 23:09:51 | 000,003,508 | ---- | M] () -- C:\AdwCleaner[R10].txt [2012.12.21 23:16:37 | 000,003,569 | ---- | M] () -- C:\AdwCleaner[R11].txt [2012.12.21 23:29:40 | 000,003,630 | ---- | M] () -- C:\AdwCleaner[R12].txt [2012.12.21 23:44:32 | 000,003,691 | ---- | M] () -- C:\AdwCleaner[R13].txt [2012.12.22 00:30:17 | 000,002,996 | ---- | M] () -- C:\AdwCleaner[R19].txt [2012.12.20 23:52:23 | 000,009,790 | ---- | M] () -- C:\AdwCleaner[R1].txt [2012.12.22 00:31:19 | 000,003,057 | ---- | M] () -- C:\AdwCleaner[R20].txt [2012.12.22 00:35:32 | 000,002,657 | ---- | M] () -- C:\AdwCleaner[R21].txt [2012.12.22 00:37:10 | 000,002,718 | ---- | M] () -- C:\AdwCleaner[R22].txt [2012.12.22 00:45:42 | 000,002,840 | ---- | M] () -- C:\AdwCleaner[R23].txt [2012.12.22 00:51:05 | 000,002,962 | ---- | M] () -- C:\AdwCleaner[R24].txt [2012.12.22 01:10:04 | 000,003,440 | ---- | M] () -- C:\AdwCleaner[R25].txt [2012.12.22 01:20:32 | 000,003,501 | ---- | M] () -- C:\AdwCleaner[R26].txt [2012.12.22 01:31:25 | 000,003,623 | ---- | M] () -- C:\AdwCleaner[R27].txt [2012.12.22 01:39:10 | 000,003,738 | ---- | M] () -- C:\AdwCleaner[R28].txt [2012.12.22 01:44:49 | 000,003,867 | ---- | M] () -- C:\AdwCleaner[R29].txt [2012.12.20 23:53:10 | 000,009,850 | ---- | M] () -- C:\AdwCleaner[R2].txt [2012.12.22 01:46:56 | 000,003,928 | ---- | M] () -- C:\AdwCleaner[R30].txt [2012.12.22 01:51:59 | 000,004,017 | ---- | M] () -- C:\AdwCleaner[R31].txt [2012.12.22 01:59:29 | 000,004,172 | ---- | M] () -- C:\AdwCleaner[R32].txt [2012.12.22 18:37:32 | 000,004,582 | ---- | M] () -- C:\AdwCleaner[R33].txt [2012.12.22 18:47:26 | 000,004,355 | ---- | M] () -- C:\AdwCleaner[R34].txt [2012.12.22 20:39:07 | 000,011,446 | ---- | M] () -- C:\AdwCleaner[R35].txt [2012.12.22 20:57:26 | 000,004,759 | ---- | M] () -- C:\AdwCleaner[R36].txt [2012.12.22 22:01:56 | 000,004,820 | ---- | M] () -- C:\AdwCleaner[R37].txt [2012.12.23 08:58:30 | 000,004,942 | ---- | M] () -- C:\AdwCleaner[R38].txt [2012.12.21 00:00:17 | 000,002,320 | ---- | M] () -- C:\AdwCleaner[R3].txt [2012.12.21 20:41:04 | 000,002,808 | ---- | M] () -- C:\AdwCleaner[R4].txt [2012.12.21 21:42:28 | 000,002,829 | ---- | M] () -- C:\AdwCleaner[R5].txt [2012.12.21 22:04:05 | 000,003,026 | ---- | M] () -- C:\AdwCleaner[R6].txt [2012.12.21 22:24:55 | 000,003,146 | ---- | M] () -- C:\AdwCleaner[R7].txt [2012.12.21 22:57:35 | 000,003,266 | ---- | M] () -- C:\AdwCleaner[R8].txt [2012.12.21 23:04:02 | 000,003,386 | ---- | M] () -- C:\AdwCleaner[R9].txt [2012.12.22 00:37:49 | 000,002,741 | ---- | M] () -- C:\AdwCleaner[S10].txt [2012.12.22 00:46:36 | 000,002,863 | ---- | M] () -- C:\AdwCleaner[S11].txt [2012.12.22 01:23:04 | 000,003,524 | ---- | M] () -- C:\AdwCleaner[S12].txt [2012.12.22 01:31:52 | 000,003,646 | ---- | M] () -- C:\AdwCleaner[S13].txt [2012.12.22 01:40:00 | 000,003,601 | ---- | M] () -- C:\AdwCleaner[S14].txt [2012.12.22 01:47:24 | 000,003,951 | ---- | M] () -- C:\AdwCleaner[S15].txt [2012.12.22 01:52:53 | 000,003,880 | ---- | M] () -- C:\AdwCleaner[S16].txt [2012.12.22 18:41:07 | 000,004,445 | ---- | M] () -- C:\AdwCleaner[S17].txt [2012.12.22 20:41:31 | 000,011,378 | ---- | M] () -- C:\AdwCleaner[S18].txt [2012.12.22 22:02:36 | 000,004,714 | ---- | M] () -- C:\AdwCleaner[S19].txt [2012.12.20 23:53:34 | 000,009,643 | ---- | M] () -- C:\AdwCleaner[S1].txt [2012.12.21 00:00:53 | 000,002,342 | ---- | M] () -- C:\AdwCleaner[S2].txt [2012.12.21 20:42:16 | 000,002,830 | ---- | M] () -- C:\AdwCleaner[S3].txt [2012.12.21 21:43:19 | 000,002,851 | ---- | M] () -- C:\AdwCleaner[S4].txt [2012.12.21 22:04:48 | 000,003,048 | ---- | M] () -- C:\AdwCleaner[S5].txt [2012.12.21 22:25:35 | 000,003,168 | ---- | M] () -- C:\AdwCleaner[S6].txt [2012.12.21 22:58:15 | 000,003,288 | ---- | M] () -- C:\AdwCleaner[S7].txt [2012.12.21 23:04:36 | 000,003,408 | ---- | M] () -- C:\AdwCleaner[S8].txt [2012.12.22 00:31:49 | 000,002,954 | ---- | M] () -- C:\AdwCleaner[S9].txt [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat [2009.04.11 07:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr [2007.03.09 19:40:09 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK [2012.12.23 14:19:52 | 000,039,166 | ---- | M] () -- C:\ComboFix.txt [2006.09.18 22:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys [2007.03.09 15:37:54 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2007.03.09 15:37:54 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2012.12.23 17:17:06 | 2459,242,496 | -HS- | M] () -- C:\pagefile.sys [2009.09.18 18:29:51 | 000,007,361 | ---- | M] () -- C:\SoftUpdateLog.txt [2009.03.26 15:19:22 | 000,389,194 | ---- | M] () -- C:\vcredist_x86.log < %PROGRAMFILES%\*.* > [2009.03.27 09:52:10 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini Invalid Environment Variable: PROGRAMFILES(X86) < %appdata%\*. > [2012.01.10 20:20:55 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ACD Systems [2012.10.10 11:03:38 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Adobe [2012.12.19 22:16:54 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\aicon [2009.11.13 13:55:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Apple Computer [2012.05.16 15:56:08 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Audacity [2011.12.24 16:42:57 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AVS4YOU [2009.09.01 11:21:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\becker [2009.03.27 10:06:38 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Bytemobile [2009.12.01 00:30:10 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DassaultSystemes [2009.12.01 00:36:22 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\EDrawings [2009.11.30 20:40:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FreeCAD [2009.04.07 21:50:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FRITZ! [2012.03.10 23:44:26 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GARMIN [2009.03.27 10:20:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Google [2009.12.01 00:33:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GuthCAD [2009.09.18 18:20:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\HCM Updater [2007.03.09 10:52:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Identities [2009.06.19 07:34:04 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\InterTrust [2010.05.24 09:39:43 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\InterVideo [2009.03.26 23:39:03 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Macromedia [2012.12.21 23:18:51 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Malwarebytes [2012.11.19 21:47:54 | 000,000,000 | --SD | M] -- C:\Users\Admin\AppData\Roaming\Microsoft [2009.06.25 06:29:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Mozilla [2010.02.13 23:19:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\NAVI [2012.12.19 23:15:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PerformerSoft [2009.09.03 21:07:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Personal [2009.11.30 23:52:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\RibbonSoft [2012.05.15 23:07:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Roxio [2011.07.27 21:59:12 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SolidDocuments [2010.01.30 10:54:41 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Sony Corporation [2011.11.15 16:41:48 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SumatraPDF [2009.09.18 18:32:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\T-Mobile [2010.09.13 15:16:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\T-Mobile Internet Manager [2009.11.30 23:51:02 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\U3 [2011.12.24 17:09:46 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\vlc [2012.11.14 13:31:57 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\VSO [2010.02.21 17:09:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\WIB2 < %appdata%\*.* > [2010.02.14 20:47:01 | 000,000,923 | -H-- | M] () -- C:\Users\Admin\AppData\Roaming\eSReg.ini < %localappdata%\*. > [2012.01.10 21:37:48 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\ACD Systems [2012.10.10 10:39:33 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Adobe [2009.03.26 15:15:33 | 000,000,000 | -HSD | M] -- C:\Users\Admin\AppData\Local\Anwendungsdaten [2009.05.05 13:24:59 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Apple [2009.11.13 13:52:50 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Apple Computer [2009.12.01 00:30:10 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\DassaultSystemes [2012.12.22 20:06:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\DoNotTrackPlus [2012.03.09 21:23:44 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Downloaded Installations [2009.04.07 21:50:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\FRITZ! [2012.03.10 23:43:19 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Garmin [2012.03.10 23:42:54 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\GARMIN_Corp [2012.03.31 20:06:44 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Google [2012.07.16 18:45:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Macromedia [2012.07.16 18:45:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Microsoft [2010.01.01 16:11:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Microsoft Help [2009.06.25 06:29:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Mozilla [2007.03.09 15:31:51 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Seven Zip [2012.12.23 17:31:21 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Temp [2009.03.26 15:15:33 | 000,000,000 | -HSD | M] -- C:\Users\Admin\AppData\Local\Temporary Internet Files [2009.03.26 16:25:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Toshiba [2009.03.26 15:15:33 | 000,000,000 | -HSD | M] -- C:\Users\Admin\AppData\Local\Verlauf [2009.04.03 09:45:08 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\VirtualStore [2010.05.15 20:43:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\VSO [2012.01.13 13:50:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Western Digital [2012.01.13 13:45:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Western_Digital [2009.03.26 23:37:51 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\WindowsUpdate < %localappdata%\*.* > [2011.04.27 15:43:01 | 000,001,356 | ---- | M] () -- C:\Users\Admin\AppData\Local\d3d9caps.dat [2012.11.26 14:41:16 | 000,015,872 | ---- | M] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.12.04 10:03:51 | 000,132,376 | ---- | M] () -- C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT [2012.12.23 13:49:12 | 004,558,953 | -H-- | M] () -- C:\Users\Admin\AppData\Local\IconCache.db < %allusersprofile%\*. > [2012.09.23 11:51:45 | 000,000,000 | ---D | M] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2012.01.13 19:31:06 | 000,000,000 | ---D | M] -- C:\ProgramData\ACD Systems [2012.11.13 23:15:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten [2009.11.13 13:50:06 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple [2009.05.05 13:26:49 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple Computer [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data [2012.12.23 13:47:55 | 000,000,000 | ---D | M] -- C:\ProgramData\Avira [2011.12.24 16:42:57 | 000,000,000 | ---D | M] -- C:\ProgramData\AVS4YOU [2009.05.29 18:20:37 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ [2009.12.01 00:32:59 | 000,000,000 | ---D | M] -- C:\ProgramData\DassaultSystemes [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente [2011.11.15 16:23:07 | 000,000,000 | ---D | M] -- C:\ProgramData\ebro electronic [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites [2012.03.10 23:44:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Garmin [2007.03.09 15:17:08 | 000,000,000 | ---D | M] -- C:\ProgramData\Google [2011.12.27 21:54:00 | 000,000,000 | ---D | M] -- C:\ProgramData\hps [2009.12.30 18:10:08 | 000,000,000 | ---D | M] -- C:\ProgramData\JVComm32 [2012.12.21 23:18:33 | 000,000,000 | ---D | M] -- C:\ProgramData\Malwarebytes [2010.09.09 23:26:05 | 000,000,000 | ---D | M] -- C:\ProgramData\McAfee [2012.12.22 23:00:17 | 000,000,000 | --SD | M] -- C:\ProgramData\Microsoft [2012.12.12 21:56:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft Help [2012.04.26 09:30:58 | 000,000,000 | ---D | M] -- C:\ProgramData\Mozilla [2009.09.10 19:07:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Office Genuine Advantage [2012.05.15 23:07:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Roxio [2009.12.28 16:46:52 | 000,000,000 | ---D | M] -- C:\ProgramData\SeaTTY [2010.03.08 17:28:49 | 000,000,000 | ---D | M] -- C:\ProgramData\SolidDocuments [2010.01.30 10:59:48 | 000,000,000 | ---D | M] -- C:\ProgramData\Sonic [2007.03.09 11:04:04 | 000,000,000 | ---D | M] -- C:\ProgramData\Sony [2009.03.27 17:17:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Sony Corporation [2012.12.22 14:26:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Spybot - Search & Destroy [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü [2010.10.12 13:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\Sun [2009.04.05 21:18:14 | 000,000,000 | ---D | M] -- C:\ProgramData\Symantec [2012.04.02 17:43:55 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates [2011.12.29 07:13:25 | 000,000,000 | ---D | M] -- C:\ProgramData\tmp [2009.03.26 15:31:41 | 000,000,000 | ---D | M] -- C:\ProgramData\UIB [2009.03.26 15:49:07 | 000,000,000 | ---D | M] -- C:\ProgramData\VAIO Media Platform [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen [2012.01.13 13:33:01 | 000,000,000 | ---D | M] -- C:\ProgramData\Western Digital [2010.07.14 18:38:57 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch [2010.07.18 09:19:46 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2007.03.09 15:32:04 | 000,000,000 | ---D | M] -- C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1} [2009.09.14 15:31:37 | 000,000,000 | ---D | M] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD} [2009.05.05 13:27:07 | 000,000,000 | ---D | M] -- C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} < %allusersprofile%\*.* > < > [2006.11.02 14:01:23 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT [2006.11.02 14:01:23 | 000,032,510 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2009.03.27 10:07:03 | 000,000,418 | -H-- | C] () -- C:\Windows\Tasks\User_Feed_Synchronization-{A6581A79-7EC0-4E1F-82C4-B00E007E92B1}.job [2012.03.31 20:02:13 | 000,001,092 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job [2012.03.31 20:02:17 | 000,001,096 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job ========== Alternate Data Streams ========== @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Rote Tasche.JPG:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Reihenklemme.jpg:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Loftahammar.JPG:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Flaschenverschluss.JPG:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Deckstrennstelle.JPG:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Atomkraft-nein-danke.jpg:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Atomkraft-nein-danke [1600x1200].jpg:VsoSummaryInformation < End of report > Code:
ATTFilter OTL Extras logfile created on: 23.12.2012 17:31:26 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Admin\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,04 Gb Available Physical Memory | 52,23% Memory free
4,23 Gb Paging File | 2,94 Gb Available in Paging File | 69,63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 86,31 Gb Total Space | 6,61 Gb Free Space | 7,65% Space Free | Partition Type: NTFS
Drive D: | 100,00 Gb Total Space | 45,71 Gb Free Space | 45,71% Space Free | Partition Type: NTFS
Drive F: | 43,65 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: XXXXXXX | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDSee 14.Manage] -- "C:\Program Files\ACD Systems\ACDSee\14.0\ACDSeeQV14.exe" "%1" (ACD Systems International Inc.)
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Program Files\dm\dm-Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [dm-Fotowelt] -- "C:\Program Files\dm\dm-Fotowelt\dm-Fotowelt.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C76B1AD-F64B-48EE-8B0A-6EFD37954781}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{131C038A-88D3-4944-8D19-A35089E4F792}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{14EF6F75-0C06-42C3-A6B6-B2C5D7F67978}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{2E0672DF-3AC6-4E08-8DC2-3AB22EF901A4}" = rport=2869 | protocol=6 | dir=out | app=system |
"{326D7AAD-F89E-4822-8BA6-2AF2E6C383BB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{40540950-0ADB-46CE-8C4A-E234965FD3E5}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{4F269FAD-60AE-49B6-8154-B3A8C9D4727F}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{5F7A3095-B451-4356-9FE2-0FEE5DA61C39}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{627626FB-30DA-4FEC-9E3B-50480916D874}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{718F0A82-A8AD-4CEA-AB4B-B105293BA5A0}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{7CFACBF0-33DE-4E9B-9649-A7835765BE72}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{8E2F3B87-707D-44C3-AA3F-0F0D109DCB36}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{98A68F34-C3B4-4FD9-819C-EA0CA13A2111}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{A5BF901B-C537-4D0F-88F3-B4BB07319356}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C6192795-E5A9-47A3-B839-26F97B949A0C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D1A48B3D-946B-43CB-BE04-4DF27A87F5DF}" = lport=2869 | protocol=6 | dir=in | app=system |
"{E704DAA4-0CFE-4946-B239-2ACFD394A6FC}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1CA23F8C-98A4-4FB4-A64D-FAE46D92752D}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe |
"{1DD85682-DC32-4A0B-8287-E46ED4D0473C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{26766BE8-2F65-4300-B6C2-DB83A831B910}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{387564E2-BD38-47C3-BD65-5552CFA57A28}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{66A96803-BFAC-4432-B39A-0383162B4612}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe |
"{6861CCA5-BFF3-4F7A-8191-CBFB6584817A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{82627E82-88D4-4797-B9E7-546697779323}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{8BF8D836-8598-4350-B556-B62480E005B4}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe |
"{9D6716E7-E866-4440-8E21-C24978DA1082}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{AF700E13-9819-42DD-86DC-EA6D93BAC3BF}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe |
"{B950ABE6-1615-4296-8549-1D75F59F3835}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe |
"{E1DF5D75-1CD6-4504-A2EF-62C43067EDDF}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{E22C5F4E-EFE8-457D-B6B2-2BA02BAD550A}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe |
"{FE42EA36-99DE-4B51-863D-9AF79B186EE4}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"TCP Query User{2F9CE069-D6E9-4484-A9AC-C5ED0D6FB9CB}C:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe" = protocol=6 | dir=in | app=c:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe |
"TCP Query User{33A43DD4-956F-4BFA-9144-329489DE42F2}C:\windows\system32\ftp.exe" = protocol=6 | dir=in | app=c:\windows\system32\ftp.exe |
"TCP Query User{574EC694-3F75-4C2D-ACC9-27251587B01E}C:\program files\trackmaker\trackmaker.exe" = protocol=6 | dir=in | app=c:\program files\trackmaker\trackmaker.exe |
"TCP Query User{700B38F4-F7DA-42E4-8C61-5BF53133774A}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{9009642B-94E7-4CE4-9275-4A4AD1392A15}C:\program files\java\jre1.6.0\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0\bin\java.exe |
"TCP Query User{C265AF90-5A3C-4DE3-8565-D6DC72A052B4}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{C3F511ED-226B-4BF8-8F0D-7662FBB81219}C:\program files\spybot - search & destroy 2\sdupdate.exe" = protocol=6 | dir=in | app=c:\program files\spybot - search & destroy 2\sdupdate.exe |
"TCP Query User{CDBA811F-EFC9-4013-ABCC-A6694911240C}C:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe" = protocol=6 | dir=in | app=c:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe |
"UDP Query User{57955B5F-D901-4FD6-B3FC-C13E57A5C93F}C:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe" = protocol=17 | dir=in | app=c:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe |
"UDP Query User{6824E8A8-3B46-4848-AE25-C30FA207D8A3}C:\program files\trackmaker\trackmaker.exe" = protocol=17 | dir=in | app=c:\program files\trackmaker\trackmaker.exe |
"UDP Query User{7D17D5E7-063D-44AE-81D0-0AA12117FAC6}C:\program files\spybot - search & destroy 2\sdupdate.exe" = protocol=17 | dir=in | app=c:\program files\spybot - search & destroy 2\sdupdate.exe |
"UDP Query User{8D7BEF79-7D48-4734-8CE5-780A84DFF041}C:\program files\java\jre1.6.0\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0\bin\java.exe |
"UDP Query User{8F7B5C06-33B3-4AC4-917F-DC12FB601C6F}C:\windows\system32\ftp.exe" = protocol=17 | dir=in | app=c:\windows\system32\ftp.exe |
"UDP Query User{9C6E22AD-E2DF-449A-B25A-0589E48EDE26}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{DF8D8676-4222-4C81-8195-D8183C1D5B33}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{E871705B-008A-45A3-946A-78229ED7427D}C:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe" = protocol=17 | dir=in | app=c:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"@icon sushi_is1" = @icon sushi 1.21
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{009E7FB7-1775-4D89-8956-F5C9A1C019FC}" = DSD Playback Plug-in
"{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}" = Sony Video Shared Library
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (VAIO_VEDB)
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent
"{0AF342A7-A435-4980-940A-9DA4AD48E399}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{0F6F6876-6334-4977-B5DD-CFC12E193420}" = iTunes
"{10113A44-CBFF-4FF7-8A13-BD1EC4180C56}" = Protector Suite QL 5.6
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP100_series" = Canon iP100 series
"{1417F599-1DBD-4499-9375-B2813E9F890C}" = VAIO Camera Utility
"{17C7703E-0B2A-4593-9CB7-E2FE14B6F8EA}" = Sony Snymsico for Vista
"{1B8FE958-A304-4902-BF7A-4E2F0F5B7017}_is1" = GPSBabel 1.4.3
"{1FEE9698-33D4-4633-B7BA-7368C87E49AA}" = GPS TrackMaker
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"{2063C2E8-3812-4BBD-9998-6610F80C1DD4}" = VAIO Media AC3 Decoder 1.0
"{220DD62A-F30A-4279-8A4B-2B7F9777593B}" = Garmin BaseCamp
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23C08587-19F4-4BBC-9078-26CF8EB02256}" = PL-2303 Vista Driver Installer-ATEN
"{2457326B-C110-40C3-89B0-889CC913871A}" = AVM FRITZ!DSL
"{24960AC2-C413-4A86-B1C1-E4CCADCA44D3}" = VAIO Information FLOW
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{2A0F3EF9-68EE-49E9-A05B-ED5B82DF63E5}" = Wireless Switch Setting Utility
"{2A2FF7F5-6F0E-4A5D-A881-39365E718BD6}" = VAIO Cozy Orange Wallpaper
"{37FD2F04-EC91-41AE-B5AB-AFF904BF20EE}" = Mobile Broadband Drivers
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1" = VSO Image Resizer 3.0.1.76
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{500162A0-4DD5-460A-BAFD-895AAE48C532}" = VAIO Media Content Collection 6.0
"{500C3FDC-5E5F-485F-BDF5-2C445839CBE0}" =
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{5090D628-C12F-4EB0-830D-819EFD52D950}" = JVComm32
"{537575D6-3B96-474C-BD8F-DFF667363DBD}" = Naviextras Toolbox Prerequesities
"{55B781F0-060E-11D4-99D7-00C04FCCB775}" =
"{560F6B2E-F0DF-44E5-8190-A4A161F0E205}" = VAIO Media 6.0
"{569B6909-302A-4661-8EBC-9E8647A7E71A}" = SolidConverterDWG
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{5855C127-1F20-404D-B7FB-1FD84D7EAB5E}" = VAIO Media Redistribution 6.0
"{59452470-A902-477F-9338-9B88101681BD}" = Setting Utility Series
"{5958CAC6-373E-402F-84FE-0A699AA920B9}" = LAN Setting Utility
"{5E343EF6-D27C-4CFC-9FAE-9AAFB541BCEE}" = VAIO Photo 2007
"{6332AFF1-9D9A-429C-AA03-F82749FA4F49}" = SonicStage Mastering Studio
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{664BCF28-C038-4F06-8BF4-A0F2D24C44EE}" = MapSource - Atlantic BlueChart v4.00
"{685BCC47-B8EC-45EC-BBCE-77DF2451502C}" = DVgate Plus
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B1F20F2-6321-4669-A58C-33DF8E7517FF}" = VAIO Entertainment Platform
"{6D2576EC-A0E9-418A-A09A-409933A3B6F4}" = VAIO Camera Capture Utility
"{6F5A71BD-9EC9-4A59-BFBD-CA63CFB4885D}" = ACDSee 14
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{785EB1D4-ECEC-4195-99B4-73C47E187721}" = VAIO Media Integrated Server 6.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{82D5BACA-3619-4D34-99DB-3A65CFB4DA33}" = DSD Direct
"{83CDA18E-0BF3-4ACA-872C-B4CDABF2360E}" = VAIO Update 4
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{934A3213-1CB6-4264-84A2-EE080C017BCA}" = VAIO Tender Green Wallpaper
"{97260AE9-A1EE-492E-8DCC-FD0AFF785720}" =
"{97BCD719-6ECB-458F-97D6-F38D2E07375E}" = VAIO Aqua Breeze Wallpaper
"{98D451C4-4ACA-4273-BB47-57CFE46B048E}" = WD SmartWare
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C1C8A04-F8CA-4472-A92D-4288CE32DE86}" = SonicStage Mastering Studio Plug-Ins
"{9E319E96-ED8E-4B01-9775-C521A1869A25}" = VAIO Power Management
"{9E407618-D9CD-4F39-9490-9ED45294073D}" = Click to DVD 2.0.05 Menu Data
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO
"{A0EB195B-5876-48E6-879D-33D4B2102610}" = SonicStage 4.3
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{A947C2B3-7445-42C4-9063-EE704CACCB22}" = VAIO Hardware Diagnostics
"{AA721D14-CFE2-410E-B975-79FE5F82F99F}" = MSVCMergeModules
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AC76BA86-7AD7-5760-0000-800000000003}" = Japanese Fonts Support For Adobe Reader 8
"{AF9A04EB-7D8E-41DE-9EDE-4AB9BB2B71B6}" = VAIO Media Registration Tool 6.0
"{AFAC914D-9E83-4A89-8ABE-427521C82CCF}" = Safari
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B5829416-1236-47AE-AAED-B2B3F9503FF7}" = Crystal Report Modules
"{B7FB0C86-41A4-4402-9A33-912C462042A0}" = Roxio Easy Media Creator Home
"{BBFFB027-7D53-4E1B-95BC-35A2216D1D60}" = VAIO Long Battery Life Wallpaper
"{C183A21C-395A-490F-99D4-CCAB35E32859}" =
"{C50F5635-A47F-4889-9303-8FA5D337F9D0}" = Garmin BlueChart Atlantic 2008.5
"{C518C7BF-A345-4019-815B-FFDF32EBCAD9}" = VAIO HDD Protection
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{D6F26C8C-FE5A-4F05-B897-35DCA97F4861}" = Winlog.basic
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DF7DB916-90E5-40F2-9010-B8125EB5FD6F}" = SonicStage Mastering Studio Audio Filter
"{E2B38044-AEF2-40AF-BDD8-FEDE799A8633}" =
"{E809063C-51A3-4269-8984-D1EB742F2151}" = Click to DVD 2.6.00
"{EC37A846-53AC-4DA7-98FA-76A4E74AA900}" = Benutzerdefinierte Voreinstellungen für SonicStage Mastering Studio Audio Filter
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{EF3D45BB-2260-4008-88EA-492E7744A9DF}" = Sony Utilities DLL
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0D85ADD-DD61-4B43-87A0-6DA52A211A8B}" = VAIO Event Service
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F570A6CC-53ED-4AA9-8B08-551CD3E38D8B}" =
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone-Konfigurationsprogramm
"{FC37C108-821D-4EDE-8F40-D5B497586805}" = VAIO Control Center
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"09B0389E270BD7AF25027552C702E5A1710355BA" = Windows Driver Package - ebro Electronic GmbH & Co. KG (ebro_ser2pl) Ports (07/07/2010 3.3.11.165)
"47D9E29CE022498902361431291130558B1BC810" = Windows Driver Package - ebro Electronic GmbH & Co. KG ebro USB Driver (03/24/2010 2.73.00)
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"53A88972B866B64F80E2A1A53DAB131532A5CD54" = Windows Driver Package - ebro Electronic GmbH & Co. KG ebro USB Driver (03/24/2010 2.73.00)
"6F18EE7CAB5FC8A721C71764B9A575B728CEE697" = Windows Driver Package - ebro Electronic GmbH & Co. KG ebro USB Driver (03/24/2010 2.73.00)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Admiralty Digital Catalogue 1.6" = Admiralty Digital Catalogue 1.6
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe FrameMaker 7.0" = Adobe FrameMaker v7.0
"Any DWG DXF Converter_is1" = Any DWG DXF Converter 2010
"Audacity_is1" = Audacity 2.0
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"Becker Content Manager" = Becker Content Manager
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"Canon iP100 series Benutzerregistrierung" = Canon iP100 series Benutzerregistrierung
"Canon Setup Utility 2.4" = Canon Setup Utility 2.4
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_104D0200" = HDAUDIO SoftV92 Data Fax Modem with SmartCP
"Content Manager 2" = Content Manager 2
"Corse-Topo_is1" = Corse-Topo für MapSource
"dm-Fotowelt" = dm-Fotowelt
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Gartrip_is1" = Gartrip 210e
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"GPL Ghostscript 9.05" = GPL Ghostscript
"GSview 5.0" = GSview 5.0
"Hauppauge WinTV 7" = Hauppauge WinTV 7
"Hauppauge WinTV Infrared Remote" = Hauppauge WinTV Infrared Remote
"Hauppauge WinTV2000" = Hauppauge WinTV2000
"Hauppauge WinTV-PVR USB Drivers" = Hauppauge WinTV-PVR USB Drivers
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"High Resolution World Data" = High Resolution World Data
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"Island-Topo_is1" = Island-Topo für MapSource
"korsika1_is1" = Topo Korsika 0.1.0.7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"OpenMG HotFix4.7-07-13-22-01" = OpenMG Limited Patch 4.7-07-14-05-01
"OSM Roadmap Norway" = OSM Roadmap Norway
"OSM SKJ Roadmap Norway" = OSM SKJ Roadmap Norway
"OSM SKJ Topo Summer Norway" = OSM SKJ Topo Summer Norway
"OSM Topo Summer Norway" = OSM Topo Summer Norway
"PDF-XChange 3_is1" = PDF-XChange 3
"Personal" = Personal 4.18.3
"POI FINDER (Becker)_is1" = POI FINDER 3.73 (Becker)
"PROHYBRIDR" = 2007 Microsoft Office system
"QCAD Professional" = QCAD Professional 2.2.2.1
"SeaTTY_is1" = SeaTTY V2.30
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"TAD Designer Lite_is1" = TAD Designer Lite 5.7
"Telia mobile broadband" = Telia mobile broadband
"T-Mobile Internet Manager" = T-Mobile Internet Manager
"VLC media player" = VLC media player 1.1.11
"WIB2_is1" = WIB2 1.0.15
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 22.12.2012 15:39:17 | Computer Name = XXXXXXX | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16457, Zeitstempel
0x50a2f9e3, fehlerhaftes Modul gdiplus.dll_unloaded, Version 0.0.0.0, Zeitstempel
0x4f2bf90a, Ausnahmecode 0xc0000005, Fehleroffset 0x74c974b2, Prozess-ID 0x674,
Anwendungsstartzeit 01cde0775f22a508.
Error - 22.12.2012 16:16:30 | Computer Name = XXXXXXX | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 964 Anfangszeit: 01cde080aa193f3c Zeitpunkt der Beendigung:
15
Error - 22.12.2012 16:27:00 | Computer Name = XXXXXXX | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 1268 Anfangszeit: 01cde081d25e3f8c Zeitpunkt der Beendigung:
78
Error - 22.12.2012 16:27:52 | Computer Name = XXXXXXX | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: a78 Anfangszeit: 01cde082bfaa1cac Zeitpunkt der Beendigung:
16
Error - 23.12.2012 07:24:18 | Computer Name = XXXXXXX | Source = VzCdbSvc | ID = 7
Description = Das Plug-In-Modul konnte nicht geladen werden. (GUID = {F508055A-CDBF-4D4D-BC8F-4D8E0D9B9E81})
(Fehlercode = 0x80004005)
Error - 23.12.2012 07:51:37 | Computer Name = XXXXXXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 23.12.2012 07:51:37 | Computer Name = XXXXXXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 19328
Error - 23.12.2012 07:51:37 | Computer Name = XXXXXXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 19328
Error - 23.12.2012 08:21:16 | Computer Name = XXXXXXX | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16457, Zeitstempel
0x50a2f9e3, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5,
Ausnahmecode 0xc0000374, Fehleroffset 0x000b06b7, Prozess-ID 0x151c, Anwendungsstartzeit
01cde106c4f14cf0.
Error - 23.12.2012 08:32:19 | Computer Name = XXXXXXX | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung PEV.exe, Version 0.0.0.0, Zeitstempel 0x4e06cfe8,
fehlerhaftes Modul PEV.exe, Version 0.0.0.0, Zeitstempel 0x4e06cfe8, Ausnahmecode
0x40000015, Fehleroffset 0x0008d1c0, Prozess-ID 0x4fc, Anwendungsstartzeit 01cde1098c8499a0.
[ OSession Events ]
Error - 10.02.2011 06:27:09 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5
seconds with 0 seconds of active time. This session ended with a crash.
Error - 04.04.2011 09:42:37 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 28
seconds with 0 seconds of active time. This session ended with a crash.
Error - 26.04.2011 14:41:17 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6550.5004, Microsoft Office Version: 12.0.6425.1000. This session lasted 7
seconds with 0 seconds of active time. This session ended with a crash.
Error - 26.05.2011 08:51:24 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 22321
seconds with 1980 seconds of active time. This session ended with a crash.
Error - 03.06.2011 14:57:03 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6550.5004, Microsoft Office Version: 12.0.6425.1000. This session lasted 17
seconds with 0 seconds of active time. This session ended with a crash.
Error - 13.12.2011 20:19:19 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6
seconds with 0 seconds of active time. This session ended with a crash.
Error - 22.12.2011 18:08:51 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6654.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 4
seconds with 0 seconds of active time. This session ended with a crash.
Error - 22.12.2011 18:29:49 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6654.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.
Error - 30.01.2012 05:09:52 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 1200
seconds with 300 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 23.12.2012 08:53:29 | Computer Name = XXXXXXX | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
Error - 23.12.2012 09:00:02 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7031
Description =
Error - 23.12.2012 09:00:23 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7034
Description =
Error - 23.12.2012 09:02:54 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7030
Description =
Error - 23.12.2012 09:10:06 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7030
Description =
Error - 23.12.2012 09:15:47 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7030
Description =
Error - 23.12.2012 09:17:29 | Computer Name = XXXXXXX | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
Error - 23.12.2012 12:13:03 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7031
Description =
Error - 23.12.2012 12:19:10 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7000
Description =
Error - 23.12.2012 12:22:03 | Computer Name = XXXXXXX | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
< End of report >
|
|
23.12.2012, 17:58
| #20 | ||
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen Eins hatte ich leider vergessen: Fix mit OTL Gut!  Soweit ich das sehe haben wir damit alles Schädliche entfernt. Um sicher sein zu können müssen jetzt noch ein paar Kontrollen machen. Da diese sehr lange dauern können bitte ich dich mir erst wieder zu schreiben, wenn du auch wirklich alles erledigt hast oder Probleme auftreten sollten. Schritt 1: Quick-Scan mit Malwarebytes Schritt 2: ESET Online Scanner Zitat:
Schritt 3: Scan mit SecurityCheck Downloade Dir bitte SecurityCheck: LINK1 LINK2
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 21:39
| #21 |
| | Claro Search auf Windows Vista entfernen Ich bin mir nicht sicher, ob das unter "Probleme auftreten" fällt: ESET hat 46 % gescannt und zwei befallene Dateien gefunden: Win32/Sirefef.FL trojan Win32/Sirefef.FA trojan Da wird mir Angst und Bange. Wenn ich nichts Gegenteiliges höre, scanne ich alles bis zum Schluß und setze morgen die Logs rein. |
|
23.12.2012, 21:50
| #22 |
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen Ohne Logfile kann man gar nichts sagen
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 22:37
| #23 |
| | Claro Search auf Windows Vista entfernen Geschafft ! Du hattest Recht, die infizierten Dateien waren bereits unter Quarantäne. Code:
ATTFilter ========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\PROGRA~2\BROWSE~1\251005~1.80\{C16C1~1\BrowserProtect.dll deleted successfully.
OTL by OldTimer - Version 3.2.69.0 log created on 12232012_180344
Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.12.23.06 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Admin :: XXXXXXXXXXXX [Administrator] Schutz: Deaktiviert 23.12.2012 18:13:18 mbam-log-2012-12-23 (18-13-18).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 217518 Laufzeit: 7 Minute(n), 10 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter C:\Qoobox\Quarantine\C\$Recycle.Bin\S-1-5-21-934988780-789137344-2609288493-1004\$0414b32a4a66d10124c340b56a44a5a2\U\80000000.@.vir Win32/Sirefef.FA trojan
C:\Qoobox\Quarantine\C\$Recycle.Bin\S-1-5-21-934988780-789137344-2609288493-1004\$0414b32a4a66d10124c340b56a44a5a2\U\800000cb.@.vir Win32/Sirefef.FL trojan
Code:
ATTFilter Results of screen317's Security Check version 0.99.56 Windows Vista Service Pack 2 x86 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.65.1.1000 Adobe Flash Player 9 Flash Player out of Date! Adobe Flash Player 10 Flash Player out of Date! Adobe Flash Player 11.5.502.135 Adobe Reader 8 Adobe Reader out of Date! Mozilla Firefox (17.0.1) Google Chrome 21.0.1180.83 Google Chrome 21.0.1180.89 Google Chrome 22.0.1229.79 Google Chrome 22.0.1229.92 Google Chrome 22.0.1229.94 Google Chrome 23.0.1271.64 Google Chrome 23.0.1271.91 Google Chrome 23.0.1271.95 Google Chrome 23.0.1271.97 ````````Process Check: objlist.exe by Laurent```````` Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` |
|
23.12.2012, 23:18
| #24 | ||||
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen Gut, dann die beiden alten Flashplayer deinstallieren und Update: Adobe Reader
Probiere einen alternativen Viewer für pdf-Dokumente aus. Diese sind meist schlanker, schneller und schleusen sehr viel seltener Schädlinge ein. Mein Vorschlag:
und dann .... Prima! Damit wären wir fertig. Wir räumen jetzt noch ein wenig auf und dann habe ich am Ende etwas Lesestoff für dich. Schritt 1: Tools deinstallieren
Schritt 2: ESET deinstallieren (Optional)
Abschließend noch Tipps zu folgenden Themen:
Damit wünsche ich dir noch viel Spaß beim Surfen im Internet ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Eine Bitte: Gib mir eine kurze Rückmeldung, wenn alles erledigt ist und keine Fragen mehr vorhanden sind, damit ich diesen Thread aus meinen Abos löschen kann.
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 23:21
| #25 |
| | Claro Search auf Windows Vista entfernen Eine kleine Frage noch: Adwcleaner meldet noch irgend welches Zeugs. Hat das was zu sagen ? Code:
ATTFilter # AdwCleaner v2.101 - Datei am 23/12/2012 um 23:23:02 erstellt
# Aktualisiert am 16/12/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Business Service Pack 2 (32 bits)
# Benutzer : Admin - XXXXXXXXXX
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Admin\Desktop\adwcleaner.exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gefunden : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dznt9xt.default-1356134083305\bprotector_extensions.sqlite
Datei Gefunden : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dznt9xt.default-1356134083305\bprotector_prefs.js
***** [Registrierungsdatenbank] *****
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gefunden : HKLM\Software\Description
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
Schlüssel Gefunden : HKU\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16457
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v17.0.1 (de)
Profilname : default-1356134083305 [Profil par défaut]
Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dznt9xt.default-1356134083305\prefs.js
Gefunden : user_pref("browser.search.selectedEngine", "Claro Search");
-\\ Google Chrome v23.0.1271.97
Datei : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R10].txt - [3508 octets] - [21/12/2012 23:09:36]
AdwCleaner[R11].txt - [3569 octets] - [21/12/2012 23:16:15]
AdwCleaner[R12].txt - [3630 octets] - [21/12/2012 23:29:30]
AdwCleaner[R13].txt - [3691 octets] - [21/12/2012 23:44:23]
AdwCleaner[R19].txt - [2996 octets] - [22/12/2012 00:30:14]
AdwCleaner[R1].txt - [9790 octets] - [20/12/2012 23:52:14]
AdwCleaner[R20].txt - [3057 octets] - [22/12/2012 00:31:17]
AdwCleaner[R21].txt - [2657 octets] - [22/12/2012 00:35:28]
AdwCleaner[R22].txt - [2718 octets] - [22/12/2012 00:37:07]
AdwCleaner[R23].txt - [2840 octets] - [22/12/2012 00:45:37]
AdwCleaner[R24].txt - [2962 octets] - [22/12/2012 00:51:02]
AdwCleaner[R25].txt - [3440 octets] - [22/12/2012 01:09:52]
AdwCleaner[R26].txt - [3501 octets] - [22/12/2012 01:20:23]
AdwCleaner[R27].txt - [3623 octets] - [22/12/2012 01:31:14]
AdwCleaner[R28].txt - [3738 octets] - [22/12/2012 01:39:07]
AdwCleaner[R29].txt - [3867 octets] - [22/12/2012 01:44:25]
AdwCleaner[R2].txt - [9850 octets] - [20/12/2012 23:53:01]
AdwCleaner[R30].txt - [3928 octets] - [22/12/2012 01:46:44]
AdwCleaner[R31].txt - [4017 octets] - [22/12/2012 01:51:53]
AdwCleaner[R32].txt - [4172 octets] - [22/12/2012 01:59:17]
AdwCleaner[R33].txt - [4582 octets] - [22/12/2012 18:37:28]
AdwCleaner[R34].txt - [4355 octets] - [22/12/2012 18:47:16]
AdwCleaner[R35].txt - [11446 octets] - [22/12/2012 20:38:51]
AdwCleaner[R36].txt - [4759 octets] - [22/12/2012 20:57:13]
AdwCleaner[R37].txt - [4820 octets] - [22/12/2012 22:01:47]
AdwCleaner[R38].txt - [4942 octets] - [23/12/2012 08:58:20]
AdwCleaner[R39].txt - [5084 octets] - [23/12/2012 22:47:44]
AdwCleaner[R3].txt - [2320 octets] - [21/12/2012 00:00:04]
AdwCleaner[R40].txt - [3503 octets] - [23/12/2012 23:23:02]
AdwCleaner[R4].txt - [2808 octets] - [21/12/2012 20:40:49]
AdwCleaner[R5].txt - [2829 octets] - [21/12/2012 21:42:12]
AdwCleaner[R6].txt - [3026 octets] - [21/12/2012 22:03:56]
AdwCleaner[R7].txt - [3146 octets] - [21/12/2012 22:24:46]
AdwCleaner[R8].txt - [3266 octets] - [21/12/2012 22:57:26]
AdwCleaner[R9].txt - [3386 octets] - [21/12/2012 23:03:52]
AdwCleaner[S10].txt - [2741 octets] - [22/12/2012 00:37:46]
AdwCleaner[S11].txt - [2863 octets] - [22/12/2012 00:46:33]
AdwCleaner[S12].txt - [3524 octets] - [22/12/2012 01:22:54]
AdwCleaner[S13].txt - [3646 octets] - [22/12/2012 01:31:41]
AdwCleaner[S14].txt - [3601 octets] - [22/12/2012 01:39:57]
AdwCleaner[S15].txt - [3951 octets] - [22/12/2012 01:47:11]
AdwCleaner[S16].txt - [3880 octets] - [22/12/2012 01:52:50]
AdwCleaner[S17].txt - [4445 octets] - [22/12/2012 18:41:04]
AdwCleaner[S18].txt - [11378 octets] - [22/12/2012 20:41:10]
AdwCleaner[S19].txt - [4714 octets] - [22/12/2012 22:02:22]
AdwCleaner[S1].txt - [9643 octets] - [20/12/2012 23:53:24]
AdwCleaner[S2].txt - [2342 octets] - [21/12/2012 00:00:44]
AdwCleaner[S3].txt - [2830 octets] - [21/12/2012 20:42:07]
AdwCleaner[S4].txt - [2851 octets] - [21/12/2012 21:43:08]
AdwCleaner[S5].txt - [3048 octets] - [21/12/2012 22:04:39]
AdwCleaner[S6].txt - [3168 octets] - [21/12/2012 22:25:26]
AdwCleaner[S7].txt - [3288 octets] - [21/12/2012 22:58:06]
AdwCleaner[S8].txt - [3408 octets] - [21/12/2012 23:04:19]
AdwCleaner[S9].txt - [2954 octets] - [22/12/2012 00:31:46]
########## EOF - C:\AdwCleaner[R40].txt - [5075 octets] ##########
|
|
23.12.2012, 23:29
| #26 |
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen Na lösch es doch?
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 23:33
| #27 |
| | Claro Search auf Windows Vista entfernen Mach ich. Ich wollte bloß vorsichtshalber fragen. Also vielen, vielen Dank und fröhliche Weihnachten ! Ich melde mich noch mal nach Weihnachten und spende Euch was. |
|
23.12.2012, 23:37
| #28 |
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen Schön, dass wir helfen konnten  Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen Falls du noch Lob oder Kritik loswerden möchtest, dann gibt es diesen Bereich hier: http://www.trojaner-board.de/lob-kritik-wuensche/
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
| Themen zu Claro Search auf Windows Vista entfernen |
| anzahl, eingefangen, entferne, entfernen, frage, fragen, gefundenen, gen, installieren, konnte, laptop, modus, neu, platt, search, software, system, unterwegs, verschiedene, vista, windows, windows vista, woche, würde |
Textbox.
Button.
und dann 
+ R Taste und kopiere folgenden Text in das Ausführen-Fenster und klicke OK.
Linear-Darstellung
