| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Claro Search auf Windows Vista entfernenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
22.12.2012, 20:32
| #1 |
 |  Claro Search auf Windows Vista entfernen Hallo liebe Forumsmitglieder ! Ich habe mir Claro Search eingefangen und bekomme ihn nicht weg. Normalerweise würde ich das System platt machen und neu installieren, aber ich bin jetzt eine Woche mit dem Laptop unterwegs und wollte fragen, ob es eine Möglichkeit gibt, Claro Search zu entfernen. Ich habe schon verschiedene Software ausprobiert, insbesondere Adwcleaner, teils auch im gesicherten Modus, konnte aber die Anzahl der gefundenen Einträge reduzieren, aber nicht beseitigen. Für Hilfe wäre ich sehr dankbar. Jürgen Hier ist das Defogger-Log: defogger_disable by jpshortstuff (23.02.10.1) Log created at 21:16 on 22/12/2012 (Admin) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- |
|
22.12.2012, 21:44
| #2 | ||
| /// TB-Ausbilder  | Claro Search auf Windows Vista entfernen
 Ich werde dir bei deinem Problem helfen. Eine Bereinigung ist mitunter mit viel Arbeit für Dich (und mich) verbunden. Bevor es los geht, habe ich etwas Lesestoff für dich. Gelesen und verstanden? Schritt 1: AdwCleaner: Werbeprogramme suchen und löschen
Schritt 2: Temporäre Dateien löschen mit TFC
Schritt 3: Scan mit DDS (+ attach) Downloade dir bitte DDS (von sUBs) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop.
__________________ |
|
22.12.2012, 22:47
| #3 |
| | Claro Search auf Windows Vista entfernen Vielen Dank für die Unterstützung.
__________________ Hier das Log von Adwcleaner: Code:
ATTFilter # AdwCleaner v2.101 - Datei am 22/12/2012 um 22:02:22 erstellt
# Aktualisiert am 16/12/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Business Service Pack 2 (32 bits)
# Benutzer : Admin - XXXXXXXXXXX
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Admin\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dznt9xt.default-1356134083305\bprotector_extensions.sqlite
Gelöscht mit Neustart : C:\Program Files\Zynga
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKLM\Software\Description
Schlüssel Gelöscht : HKU\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16457
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v17.0.1 (de)
Profilname : default-1356134083305 [Profil par défaut]
Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dznt9xt.default-1356134083305\prefs.js
[OK] Die Datei ist sauber.
-\\ Google Chrome v23.0.1271.97
Datei : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R10].txt - [3508 octets] - [21/12/2012 23:09:36]
AdwCleaner[R11].txt - [3569 octets] - [21/12/2012 23:16:15]
AdwCleaner[R12].txt - [3630 octets] - [21/12/2012 23:29:30]
AdwCleaner[R13].txt - [3691 octets] - [21/12/2012 23:44:23]
AdwCleaner[R19].txt - [2996 octets] - [22/12/2012 00:30:14]
AdwCleaner[R1].txt - [9790 octets] - [20/12/2012 23:52:14]
AdwCleaner[R20].txt - [3057 octets] - [22/12/2012 00:31:17]
AdwCleaner[R21].txt - [2657 octets] - [22/12/2012 00:35:28]
AdwCleaner[R22].txt - [2718 octets] - [22/12/2012 00:37:07]
AdwCleaner[R23].txt - [2840 octets] - [22/12/2012 00:45:37]
AdwCleaner[R24].txt - [2962 octets] - [22/12/2012 00:51:02]
AdwCleaner[R25].txt - [3440 octets] - [22/12/2012 01:09:52]
AdwCleaner[R26].txt - [3501 octets] - [22/12/2012 01:20:23]
AdwCleaner[R27].txt - [3623 octets] - [22/12/2012 01:31:14]
AdwCleaner[R28].txt - [3738 octets] - [22/12/2012 01:39:07]
AdwCleaner[R29].txt - [3867 octets] - [22/12/2012 01:44:25]
AdwCleaner[R2].txt - [9850 octets] - [20/12/2012 23:53:01]
AdwCleaner[R30].txt - [3928 octets] - [22/12/2012 01:46:44]
AdwCleaner[R31].txt - [4017 octets] - [22/12/2012 01:51:53]
AdwCleaner[R32].txt - [4172 octets] - [22/12/2012 01:59:17]
AdwCleaner[R33].txt - [4582 octets] - [22/12/2012 18:37:28]
AdwCleaner[R34].txt - [4355 octets] - [22/12/2012 18:47:16]
AdwCleaner[R35].txt - [11446 octets] - [22/12/2012 20:38:51]
AdwCleaner[R36].txt - [4759 octets] - [22/12/2012 20:57:13]
AdwCleaner[R37].txt - [4820 octets] - [22/12/2012 22:01:47]
AdwCleaner[R3].txt - [2320 octets] - [21/12/2012 00:00:04]
AdwCleaner[R4].txt - [2808 octets] - [21/12/2012 20:40:49]
AdwCleaner[R5].txt - [2829 octets] - [21/12/2012 21:42:12]
AdwCleaner[R6].txt - [3026 octets] - [21/12/2012 22:03:56]
AdwCleaner[R7].txt - [3146 octets] - [21/12/2012 22:24:46]
AdwCleaner[R8].txt - [3266 octets] - [21/12/2012 22:57:26]
AdwCleaner[R9].txt - [3386 octets] - [21/12/2012 23:03:52]
AdwCleaner[S10].txt - [2741 octets] - [22/12/2012 00:37:46]
AdwCleaner[S11].txt - [2863 octets] - [22/12/2012 00:46:33]
AdwCleaner[S12].txt - [3524 octets] - [22/12/2012 01:22:54]
AdwCleaner[S13].txt - [3646 octets] - [22/12/2012 01:31:41]
AdwCleaner[S14].txt - [3601 octets] - [22/12/2012 01:39:57]
AdwCleaner[S15].txt - [3951 octets] - [22/12/2012 01:47:11]
AdwCleaner[S16].txt - [3880 octets] - [22/12/2012 01:52:50]
AdwCleaner[S17].txt - [4445 octets] - [22/12/2012 18:41:04]
AdwCleaner[S18].txt - [11378 octets] - [22/12/2012 20:41:10]
AdwCleaner[S19].txt - [4043 octets] - [22/12/2012 22:02:22]
AdwCleaner[S1].txt - [9643 octets] - [20/12/2012 23:53:24]
AdwCleaner[S2].txt - [2342 octets] - [21/12/2012 00:00:44]
AdwCleaner[S3].txt - [2830 octets] - [21/12/2012 20:42:07]
AdwCleaner[S4].txt - [2851 octets] - [21/12/2012 21:43:08]
AdwCleaner[S5].txt - [3048 octets] - [21/12/2012 22:04:39]
AdwCleaner[S6].txt - [3168 octets] - [21/12/2012 22:25:26]
AdwCleaner[S7].txt - [3288 octets] - [21/12/2012 22:58:06]
AdwCleaner[S8].txt - [3408 octets] - [21/12/2012 23:04:19]
AdwCleaner[S9].txt - [2954 octets] - [22/12/2012 00:31:46]
########## EOF - C:\AdwCleaner[S19].txt - [4644 octets] ##########
Hier DDS.txt: DDS Logfile: DDS Logfile: DDS Logfile: Code:
ATTFilter DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 1.6.0_37
Run by Admin at 22:33:58 on 2012-12-22
Microsoft® Windows Vista™ Business 6.0.6002.2.1252.49.1031.18.2045.577 [GMT 1:00]
.
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\SLsvc.exe
C:\Program Files\Protector Suite QL\upeksvr.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe
C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe
C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Sony\WiseWan\NovatelDetection\VAIODetection.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
C:\Program Files\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe
C:\Program Files\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\FRITZ!DSL\StCenter.exe
C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe
C:\Program Files\Personal\bin\Personal.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\WinTV\WinTV7\WinTVTray.exe
C:\Windows\System32\alg.exe
C:\Users\Admin\AppData\Roaming\T-Mobile Internet Manager\ouc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
uSearch Bar = Preserve
uSearch Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SDHelper: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy 2\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
BHO: CBrowserHelperObject Object: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\google bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: &Google: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
TB: &Google: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe
uRun: [HW_OPENEYE_OUC_T-Mobile Internet Manager] "c:\program files\t-mobile\t-mobile internet manager\updatedog\ouc.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Spybot-S&D Cleaning] "c:\program files\spybot - search & destroy 2\SDCleaner.exe" /autoclean
mRun: [Windows Defender] c:\program files\windows defender\MSASCui.exe -hide
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [DRCU] "c:\program files\sony\drcu\DRCU.exe"
mRun: [VAIOCameraUtility] "c:\program files\sony\vaio camera utility\VCUServe.exe"
mRun: [ISBMgr.exe] "c:\program files\sony\isb utility\ISBMgr.exe"
mRun: [PSQLLauncher] "c:\program files\protector suite ql\launcher.exe" /startup
mRun: [VAIODetection] c:\program files\sony\wisewan\novateldetection\VAIODetection.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [DataCardMonitor] c:\program files\t-mobile\t-mobile internet manager\DataCardMonitor.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [ACSW14DE] "c:\program files\acd systems\acdsee\14.0\ACDSeeInTouch2.exe" /pid ACSW14DE
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [SDTray] "c:\program files\spybot - search & destroy 2\SDTray.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 5.0\distillr\AcroTray.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\autost~1.lnk - c:\program files\wintv\Ir.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\fritz!~1.lnk - c:\windows\installer\{2457326b-c110-40c3-89b0-889cc913871a}\Icon2457326B4.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.285\SSScheduler.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\personal.lnk - c:\program files\personal\bin\Personal.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\wddmst~1.lnk - c:\program files\western digital\wd smartware\wd drive manager\WDDMStatus.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\wintvr~1.lnk - c:\program files\wintv\wintv7\WinTVTray.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-System: DisableCAD = dword:1
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy 2\SDHelper.dll
LSP: c:\program files\avira\antivir desktop\avsda.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{9BFEB1E5-4DDC-4C56-BFE7-D42653BA50AF} : DHCPNameServer = 192.168.0.1
Notify: igfxcui - igfxdev.dll
Notify: psfus - c:\windows\system32\psqlpwd.dll
Notify: SDWinLogon - SDWinLogon.dll
Notify: VESWinlogon - VESWinlogon.dll
AppInit_DLLs= c:\progra~2\browse~1\251005~1.80\{c16c1~1\browse~1.dll c:\progra~1\google\google~2\goec62~1.dll
LSA: Notification Packages = scecli psqlpwd
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\admin\appdata\roaming\mozilla\firefox\profiles\3dznt9xt.default-1356134083305\
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\personal\bin\np_prsnl.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_5_502_135.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
FF - ExtSQL: 2012-12-05 15:12; {B922D405-6D13-4A2B-AE89-08A030DA4402}; c:\program files\mozilla firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}
FF - ExtSQL: 2012-12-05 15:12; {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}; c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF - ExtSQL: 2012-12-05 15:12; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-12-22 36552]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-12-22 83944]
.
=============== File Associations ===============
.
ShellExec: solidconverterdwg.exe: open=c:\program files\soliddocuments\solidconverterdwg\solidconverterdwg.exe
ShellExec: VRCProxy2.exe: open=c:\program files\soliddocuments\solidconverterdwg\VRCProxy2.exe
.
=============== Created Last 30 ================
.
2012-12-22 19:06:14 -------- d-----w- c:\users\admin\appdata\local\DoNotTrackPlus
2012-12-22 18:30:30 -------- d-----w- c:\users\admin\appdata\roaming\Avira
2012-12-22 18:22:35 83944 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-12-22 18:22:35 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-12-22 18:22:26 -------- d-----w- c:\programdata\Avira
2012-12-22 18:22:26 -------- d-----w- c:\program files\Avira
2012-12-21 23:57:49 176128 ----a-w- c:\windows\system32\igfxres.dll
2012-12-21 22:43:05 -------- d-----w- c:\programdata\????0
2012-12-21 22:24:53 6812136 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{333d7f10-6413-4af8-ba51-05d62896d62e}\mpengine.dll
2012-12-21 22:18:51 -------- d-----w- c:\users\admin\appdata\roaming\Malwarebytes
2012-12-21 22:18:33 -------- d-----w- c:\programdata\Malwarebytes
2012-12-21 22:18:29 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-21 22:18:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-12-21 22:08:44 -------- d-----w- c:\programdata\????0
2012-12-21 22:04:49 -------- d-----w- c:\windows\system32\searchplugins
2012-12-21 22:04:49 -------- d-----w- c:\windows\system32\Extensions
2012-12-21 22:03:08 -------- d-----w- c:\programdata\?ø?ø0
2012-12-21 21:56:06 -------- d-----w- c:\programdata\????0
2012-12-21 21:10:20 -------- d-----w- c:\programdata\????0
2012-12-21 20:49:28 -------- d-----w- c:\programdata\?þ?þ0
2012-12-21 20:20:31 -------- d-----w- c:\program files\Enigma Software Group
2012-12-21 19:46:02 -------- d-----w- c:\programdata\?¢?¢0
2012-12-21 07:48:24 -------- d-----w- c:\programdata\?x?x0
2012-12-21 07:03:09 -------- d-----w- c:\programdata\?ë?ë0
2012-12-21 06:33:23 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-21 06:33:23 293376 ----a-w- c:\windows\system32\atmfd.dll
2012-12-21 00:46:03 -------- d-----w- c:\programdata\????0
2012-12-20 23:22:58 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-12-20 23:22:39 15224 ----a-w- c:\windows\system32\sdnclean.exe
2012-12-20 23:22:30 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2012-12-20 22:58:04 -------- d-----w- c:\programdata\????0
2012-12-20 22:30:59 -------- d-----w- c:\programdata\????0
2012-12-20 20:23:14 -------- d-----w- c:\programdata\?D?D0
2012-12-20 05:57:33 -------- d-----w- c:\programdata\????0
2012-12-19 22:16:56 -------- d-----w- c:\programdata\BrowserProtect
2012-12-19 22:15:49 -------- d-----w- c:\users\admin\appdata\roaming\PerformerSoft
2012-12-19 22:15:43 17464 ----a-w- c:\windows\system32\roboot.exe
2012-12-19 22:14:51 -------- d-----w- c:\program files\IcoFX 2
2012-12-19 21:16:54 -------- d-----w- c:\users\admin\appdata\roaming\aicon
2012-12-19 21:16:49 -------- d-----w- c:\program files\aicon
2012-12-12 20:57:01 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-12-12 20:57:01 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-12-12 20:57:01 149552 ----a-w- c:\program files\internet explorer\sqmapi.dll
2012-12-12 20:57:00 194048 ----a-w- c:\program files\internet explorer\IEShims.dll
2012-12-12 20:57:00 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-12-12 20:53:17 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-12-12 20:53:10 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-12-12 20:53:10 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-12-12 20:53:09 73216 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-12-12 20:53:09 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-12-12 20:53:09 16896 ----a-w- c:\windows\system32\winusb.dll
2012-12-12 20:53:07 526952 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-12-12 20:53:07 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-12-12 20:53:06 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-12-12 20:53:06 196608 ----a-w- c:\windows\system32\WUDFHost.exe
2012-12-12 20:53:05 613888 ----a-w- c:\windows\system32\WUDFx.dll
2012-12-12 20:21:21 2048000 ----a-w- c:\windows\system32\win32k.sys
2012-12-12 20:21:18 376320 ----a-w- c:\windows\system32\dpnet.dll
2012-12-12 20:21:18 23040 ----a-w- c:\windows\system32\dpnsvr.exe
2012-12-12 20:21:12 224640 ----a-w- c:\windows\system32\drivers\volsnap.sys
2012-12-12 20:21:03 2048 ----a-w- c:\windows\system32\tzres.dll
.
==================== Find3M ====================
.
2012-12-20 05:58:49 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-20 05:58:49 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-14 02:09:22 1800704 ----a-w- c:\windows\system32\jscript9.dll
2012-11-14 01:58:15 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-11-14 01:57:37 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-09-25 16:19:41 75776 ----a-w- c:\windows\system32\synceng.dll
2012-09-24 13:32:24 477168 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-24 13:32:20 473072 ----a-w- c:\windows\system32\deployJava1.dll
.
============= FINISH: 22:39:30,41 ===============
--- --- --- --- --- --- --------------------------------------------------------------------------- Hier Attach.txt: Code:
ATTFilter .
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft® Windows Vista™ Business
Boot Device: \Device\HarddiskVolume1
Install Date: 26.03.2009 14:53:10
System Uptime: 22.12.2012 22:23:13 (0 hours ago)
.
Motherboard: Sony Corporation | | VAIO
Processor: Intel(R) Core(TM)2 CPU T7400 @ 2.16GHz | N/A | 1000/166mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 86 GiB total, 5,351 GiB free.
D: is FIXED (NTFS) - 100 GiB total, 45,705 GiB free.
E: is Removable
F: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description:
Device ID: ROOT\*6TO4MP\0000
Manufacturer: Microsoft
Name:
PNP Device ID: ROOT\*6TO4MP\0000
Service:
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft-ISATAP-Adapter
Device ID: ROOT\*ISATAP\0003
Manufacturer: Microsoft
Name: Microsoft-ISATAP-Adapter #4
PNP Device ID: ROOT\*ISATAP\0003
Service: tunnel
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft-ISATAP-Adapter
Device ID: ROOT\*ISATAP\0010
Manufacturer: Microsoft
Name: Microsoft-ISATAP-Adapter #3
PNP Device ID: ROOT\*ISATAP\0010
Service: tunnel
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft-ISATAP-Adapter
Device ID: ROOT\*ISATAP\0017
Manufacturer: Microsoft
Name: Microsoft-ISATAP-Adapter #4
PNP Device ID: ROOT\*ISATAP\0017
Service: tunnel
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft-ISATAP-Adapter
Device ID: ROOT\*ISATAP\0032
Manufacturer: Microsoft
Name: Microsoft-ISATAP-Adapter #10
PNP Device ID: ROOT\*ISATAP\0032
Service: tunnel
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
@icon sushi 1.21
2007 Microsoft Office system
ACDSee 14
Activation Assistant for the 2007 Microsoft Office suites
Admiralty Digital Catalogue 1.6
Adobe Acrobat 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Flash Player 9 ActiveX
Adobe FrameMaker v7.0
Adobe Reader X (10.1.4) - Deutsch
Alps Pointing-device for VAIO
Any DWG DXF Converter 2010
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Audacity 2.0
Avira Free Antivirus
AVM FRITZ!Box Dokumentation
AVM FRITZ!Box Druckeranschluss
AVM FRITZ!DSL
Becker Content Manager
Benutzerdefinierte Voreinstellungen für SonicStage Mastering Studio Audio Filter
Bluetooth Stack for Windows by Toshiba
Bonjour
Browser Address Error Redirector
Business Contact Manager für Outlook 2007 SP2
Canon iP100 series
Canon iP100 series Benutzerregistrierung
Canon My Printer
Canon Setup Utility 2.4
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
Click to DVD 2.0.05 Menu Data
Click to DVD 2.6.00
Content Manager 2
Corse-Topo für MapSource
Crystal Report Modules
dm-Fotowelt
DSD Direct
DSD Playback Plug-in
DVgate Plus
Garmin BaseCamp
Garmin BlueChart Atlantic 2008.5
Garmin USB Drivers
Gartrip 210e
Google Chrome
Google Desktop
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
GPL Ghostscript
GPS TrackMaker
GPSBabel 1.4.3
GSview 5.0
Hauppauge WinTV-PVR USB Drivers
Hauppauge WinTV 7
Hauppauge WinTV Infrared Remote
Hauppauge WinTV2000
HDAUDIO SoftV92 Data Fax Modem with SmartCP
High Resolution World Data
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel(R) Graphics Media Accelerator Driver
iPhone-Konfigurationsprogramm
Island-Topo für MapSource
iTunes
Japanese Fonts Support For Adobe Reader 8
Java Auto Updater
Java(TM) 6 Update 37
Java(TM) SE Runtime Environment 6
JVComm32
LAN Setting Utility
Malwarebytes Anti-Malware Version 1.65.1.1000
MapSource - Atlantic BlueChart v4.00
McAfee Security Scan Plus
Microsoft .NET Framework 3.5 Language Pack SP1 - deu
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Office 2003 Web Components
Microsoft Office 2007 Primary Interop Assemblies
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (German) 2007
Microsoft Office Excel MUI (German) 2007
Microsoft Office File Validation Add-In
Microsoft Office Live Add-in 1.5
Microsoft Office Outlook MUI (German) 2007
Microsoft Office PowerPoint MUI (German) 2007
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Italian) 2007
Microsoft Office Proofing (German) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (German) 2007
Microsoft Office Shared MUI (German) 2007
Microsoft Office Small Business Connectivity Components
Microsoft Office Word MUI (German) 2007
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
Microsoft SQL Server 2005 Express Edition (VAIO_VEDB)
Microsoft SQL Server Native Client
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Works
Mobile Broadband Drivers
Mozilla Firefox 17.0.1 (x86 de)
Mozilla Maintenance Service
MSVCMergeModules
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Naviextras Toolbox Prerequesities
NVIDIA Drivers
OGA Notifier 2.0.0048.0
OpenMG Limited Patch 4.7-07-14-05-01
OpenMG Secure Module 4.7.00
OSM Roadmap Norway
OSM SKJ Roadmap Norway
OSM SKJ Topo Summer Norway
OSM Topo Summer Norway
PDF-XChange 3
PDFCreator
Personal 4.18.3
PL-2303 USB-to-Serial
PL-2303 Vista Driver Installer-ATEN
POI FINDER 3.73 (Becker)
Protector Suite QL 5.6
QCAD Professional 2.2.2.1
QuickTime
Roxio Easy Media Creator Home
Safari
SeaTTY V2.30
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition
Setting Utility Series
SigmaTel Audio
SolidConverterDWG
SonicStage 4.3
SonicStage Mastering Studio
SonicStage Mastering Studio Audio Filter
SonicStage Mastering Studio Plug-Ins
Sony Snymsico for Vista
Sony Utilities DLL
Sony Video Shared Library
Spybot - Search & Destroy
T-Mobile Internet Manager
TAD Designer Lite 5.7
Telia mobile broadband
Topo Korsika 0.1.0.7
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2760573) 32-Bit Edition
VAIO Aqua Breeze Wallpaper
VAIO Camera Capture Utility
VAIO Camera Utility
VAIO Control Center
VAIO Cozy Orange Wallpaper
VAIO Data Restore Tool
VAIO Entertainment Platform
VAIO Event Service
VAIO Hardware Diagnostics
VAIO HDD Protection
VAIO Information FLOW
VAIO Long Battery Life Wallpaper
VAIO Media 6.0
VAIO Media AC3 Decoder 1.0
VAIO Media Content Collection 6.0
VAIO Media Integrated Server 6.0
VAIO Media Redistribution 6.0
VAIO Media Registration Tool 6.0
VAIO Photo 2007
VAIO Power Management
VAIO Tender Green Wallpaper
VAIO Update 4
VLC media player 1.1.11
VSO Image Resizer 3.0.1.76
WD SmartWare
WIB2 1.0.15
Windows Driver Package - ebro Electronic GmbH & Co. KG (ebro_ser2pl) Ports (07/07/2010 3.3.11.165)
Windows Driver Package - ebro Electronic GmbH & Co. KG ebro USB Driver (03/24/2010 2.73.00)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
Windows Live ID-Anmelde-Assistent
Windows Media Player Firefox Plugin
WinDVD for VAIO
Winlog.basic
Wireless Switch Setting Utility
.
==== End Of File ===========================
|
|
22.12.2012, 22:52
| #4 | ||
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen Wie oft hast du denn AdwCleaner benutzt?? Schritt 1: Deinstalliere McAfee Security Scan Plus, Java(TM) 6 Update 37, Java(TM) SE Runtime Environment 6, Spybot - Search & Destroy Schritt 2: Scan mit Combofix
__________________  Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
22.12.2012, 23:48
| #5 |
| | Claro Search auf Windows Vista entfernen Es ist schon richtig, was in der Log-Datei von AdwCleaner steht. Ich habe den AdwCleaner fast 20mal benutzt. Combofix lieferte eine Fehlermeldung von der "Protector Suite QL": Interner Fehler pb_msi oder so ähnlich. Ansonsten lief alles glatt ohne Booten. Hier nun das Log-File von Combofix: Code:
ATTFilter ComboFix 12-12-22.02 - Admin 22.12.2012 23:23:24.1.2 - x86
Microsoft® Windows Vista™ Business 6.0.6002.2.1252.49.1031.18.2045.978 [GMT 1:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\$recycle.bin\S-1-5-21-934988780-789137344-2609288493-1004\$0414b32a4a66d10124c340b56a44a5a2\@
c:\$recycle.bin\S-1-5-21-934988780-789137344-2609288493-1004\$0414b32a4a66d10124c340b56a44a5a2\U\00000001.@
c:\$recycle.bin\S-1-5-21-934988780-789137344-2609288493-1004\$0414b32a4a66d10124c340b56a44a5a2\U\80000000.@
c:\$recycle.bin\S-1-5-21-934988780-789137344-2609288493-1004\$0414b32a4a66d10124c340b56a44a5a2\U\800000cb.@
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-11-22 bis 2012-12-22 ))))))))))))))))))))))))))))))
.
.
2012-12-22 19:06 . 2012-12-22 19:06 -------- d-----w- c:\users\Admin\AppData\Local\DoNotTrackPlus
2012-12-22 18:30 . 2012-12-22 18:30 -------- d-----w- c:\users\Admin\AppData\Roaming\Avira
2012-12-22 18:22 . 2012-11-27 09:01 83944 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-12-22 18:22 . 2012-11-22 14:51 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-12-22 18:22 . 2012-11-22 14:50 134336 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-12-22 18:22 . 2012-12-22 18:24 -------- d-----w- c:\programdata\Avira
2012-12-22 18:22 . 2012-12-22 18:22 -------- d-----w- c:\program files\Avira
2012-12-21 23:57 . 2006-11-27 07:44 176128 ----a-w- c:\windows\system32\igfxres.dll
2012-12-21 22:43 . 2012-12-21 22:43 -------- d-----w- c:\progra~2\0E5F5~1
2012-12-21 22:24 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{333D7F10-6413-4AF8-BA51-05D62896D62E}\mpengine.dll
2012-12-21 22:18 . 2012-12-21 22:18 -------- d-----w- c:\users\Admin\AppData\Roaming\Malwarebytes
2012-12-21 22:18 . 2012-12-21 22:18 -------- d-----w- c:\programdata\Malwarebytes
2012-12-21 22:18 . 2012-09-29 18:54 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-21 22:18 . 2012-12-21 22:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-12-21 22:08 . 2012-12-21 22:08 -------- d-----w- c:\progra~2\0E6FD~1
2012-12-21 22:04 . 2012-12-21 22:04 -------- d-----w- c:\windows\system32\searchplugins
2012-12-21 22:04 . 2012-12-21 22:04 -------- d-----w- c:\windows\system32\Extensions
2012-12-21 22:03 . 2012-12-21 22:03 -------- d-----w-0 c:\progra~2\0ABE9~1
2012-12-21 21:56 . 2012-12-21 21:56 -------- d-----w- c:\progra~2\0B6F9~1
2012-12-21 21:10 . 2012-12-21 21:10 -------- d-----w- c:\progra~2\0ECE5~1
2012-12-21 20:49 . 2012-12-21 20:49 -------- d-----w-0 c:\progra~2\0EBE1~1
2012-12-21 20:20 . 2012-12-21 20:20 -------- d-----w- c:\program files\Enigma Software Group
2012-12-21 19:46 . 2012-12-21 19:46 -------- d-----w-0 c:\progra~2\097E1~1
2012-12-21 07:48 . 2012-12-21 07:48 -------- d-----w-0 c:\progra~2\XX0~1
2012-12-21 07:03 . 2012-12-21 07:03 -------- d-----w-0 c:\progra~2\00BE5~1
2012-12-21 06:33 . 2012-12-16 13:12 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-21 06:33 . 2012-12-16 10:50 293376 ----a-w- c:\windows\system32\atmfd.dll
2012-12-21 00:46 . 2012-12-21 00:46 -------- d-----w- c:\progra~2\0BDE9~1
2012-12-20 23:22 . 2012-12-22 13:26 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-12-20 23:22 . 2012-12-22 22:03 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2012-12-20 22:58 . 2012-12-20 22:58 -------- d-----w- c:\progra~2\068F9~1
2012-12-20 22:30 . 2012-12-20 22:30 -------- d-----w- c:\progra~2\074F9~1
2012-12-20 20:23 . 2012-12-20 20:23 -------- d-----w-0 c:\progra~2\DD0~1
2012-12-20 05:57 . 2012-12-20 05:57 -------- d-----w- c:\progra~2\0D5F1~1
2012-12-19 22:16 . 2012-12-19 22:16 -------- d-----w- c:\programdata\BrowserProtect
2012-12-19 22:15 . 2012-12-19 22:15 -------- d-----w- c:\users\Admin\AppData\Roaming\PerformerSoft
2012-12-19 22:15 . 2012-03-14 14:47 17464 ----a-w- c:\windows\system32\roboot.exe
2012-12-19 22:14 . 2012-12-21 00:29 -------- d-----w- c:\program files\IcoFX 2
2012-12-19 21:16 . 2012-12-19 21:16 -------- d-----w- c:\users\Admin\AppData\Roaming\aicon
2012-12-19 21:16 . 2012-12-19 21:16 -------- d-----w- c:\program files\aicon
2012-12-12 20:57 . 2012-11-14 02:56 149552 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2012-12-12 20:57 . 2012-11-14 01:48 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-12-12 20:57 . 2012-11-14 01:44 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-12-12 20:57 . 2012-11-14 01:51 194048 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2012-12-12 20:57 . 2012-11-14 01:49 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-12-12 20:53 . 2012-07-26 02:46 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-12-12 20:53 . 2012-07-26 02:33 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-12-12 20:53 . 2012-07-26 02:32 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-12-12 20:53 . 2012-07-26 03:20 73216 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-12-12 20:53 . 2012-07-26 03:20 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-12-12 20:53 . 2009-07-14 12:12 16896 ----a-w- c:\windows\system32\winusb.dll
2012-12-12 20:53 . 2012-07-26 03:39 526952 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-12-12 20:53 . 2012-07-26 03:39 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-12-12 20:53 . 2012-07-26 03:21 196608 ----a-w- c:\windows\system32\WUDFHost.exe
2012-12-12 20:53 . 2012-07-26 03:20 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-12-12 20:53 . 2012-07-26 03:20 613888 ----a-w- c:\windows\system32\WUDFx.dll
2012-12-12 20:21 . 2012-11-13 01:36 2048000 ----a-w- c:\windows\system32\win32k.sys
2012-12-12 20:21 . 2012-11-02 10:18 376320 ----a-w- c:\windows\system32\dpnet.dll
2012-12-12 20:21 . 2012-11-02 08:26 23040 ----a-w- c:\windows\system32\dpnsvr.exe
2012-12-12 20:21 . 2012-08-21 11:47 224640 ----a-w- c:\windows\system32\drivers\volsnap.sys
2012-12-12 20:21 . 2012-11-13 01:29 2048 ----a-w- c:\windows\system32\tzres.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-20 05:58 . 2012-07-16 14:29 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-20 05:58 . 2011-09-24 00:48 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-25 16:19 . 2012-11-16 10:01 75776 ----a-w- c:\windows\system32\synceng.dll
2012-09-24 13:32 . 2012-07-16 14:40 477168 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-24 13:32 . 2010-10-12 12:12 473072 ----a-w- c:\windows\system32\deployJava1.dll
2012-12-05 14:12 . 2012-12-05 14:12 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2010-08-22 10:02 . 2012-12-05 14:12 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2006-11-29 16:13 2854912 ----a-w- c:\program files\Protector Suite QL\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2006-11-29 16:13 2854912 ----a-w- c:\program files\Protector Suite QL\farchns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"HW_OPENEYE_OUC_T-Mobile Internet Manager"="c:\program files\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe" [2009-06-23 110592]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2006-09-11 118784]
"DRCU"="c:\program files\Sony\DRCU\DRCU.exe" [2006-12-03 61440]
"VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2006-11-14 411768]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2006-11-11 43128]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2006-11-29 49168]
"VAIODetection"="c:\program files\Sony\WiseWan\NovatelDetection\VAIODetection.exe" [2009-03-26 378880]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-19 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-19 81920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-22 30192]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-10-26 652624]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-09-14 1603152]
"DataCardMonitor"="c:\program files\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe" [2009-09-18 253952]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-27 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-27 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-27 81920]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"ACSW14DE"="c:\program files\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe" [2011-11-17 1231472]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-12-04 384800]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2009-6-19 82026]
AutoStart IR.lnk - c:\program files\WinTV\Ir.exe [2010-5-24 110647]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-1-18 2752512]
FRITZ!DSL Startcenter.lnk - c:\windows\Installer\{2457326B-C110-40C3-89B0-889CC913871A}\Icon2457326B4.exe [2009-4-7 29184]
Personal.lnk - c:\program files\Personal\bin\Personal.exe [2011-12-16 1088920]
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2010-9-8 5185536]
WinTV Recording Status..lnk - c:\program files\WinTV\WinTV7\WinTVTray.exe [2010-5-24 98304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-11-29 16:00 90112 ----a-w- c:\windows\System32\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2006-11-24 09:36 73728 ----a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"wave1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - BMLoad
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-12-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-31 19:02]
.
2012-12-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-31 19:02]
.
2010-12-16 c:\windows\Tasks\User_Feed_Synchronization-{A6581A79-7EC0-4E1F-82C4-B00E007E92B1}.job
- c:\windows\system32\msfeedssync.exe [2011-05-17 21:16]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dznt9xt.default-1356134083305\
FF - ExtSQL: 2012-12-05 15:12; {B922D405-6D13-4A2B-AE89-08A030DA4402}; c:\program files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}
FF - ExtSQL: 2012-12-05 15:12; {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF - ExtSQL: 2012-12-05 15:12; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-12-22 23:36
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
[0] 0x61666567
.
Scanne versteckte Autostarteinträge...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DataCardMonitor = c:\program files\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe?mp?ogram%7?'????X???????#7? ????D/?????????????????????~7?|?????7??(???am Files\T-Mobile\T-Mobile Internet Manager\????c:\users????????c:\Program Files\T-Mobile\T-Mobile Internet Mana
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.032"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.abr"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ani"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.apd"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.arw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.bay"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.bmp"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.bw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bwf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.bwf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.caf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.caf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cel\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.cel"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CR2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.cr2"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.crw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.cs1"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.cur"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.dcr"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.dcx"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.dib"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.djv"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.djvu"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.dng"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.emf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.eps"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.erf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.fff"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.flc"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fli\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.fli"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.fpx"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.gif"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gsm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.gsm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.hdr"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.icl"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.icn"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.iff"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ilbm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.int"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.inta"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.iw4"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.j2c"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.j2k"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jbr"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jfif"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jif"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jp2"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpc"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpe"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpeg"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpg"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpk"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpx"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kar\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.kar"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.kdc"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.lbm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m15\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.m15"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1a\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.m1a"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2a\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.m2a"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m75\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.m75"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.mef"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.mos"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.mrw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.nef"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.nrw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.orf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pbm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pbr"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pcd"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pct"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pcx"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pef"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pgm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pic"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pics\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pics"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pict"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pix"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.png"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ppm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.psd"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.psp"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pspbrush"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pspimage"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qcp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.qcp"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qtpf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.qtpf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.raf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ras"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.raw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rgb"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rgba"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rle"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rsb"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rw2"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rwl"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sdv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.sdv"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sfil\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.sfil"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.sgi"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.smf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.smi"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smil\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.smil"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.sml"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.sr2"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.srf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.srw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.swa\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.swa"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.tga"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.thm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.tif"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.tiff"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ttc"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ttf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ulw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ulw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v14o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.v14o"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v14p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.v14p"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v14pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.v14pf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vfw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.vfw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.wbm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.wbmp"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.wmf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.xbm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.xif"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.xmp"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.xpm"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(788)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infra.dll
.
Zeit der Fertigstellung: 2012-12-22 23:40:58
ComboFix-quarantined-files.txt 2012-12-22 22:40
.
Vor Suchlauf: 6.879.969.280 Bytes frei
Nach Suchlauf: 6.508.187.648 Bytes frei
.
- - End Of File - - A631A736DC7D8C5BE3EC1105E85BD94B
|
|
23.12.2012, 10:40
| #6 |
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen Da hat Combofix was ganz schön fieses entfernt. Wir brauchen da noch einen weiteren Test. Scan mit MBAR Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ --> Claro Search auf Windows Vista entfernen |
|
23.12.2012, 13:05
| #7 |
| | Claro Search auf Windows Vista entfernen Mbar sagt "Probably rootkit aktivity detected" und startet nicht. Und dann Press no if you are not sure. Ich habe Yes gedrückt und dann wiederholt sich das ganze. Drücke ich no, sagt das Programm, mbar sei nicht up to date und ich soll die neue version laden. Was soll ich tun ? |
|
23.12.2012, 13:06
| #8 |
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen Hm lass bitte Combofix nochmal laufen. Das will ich genauer sehen.
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 13:14
| #9 |
| | Claro Search auf Windows Vista entfernen Darf ich vorher Avira noch deinstallieren ? Das lässt sich so schlecht deaktivieren. Zur Info: Ich wollte vorher ein neues ComboFix von Deinem Link downloaden, das ging nicht, weil das alte schreibgeschützt war. Ich nehme also das alte, wenn Du nichts anderes sagst. |
|
23.12.2012, 13:26
| #10 |
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen Ja Avira deinstallieren aber bitte das alte CF löschen (notfalls neustart) und die neue Version laden.
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 14:31
| #11 |
| | Claro Search auf Windows Vista entfernenCode:
ATTFilter ComboFix 12-12-22.02 - Admin 23.12.2012 14:04:13.3.2 - x86
Microsoft® Windows Vista™ Business 6.0.6002.2.1252.49.1031.18.2045.835 [GMT 1:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-11-23 bis 2012-12-23 ))))))))))))))))))))))))))))))
.
.
2012-12-23 13:15 . 2012-12-23 13:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-12-22 19:06 . 2012-12-22 19:06 -------- d-----w- c:\users\Admin\AppData\Local\DoNotTrackPlus
2012-12-22 18:22 . 2012-12-23 12:47 -------- d-----w- c:\programdata\Avira
2012-12-21 23:57 . 2006-11-27 07:44 176128 ----a-w- c:\windows\system32\igfxres.dll
2012-12-21 22:43 . 2012-12-21 22:43 -------- d-----w- c:\progra~2\0E5F5~1
2012-12-21 22:24 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{333D7F10-6413-4AF8-BA51-05D62896D62E}\mpengine.dll
2012-12-21 22:18 . 2012-12-21 22:18 -------- d-----w- c:\users\Admin\AppData\Roaming\Malwarebytes
2012-12-21 22:18 . 2012-12-21 22:18 -------- d-----w- c:\programdata\Malwarebytes
2012-12-21 22:18 . 2012-09-29 18:54 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-21 22:18 . 2012-12-21 22:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-12-21 22:08 . 2012-12-21 22:08 -------- d-----w- c:\progra~2\0E6FD~1
2012-12-21 22:04 . 2012-12-21 22:04 -------- d-----w- c:\windows\system32\searchplugins
2012-12-21 22:04 . 2012-12-21 22:04 -------- d-----w- c:\windows\system32\Extensions
2012-12-21 22:03 . 2012-12-21 22:03 -------- d-----w-0 c:\progra~2\0ABE9~1
2012-12-21 21:56 . 2012-12-21 21:56 -------- d-----w- c:\progra~2\0B6F9~1
2012-12-21 21:10 . 2012-12-21 21:10 -------- d-----w- c:\progra~2\0ECE5~1
2012-12-21 20:49 . 2012-12-21 20:49 -------- d-----w-0 c:\progra~2\0EBE1~1
2012-12-21 20:20 . 2012-12-21 20:20 -------- d-----w- c:\program files\Enigma Software Group
2012-12-21 19:46 . 2012-12-21 19:46 -------- d-----w-0 c:\progra~2\097E1~1
2012-12-21 07:48 . 2012-12-21 07:48 -------- d-----w-0 c:\progra~2\XX0~1
2012-12-21 07:03 . 2012-12-21 07:03 -------- d-----w-0 c:\progra~2\00BE5~1
2012-12-21 06:33 . 2012-12-16 13:12 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-21 06:33 . 2012-12-16 10:50 293376 ----a-w- c:\windows\system32\atmfd.dll
2012-12-21 00:46 . 2012-12-21 00:46 -------- d-----w- c:\progra~2\0BDE9~1
2012-12-20 23:22 . 2012-12-22 13:26 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-12-20 23:22 . 2012-12-22 22:03 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2012-12-20 22:58 . 2012-12-20 22:58 -------- d-----w- c:\progra~2\068F9~1
2012-12-20 22:30 . 2012-12-20 22:30 -------- d-----w- c:\progra~2\074F9~1
2012-12-20 20:23 . 2012-12-20 20:23 -------- d-----w-0 c:\progra~2\DD0~1
2012-12-20 05:57 . 2012-12-20 05:57 -------- d-----w- c:\progra~2\0D5F1~1
2012-12-19 22:16 . 2012-12-19 22:16 -------- d-----w- c:\programdata\BrowserProtect
2012-12-19 22:15 . 2012-12-19 22:15 -------- d-----w- c:\users\Admin\AppData\Roaming\PerformerSoft
2012-12-19 22:15 . 2012-03-14 14:47 17464 ----a-w- c:\windows\system32\roboot.exe
2012-12-19 22:14 . 2012-12-21 00:29 -------- d-----w- c:\program files\IcoFX 2
2012-12-19 21:16 . 2012-12-19 21:16 -------- d-----w- c:\users\Admin\AppData\Roaming\aicon
2012-12-19 21:16 . 2012-12-19 21:16 -------- d-----w- c:\program files\aicon
2012-12-12 20:57 . 2012-11-14 02:56 149552 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2012-12-12 20:57 . 2012-11-14 01:48 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-12-12 20:57 . 2012-11-14 01:44 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-12-12 20:57 . 2012-11-14 01:51 194048 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2012-12-12 20:57 . 2012-11-14 01:49 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-12-12 20:53 . 2012-07-26 02:46 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-12-12 20:53 . 2012-07-26 02:33 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-12-12 20:53 . 2012-07-26 02:32 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-12-12 20:53 . 2012-07-26 03:20 73216 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-12-12 20:53 . 2012-07-26 03:20 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-12-12 20:53 . 2009-07-14 12:12 16896 ----a-w- c:\windows\system32\winusb.dll
2012-12-12 20:53 . 2012-07-26 03:39 526952 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-12-12 20:53 . 2012-07-26 03:39 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-12-12 20:53 . 2012-07-26 03:21 196608 ----a-w- c:\windows\system32\WUDFHost.exe
2012-12-12 20:53 . 2012-07-26 03:20 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-12-12 20:53 . 2012-07-26 03:20 613888 ----a-w- c:\windows\system32\WUDFx.dll
2012-12-12 20:21 . 2012-11-13 01:36 2048000 ----a-w- c:\windows\system32\win32k.sys
2012-12-12 20:21 . 2012-11-02 10:18 376320 ----a-w- c:\windows\system32\dpnet.dll
2012-12-12 20:21 . 2012-11-02 08:26 23040 ----a-w- c:\windows\system32\dpnsvr.exe
2012-12-12 20:21 . 2012-08-21 11:47 224640 ----a-w- c:\windows\system32\drivers\volsnap.sys
2012-12-12 20:21 . 2012-11-13 01:29 2048 ----a-w- c:\windows\system32\tzres.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-20 05:58 . 2012-07-16 14:29 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-20 05:58 . 2011-09-24 00:48 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-25 16:19 . 2012-11-16 10:01 75776 ----a-w- c:\windows\system32\synceng.dll
2012-09-24 13:32 . 2012-07-16 14:40 477168 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-24 13:32 . 2010-10-12 12:12 473072 ----a-w- c:\windows\system32\deployJava1.dll
2012-12-05 14:12 . 2012-12-05 14:12 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2010-08-22 10:02 . 2012-12-05 14:12 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2006-11-29 16:13 2854912 ----a-w- c:\program files\Protector Suite QL\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2006-11-29 16:13 2854912 ----a-w- c:\program files\Protector Suite QL\farchns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"HW_OPENEYE_OUC_T-Mobile Internet Manager"="c:\program files\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe" [2009-06-23 110592]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2006-09-11 118784]
"DRCU"="c:\program files\Sony\DRCU\DRCU.exe" [2006-12-03 61440]
"VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2006-11-14 411768]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2006-11-11 43128]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2006-11-29 49168]
"VAIODetection"="c:\program files\Sony\WiseWan\NovatelDetection\VAIODetection.exe" [2009-03-26 378880]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-19 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-19 81920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-22 30192]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-10-26 652624]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-09-14 1603152]
"DataCardMonitor"="c:\program files\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe" [2009-09-18 253952]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-27 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-27 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-27 81920]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"ACSW14DE"="c:\program files\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe" [2011-11-17 1231472]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2009-6-19 82026]
AutoStart IR.lnk - c:\program files\WinTV\Ir.exe [2010-5-24 110647]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-1-18 2752512]
FRITZ!DSL Startcenter.lnk - c:\windows\Installer\{2457326B-C110-40C3-89B0-889CC913871A}\Icon2457326B4.exe [2009-4-7 29184]
Personal.lnk - c:\program files\Personal\bin\Personal.exe [2011-12-16 1088920]
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2010-9-8 5185536]
WinTV Recording Status..lnk - c:\program files\WinTV\WinTV7\WinTVTray.exe [2010-5-24 98304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-11-29 16:00 90112 ----a-w- c:\windows\System32\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2006-11-24 09:36 73728 ----a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\BROWSE~1\251005~1.80\{C16C1~1\BrowserProtect.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"wave1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - BMLoad
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-31 19:02]
.
2012-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-31 19:02]
.
2010-12-16 c:\windows\Tasks\User_Feed_Synchronization-{A6581A79-7EC0-4E1F-82C4-B00E007E92B1}.job
- c:\windows\system32\msfeedssync.exe [2011-05-17 21:16]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dznt9xt.default-1356134083305\
FF - prefs.js: browser.search.selectedEngine - Claro Search
FF - ExtSQL: 2012-12-05 15:12; {B922D405-6D13-4A2B-AE89-08A030DA4402}; c:\program files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}
FF - ExtSQL: 2012-12-05 15:12; {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF - ExtSQL: 2012-12-05 15:12; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-12-23 14:15
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DataCardMonitor = c:\program files\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe?mp?ogram%7?'????X???????#7? ????D/?????????????????????~7?|?????7??(???am Files\T-Mobile\T-Mobile Internet Manager\????c:\users????????c:\Program Files\T-Mobile\T-Mobile Internet Mana
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.032"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.abr"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ani"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.apd"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.arw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.bay"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.bmp"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.bw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bwf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.bwf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.caf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.caf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cel\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.cel"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CR2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.cr2"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.crw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.cs1"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.cur"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.dcr"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.dcx"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.dib"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.djv"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.djvu"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.dng"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.emf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.eps"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.erf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.fff"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.flc"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fli\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.fli"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.fpx"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.gif"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gsm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.gsm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.hdr"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.icl"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.icn"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.iff"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ilbm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.int"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.inta"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.iw4"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.j2c"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.j2k"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jbr"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jfif"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jif"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jp2"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpc"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpe"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpeg"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpg"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpk"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.jpx"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kar\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.kar"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.kdc"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.lbm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m15\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.m15"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1a\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.m1a"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2a\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.m2a"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m75\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.m75"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.mef"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.mos"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.mrw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.nef"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.nrw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.orf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pbm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pbr"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pcd"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pct"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pcx"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pef"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pgm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pic"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pics\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pics"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pict"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pix"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.png"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ppm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.psd"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.psp"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pspbrush"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.pspimage"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qcp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.qcp"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qtpf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.qtpf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.raf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ras"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.raw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rgb"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rgba"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rle"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rsb"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rw2"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.rwl"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sdv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.sdv"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sfil\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.sfil"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.sgi"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.smf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.smi"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smil\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.smil"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.sml"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.sr2"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.srf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.srw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.swa\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.swa"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.tga"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.thm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.tif"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.tiff"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ttc"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ttf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ulw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.ulw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v14o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.v14o"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v14p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.v14p"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v14pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.v14pf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vfw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.vfw"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.wbm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.wbmp"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.wmf"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.xbm"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.xif"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.xmp"
.
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 14.xpm"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(776)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infra.dll
.
- - - - - - - > 'Explorer.exe'(4584)
c:\program files\Protector Suite QL\farchns.dll
c:\program files\Protector Suite QL\infra.dll
.
Zeit der Fertigstellung: 2012-12-23 14:19:52
ComboFix-quarantined-files.txt 2012-12-23 13:19
ComboFix2.txt 2012-12-23 12:45
ComboFix3.txt 2012-12-22 22:40
.
Vor Suchlauf: 7.629.316.096 Bytes frei
Nach Suchlauf: 7.478.767.616 Bytes frei
.
- - End Of File - - EB00FF9F3473FF970BCA73D99B825888
|
|
23.12.2012, 14:40
| #12 |
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen ALso da müssen wir nochmal anders ran: Customscan mit OTL
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 15:43
| #13 |
| | Claro Search auf Windows Vista entfernen Ich habe in den Dateinamen personenbezogene Daten. Kann ich die rausxxxxen oder Dir die Dateien als PN senden ? |
|
23.12.2012, 15:47
| #14 |
| /// TB-Ausbilder | Claro Search auf Windows Vista entfernen Du kannst die unkenntlich machen, wenn es unbedingt sein muss.
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 15:53
| #15 |
| | Claro Search auf Windows Vista entfernen OTL.txt: Code:
ATTFilter OTL logfile created on: 23.12.2012 14:50:20 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Admin\Desktop Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 0,91 Gb Available Physical Memory | 45,39% Memory free 4,23 Gb Paging File | 3,04 Gb Available in Paging File | 71,85% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 86,31 Gb Total Space | 7,03 Gb Free Space | 8,15% Space Free | Partition Type: NTFS Drive D: | 100,00 Gb Total Space | 45,71 Gb Free Space | 45,71% Space Free | Partition Type: NTFS Drive F: | 43,65 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: xxxxxxx | User Name: Admin | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: On | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Admin\Desktop\OTL.exe (OldTimer Tools) PRC - C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe () PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (ACD Systems) PRC - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe () PRC - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe () PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (Western Digital Technologies, Inc.) PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC) PRC - C:\Program Files\WinTV\WinTV7\WinTVTray.exe (Hauppauge Computer Works, Inc.) PRC - C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe (Hauppauge Computer Works) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Program Files\Sony\WiseWan\NovatelDetection\VAIODetection.exe ( Sony VOE) PRC - C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe (Sony Corporation) PRC - C:\Windows\System32\schtasks.exe (Microsoft Corporation) PRC - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation) PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.) PRC - C:\Program Files\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin) PRC - C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe (Sony Corporation) PRC - C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation) PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.) PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.) PRC - C:\Program Files\Protector Suite QL\upeksvr.exe (UPEK Inc.) PRC - C:\Program Files\Protector Suite QL\psqltray.exe (UPEK Inc.) PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation) PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe (Sony Corporation) PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation) PRC - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation) PRC - C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation) PRC - C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe (Sony Corporation) PRC - C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation) PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION) PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\Apoint\ApMsgFwd.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.) PRC - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.) ========== Modules (No Company Name) ========== MOD - C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe () MOD - C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll () MOD - C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll () MOD - C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll () MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\Program Files\WinTV\TVServer\HauppaugeTVServerps.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll () MOD - C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll () MOD - C:\Program Files\Sony\VAIO Camera Utility\VCULib.dll () MOD - C:\Windows\System32\TosCommAPI.dll () ========== Services (SafeList) ========== SRV - (CLTNetCnService) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon File not found SRV - (BrowserProtect) -- C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe () SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (WDFME) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe () SRV - (WDSC) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe () SRV - (WDDMService) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC) SRV - (HauppaugeTVServer) -- C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe (Hauppauge Computer Works) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (BcmSqlStartupSvc) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation) SRV - (IGDCTRL) -- C:\Program Files\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin) SRV - (SSScsiSV) -- C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe (Sony Corporation) SRV - (SonicStage Back-End Service) -- C:\Program Files\Common Files\Sony Shared\AvLib\SsBeSvc.exe (Sony Corporation) SRV - (VAIOMediaPlatform-IntegratedServer-AppServer) -- C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe (Sony Corporation) SRV - (VAIOMediaPlatform-UCLS-UPnP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe (Sony Corporation) SRV - (VAIOMediaPlatform-IntegratedServer-UPnP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe (Sony Corporation) SRV - (VAIOMediaPlatform-UCLS-AppServer) -- C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe (Sony Corporation) SRV - (VAIO Entertainment TV Device Arbitration Service) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe (Sony Corporation) SRV - (VAIOMediaPlatform-UCLS-HTTP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe (Sony Corporation) SRV - (VAIOMediaPlatform-IntegratedServer-HTTP) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe (Sony Corporation) SRV - (VAIOMediaPlatform-Mobile-Gateway) -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe (Sony Corporation) SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AvLib\MSCSPTISRV.exe (Sony Corporation) SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AvLib\SPTISRV.exe (Sony Corporation) SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AvLib\PACSPTISVR.exe () SRV - (Vcsw) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation) SRV - (VzFw) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe (Sony Corporation) SRV - (VzCdbSvc) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation) SRV - (VAIO Event Service) -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation) SRV - (TOSHIBA Bluetooth Service) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION) ========== Driver Services (SafeList) ========== DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found DRV - (mbr) -- C:\ComboFix\mbr.sys File not found DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found DRV - (hwusbfake) -- system32\DRIVERS\ewusbfake.sys File not found DRV - (catchme) -- C:\Users\Admin\AppData\Local\Temp\catchme.sys File not found DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation) DRV - (hcwAVD2) -- C:\Windows\System32\drivers\HCWUSB2AV.sys (Conexant Systems, Inc.) DRV - (FTDIBUS) -- C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (hwusbdev) -- C:\Windows\System32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.) DRV - (WDC_SAM) -- C:\Windows\System32\drivers\wdcsam.sys (Western Digital Technologies) DRV - (BMLoad) -- C:\Windows\System32\drivers\BMLoad.sys (Bytemobile, Inc.) DRV - (tcpipBM) -- C:\Windows\System32\drivers\tcpipBM.sys (Bytemobile, Inc.) DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.) DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation) DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION) DRV - (tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (shpf) -- C:\Windows\System32\drivers\shpf.sys (Sony Corporation) DRV - (tosrfbnp) -- C:\Windows\System32\drivers\tosrfbnp.sys (TOSHIBA Corporation) DRV - (R5U870FLx86) -- C:\Windows\System32\drivers\R5U870FLx86.sys (Ricoh) DRV - (R5U870FUx86) -- C:\Windows\System32\drivers\R5U870FUx86.sys (Ricoh) DRV - (NWADI) -- C:\Windows\System32\drivers\NWADIenum.sys (Novatel Wireless Inc) DRV - (ti21sony) -- C:\Windows\System32\drivers\ti21sony.sys (Texas Instruments) DRV - (NETw3v32) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation) DRV - (DMICall) -- C:\Windows\System32\drivers\DMICall.sys (Sony Corporation) DRV - (SNC) -- C:\Windows\System32\drivers\SonyNC.sys (Sony Corporation) DRV - (tosporte) -- C:\Windows\System32\drivers\tosporte.sys (TOSHIBA Corporation) DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.) DRV - (SPI) -- C:\Windows\System32\drivers\SonyPI.sys (Sony Corporation) DRV - (SonyImgF) -- C:\Windows\System32\drivers\SonyImgF.sys (Sony Corporation) DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.) DRV - (iComp) -- C:\Windows\System32\drivers\HCWUSB2.sys (Hauppauge Computer Works, Inc.) DRV - (Tosrfcom) -- C:\Windows\System32\drivers\tosrfcom.sys (TOSHIBA Corporation) DRV - (tosrfnds) -- C:\Windows\System32\drivers\tosrfnds.sys (TOSHIBA Corporation.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://partnerpage.google.com/eu.s [Binary data over 200 bytes] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://partnerpage.google.com/eu.s [Binary data over 200 bytes] IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 45 E3 2E C7 DF DF CD 01 [binary data] IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..\SearchScopes\{631D8DC9-02BE-4B93-994E-569D0AA83624}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=caa1ac93-d441-4705-bb9f-4bca8ba052e4&apn_sauid=5E7C3CF7-EEFA-4614-BA26-EE50AE5A82CD IE - HKU\S-1-5-21-934988780-789137344-2609288493-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Claro Search" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@se.nexus/Personal: C:\Program Files\Personal\bin\np_prsnl.dll (Technology Nexus AB) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.05 15:12:42 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.12.05 15:12:33 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.05 15:12:42 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.12.05 15:12:33 | 000,000,000 | ---D | M] [2009.06.25 06:29:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions [2012.12.22 20:41:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\3dznt9xt.default-1356134083305\Extensions [2012.12.22 22:57:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2012.12.05 15:12:31 | 000,000,000 | ---D | M] (pdfforge Toolbar Plugin) -- C:\Program Files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402} [2012.12.05 15:12:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012.12.20 23:53:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com [2012.12.05 15:12:42 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.06.29 19:05:58 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.08.30 09:05:09 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.06.29 19:05:58 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.06.29 19:05:58 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.29 19:05:58 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.29 19:05:58 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: () CHR - default_search_provider: search_url = CHR - default_search_provider: suggest_url = CHR - homepage: hxxp://www.claro-search.com/?affID=114506&tt=5112_8&babsrc=HP_clro&mntrId=8866423e0000000000000019d2b5669a CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\ CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\ CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\ CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2012.12.22 23:35:49 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Germany GmbH) O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google BAE\BAE.dll (Your Company Name) O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Germany GmbH) O3 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Germany GmbH) O4 - HKLM..\Run: [ACSW14DE] C:\Program Files\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (ACD Systems) O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.) O4 - HKLM..\Run: [DataCardMonitor] C:\Program Files\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.) O4 - HKLM..\Run: [DRCU] C:\Program Files\Sony\DRCU\DRCU.exe (Sony Corporation) O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.) O4 - HKLM..\Run: [VAIOCameraUtility] C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe (Sony Corporation) O4 - HKLM..\Run: [VAIODetection] C:\Program Files\Sony\WiseWan\NovatelDetection\VAIODetection.exe ( Sony VOE) O4 - HKU\S-1-5-21-934988780-789137344-2609288493-1004..\Run: [HW_OPENEYE_OUC_T-Mobile Internet Manager] C:\Program Files\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..Trusted Domains: fritz.box ([]* in Lokales Intranet) O15 - HKU\S-1-5-21-934988780-789137344-2609288493-1004\..Trusted Domains: localhost ([]http in Lokales Intranet) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9BFEB1E5-4DDC-4C56-BFE7-D42653BA50AF}: DhcpNameServer = 192.168.0.1 O20 - AppInit_DLLs: (c:\windows\windowsmobile\wmdc.exe) - File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.) O20 - Winlogon\Notify\psfus: DllName - (C:\Windows\system32\psqlpwd.dll) - C:\Windows\System32\psqlpwd.dll (UPEK Inc.) O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: VIDC.ACDV - ACDV.dll File not found Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: VIDC.dvsd - C:\Program Files\Common Files\Sony Shared\VideoLib\sonydv.dll (Sony Corporation) SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.12.23 14:44:22 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe [2012.12.23 14:18:47 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2012.12.23 14:00:30 | 000,000,000 | ---D | C] -- C:\ComboFix [2012.12.23 13:58:51 | 005,012,898 | R--- | C] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe [2012.12.23 12:56:51 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\mbar-1.01.0.1009 [2012.12.22 23:19:43 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2012.12.22 23:19:43 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2012.12.22 23:19:42 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2012.12.22 23:19:16 | 000,000,000 | ---D | C] -- C:\Qoobox [2012.12.22 23:18:40 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2012.12.22 22:31:42 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\Admin\Desktop\dds.com [2012.12.22 22:14:08 | 000,448,512 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\TFC.exe [2012.12.22 20:06:14 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\DoNotTrackPlus [2012.12.22 19:22:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2012.12.22 14:26:44 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\ProcAlyzer Dumps [2012.12.21 23:18:51 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes [2012.12.21 23:18:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.12.21 23:18:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.12.21 23:18:29 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.12.21 23:18:28 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.12.21 23:04:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\searchplugins [2012.12.21 23:04:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\Extensions [2012.12.21 21:20:31 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group [2012.12.21 00:22:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2012.12.21 00:22:30 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2 [2012.12.19 23:17:08 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect [2012.12.19 23:16:56 | 000,000,000 | ---D | C] -- C:\ProgramData\BrowserProtect [2012.12.19 23:15:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\PerformerSoft [2012.12.19 23:15:43 | 000,017,464 | ---- | C] (PerformerSoft LLC) -- C:\Windows\System32\roboot.exe [2012.12.19 23:14:51 | 000,000,000 | ---D | C] -- C:\Program Files\IcoFX 2 [2012.12.19 22:16:54 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\aicon [2012.12.19 22:16:49 | 000,000,000 | ---D | C] -- C:\Program Files\aicon [2012.12.19 22:16:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\@icon sushi [2012.12.15 17:58:50 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\XXXXXXXXX [2012.12.14 15:55:02 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\XXXXXXXXXXXXXXX [2012.12.12 21:57:01 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.12.12 21:57:00 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.12.12 21:57:00 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2012.12.12 21:57:00 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.12.12 21:56:59 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2012.12.12 21:56:58 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.12.12 21:56:58 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.12.12 21:56:55 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.12.12 21:53:17 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll [2012.12.12 21:53:09 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll [2012.12.12 21:53:09 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winusb.dll [2012.12.12 21:53:07 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys [2012.12.12 21:53:06 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll [2012.12.12 21:53:05 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll [2012.12.12 21:21:21 | 002,048,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012.12.12 21:21:18 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnet.dll [2012.12.12 21:21:18 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnsvr.exe [2012.12.12 21:21:03 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2012.12.05 15:12:30 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox ========== Files - Modified Within 30 Days ========== [2012.12.23 14:44:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe [2012.12.23 13:58:53 | 005,012,898 | R--- | M] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe [2012.12.23 13:52:16 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics [2012.12.23 13:51:39 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.12.23 13:50:56 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.23 13:50:56 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.23 13:50:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.12.23 13:44:02 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.12.22 23:35:49 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts [2012.12.22 22:31:42 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\Admin\Desktop\dds.com [2012.12.22 22:14:09 | 000,448,512 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\TFC.exe [2012.12.22 21:10:07 | 000,000,000 | ---- | M] () -- C:\Users\Admin\defogger_reenable [2012.12.22 18:08:04 | 000,752,008 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.12.22 18:08:04 | 000,697,526 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.12.22 18:08:04 | 000,179,980 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.12.22 18:08:04 | 000,144,632 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.12.21 23:18:35 | 000,000,866 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.21 21:41:08 | 000,547,175 | ---- | M] () -- C:\Users\Admin\Desktop\adwcleaner.exe [2012.12.21 07:53:04 | 000,496,968 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.12.19 22:16:49 | 000,000,674 | ---- | M] () -- C:\Users\Admin\Desktop\@icon sushi.lnk [2012.12.12 18:49:03 | 000,001,931 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2012.12.07 00:36:09 | 000,011,443 | ---- | M] () -- C:\Users\Admin\gsview32.ini [2012.11.26 14:41:16 | 000,015,872 | ---- | M] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.11.24 18:05:54 | 001,062,736 | ---- | M] () -- C:\Users\Admin\Documents\GARtrip.pdf [2012.11.23 16:06:12 | 005,479,806 | ---- | M] () -- C:\Users\Admin\Documents\k3_s94.pdf ========== Files Created - No Company Name ========== [2012.12.22 23:19:43 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2012.12.22 23:19:43 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2012.12.22 23:19:43 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2012.12.22 23:19:43 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2012.12.22 23:19:43 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2012.12.22 21:10:07 | 000,000,000 | ---- | C] () -- C:\Users\Admin\defogger_reenable [2012.12.21 23:18:35 | 000,000,866 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.21 21:41:08 | 000,547,175 | ---- | C] () -- C:\Users\Admin\Desktop\adwcleaner.exe [2012.12.19 22:16:49 | 000,000,674 | ---- | C] () -- C:\Users\Admin\Desktop\@icon sushi.lnk [2012.12.12 21:53:48 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf [2012.12.12 21:53:48 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2012.11.23 16:06:02 | 005,479,806 | ---- | C] () -- C:\Users\Admin\Documents\k3_s94.pdf [2012.11.04 21:31:57 | 000,011,443 | ---- | C] () -- C:\Users\Admin\gsview32.ini [2010.02.13 23:08:37 | 000,000,923 | -H-- | C] () -- C:\Users\Admin\AppData\Roaming\eSReg.ini [2009.12.09 14:29:26 | 000,001,356 | ---- | C] () -- C:\Users\Admin\AppData\Local\d3d9caps.dat [2009.03.27 16:10:37 | 000,015,872 | ---- | C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== ZeroAccess Check ========== [2006.11.02 13:54:18 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.01.10 20:20:55 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ACD Systems [2012.12.19 22:16:54 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\aicon [2012.05.16 15:56:08 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Audacity [2009.09.01 11:21:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\becker [2009.03.27 10:06:38 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Bytemobile [2009.12.01 00:30:10 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DassaultSystemes [2009.12.01 00:36:22 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\EDrawings [2009.11.30 20:40:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FreeCAD [2009.04.07 21:50:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FRITZ! [2012.03.10 23:44:26 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GARMIN [2009.12.01 00:33:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GuthCAD [2009.09.18 18:20:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\HCM Updater [2009.06.19 07:34:04 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\InterTrust [2010.05.24 09:39:43 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\InterVideo [2010.02.13 23:19:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\NAVI [2012.12.19 23:15:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PerformerSoft [2009.09.03 21:07:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Personal [2009.11.30 23:52:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\RibbonSoft [2011.07.27 21:59:12 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SolidDocuments [2011.11.15 16:41:48 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SumatraPDF [2009.09.18 18:32:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\T-Mobile [2010.09.13 15:16:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\T-Mobile Internet Manager [2012.11.14 13:31:57 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\VSO [2010.02.21 17:09:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\WIB2 ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2012.12.23 14:18:47 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2009.06.25 09:11:24 | 000,000,000 | ---D | M] -- C:\Boot [2012.12.23 14:19:56 | 000,000,000 | ---D | M] -- C:\ComboFix [2012.12.22 22:59:42 | 000,000,000 | ---D | M] -- C:\Config.Msi [2007.03.09 15:17:24 | 000,000,000 | ---D | M] -- C:\Documentation [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2007.03.09 06:23:14 | 000,000,000 | ---D | M] -- C:\Drivers [2012.06.28 09:52:07 | 000,000,000 | ---D | M] -- C:\Garmin [2010.05.24 10:44:45 | 000,000,000 | ---D | M] -- C:\Hauppauge [2009.03.26 15:31:07 | 000,000,000 | ---D | M] -- C:\Infineon [2009.12.09 14:33:05 | 000,000,000 | ---D | M] -- C:\Intel [2007.03.09 15:22:33 | 000,000,000 | R--D | M] -- C:\MSOCache [2009.03.27 09:39:19 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.12.23 13:50:32 | 000,000,000 | ---D | M] -- C:\Program Files [2012.12.23 13:50:32 | 000,000,000 | ---D | M] -- C:\ProgramData [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\Programme [2012.12.23 14:19:56 | 000,000,000 | ---D | M] -- C:\Qoobox [2012.12.23 14:54:48 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2010.03.08 10:34:27 | 000,000,000 | ---D | M] -- C:\temp [2010.03.08 10:34:11 | 000,000,000 | ---D | M] -- C:\tmp [2009.03.27 14:08:02 | 000,000,000 | ---D | M] -- C:\Update [2009.03.26 15:15:00 | 000,000,000 | R--D | M] -- C:\Users [2009.03.27 11:12:25 | 000,000,000 | ---D | M] -- C:\VAIO Entertainment [2012.12.23 14:15:54 | 000,000,000 | ---D | M] -- C:\Windows [2009.07.06 09:47:46 | 000,000,000 | ---D | M] -- C:\YPC_VIEW < %SYSTEMDRIVE%\*.* > [2012.12.21 23:09:51 | 000,003,508 | ---- | M] () -- C:\AdwCleaner[R10].txt [2012.12.21 23:16:37 | 000,003,569 | ---- | M] () -- C:\AdwCleaner[R11].txt [2012.12.21 23:29:40 | 000,003,630 | ---- | M] () -- C:\AdwCleaner[R12].txt [2012.12.21 23:44:32 | 000,003,691 | ---- | M] () -- C:\AdwCleaner[R13].txt [2012.12.22 00:30:17 | 000,002,996 | ---- | M] () -- C:\AdwCleaner[R19].txt [2012.12.20 23:52:23 | 000,009,790 | ---- | M] () -- C:\AdwCleaner[R1].txt [2012.12.22 00:31:19 | 000,003,057 | ---- | M] () -- C:\AdwCleaner[R20].txt [2012.12.22 00:35:32 | 000,002,657 | ---- | M] () -- C:\AdwCleaner[R21].txt [2012.12.22 00:37:10 | 000,002,718 | ---- | M] () -- C:\AdwCleaner[R22].txt [2012.12.22 00:45:42 | 000,002,840 | ---- | M] () -- C:\AdwCleaner[R23].txt [2012.12.22 00:51:05 | 000,002,962 | ---- | M] () -- C:\AdwCleaner[R24].txt [2012.12.22 01:10:04 | 000,003,440 | ---- | M] () -- C:\AdwCleaner[R25].txt [2012.12.22 01:20:32 | 000,003,501 | ---- | M] () -- C:\AdwCleaner[R26].txt [2012.12.22 01:31:25 | 000,003,623 | ---- | M] () -- C:\AdwCleaner[R27].txt [2012.12.22 01:39:10 | 000,003,738 | ---- | M] () -- C:\AdwCleaner[R28].txt [2012.12.22 01:44:49 | 000,003,867 | ---- | M] () -- C:\AdwCleaner[R29].txt [2012.12.20 23:53:10 | 000,009,850 | ---- | M] () -- C:\AdwCleaner[R2].txt [2012.12.22 01:46:56 | 000,003,928 | ---- | M] () -- C:\AdwCleaner[R30].txt [2012.12.22 01:51:59 | 000,004,017 | ---- | M] () -- C:\AdwCleaner[R31].txt [2012.12.22 01:59:29 | 000,004,172 | ---- | M] () -- C:\AdwCleaner[R32].txt [2012.12.22 18:37:32 | 000,004,582 | ---- | M] () -- C:\AdwCleaner[R33].txt [2012.12.22 18:47:26 | 000,004,355 | ---- | M] () -- C:\AdwCleaner[R34].txt [2012.12.22 20:39:07 | 000,011,446 | ---- | M] () -- C:\AdwCleaner[R35].txt [2012.12.22 20:57:26 | 000,004,759 | ---- | M] () -- C:\AdwCleaner[R36].txt [2012.12.22 22:01:56 | 000,004,820 | ---- | M] () -- C:\AdwCleaner[R37].txt [2012.12.23 08:58:30 | 000,004,942 | ---- | M] () -- C:\AdwCleaner[R38].txt [2012.12.21 00:00:17 | 000,002,320 | ---- | M] () -- C:\AdwCleaner[R3].txt [2012.12.21 20:41:04 | 000,002,808 | ---- | M] () -- C:\AdwCleaner[R4].txt [2012.12.21 21:42:28 | 000,002,829 | ---- | M] () -- C:\AdwCleaner[R5].txt [2012.12.21 22:04:05 | 000,003,026 | ---- | M] () -- C:\AdwCleaner[R6].txt [2012.12.21 22:24:55 | 000,003,146 | ---- | M] () -- C:\AdwCleaner[R7].txt [2012.12.21 22:57:35 | 000,003,266 | ---- | M] () -- C:\AdwCleaner[R8].txt [2012.12.21 23:04:02 | 000,003,386 | ---- | M] () -- C:\AdwCleaner[R9].txt [2012.12.22 00:37:49 | 000,002,741 | ---- | M] () -- C:\AdwCleaner[S10].txt [2012.12.22 00:46:36 | 000,002,863 | ---- | M] () -- C:\AdwCleaner[S11].txt [2012.12.22 01:23:04 | 000,003,524 | ---- | M] () -- C:\AdwCleaner[S12].txt [2012.12.22 01:31:52 | 000,003,646 | ---- | M] () -- C:\AdwCleaner[S13].txt [2012.12.22 01:40:00 | 000,003,601 | ---- | M] () -- C:\AdwCleaner[S14].txt [2012.12.22 01:47:24 | 000,003,951 | ---- | M] () -- C:\AdwCleaner[S15].txt [2012.12.22 01:52:53 | 000,003,880 | ---- | M] () -- C:\AdwCleaner[S16].txt [2012.12.22 18:41:07 | 000,004,445 | ---- | M] () -- C:\AdwCleaner[S17].txt [2012.12.22 20:41:31 | 000,011,378 | ---- | M] () -- C:\AdwCleaner[S18].txt [2012.12.22 22:02:36 | 000,004,714 | ---- | M] () -- C:\AdwCleaner[S19].txt [2012.12.20 23:53:34 | 000,009,643 | ---- | M] () -- C:\AdwCleaner[S1].txt [2012.12.21 00:00:53 | 000,002,342 | ---- | M] () -- C:\AdwCleaner[S2].txt [2012.12.21 20:42:16 | 000,002,830 | ---- | M] () -- C:\AdwCleaner[S3].txt [2012.12.21 21:43:19 | 000,002,851 | ---- | M] () -- C:\AdwCleaner[S4].txt [2012.12.21 22:04:48 | 000,003,048 | ---- | M] () -- C:\AdwCleaner[S5].txt [2012.12.21 22:25:35 | 000,003,168 | ---- | M] () -- C:\AdwCleaner[S6].txt [2012.12.21 22:58:15 | 000,003,288 | ---- | M] () -- C:\AdwCleaner[S7].txt [2012.12.21 23:04:36 | 000,003,408 | ---- | M] () -- C:\AdwCleaner[S8].txt [2012.12.22 00:31:49 | 000,002,954 | ---- | M] () -- C:\AdwCleaner[S9].txt [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat [2009.04.11 07:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr [2007.03.09 19:40:09 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK [2012.12.23 14:19:52 | 000,039,166 | ---- | M] () -- C:\ComboFix.txt [2006.09.18 22:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys [2007.03.09 15:37:54 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2007.03.09 15:37:54 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2012.12.23 13:50:36 | 2459,242,496 | -HS- | M] () -- C:\pagefile.sys [2009.09.18 18:29:51 | 000,007,361 | ---- | M] () -- C:\SoftUpdateLog.txt [2009.03.26 15:19:22 | 000,389,194 | ---- | M] () -- C:\vcredist_x86.log < %PROGRAMFILES%\*.* > [2009.03.27 09:52:10 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini Invalid Environment Variable: PROGRAMFILES(X86) < %appdata%\*. > [2012.01.10 20:20:55 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ACD Systems [2012.10.10 11:03:38 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Adobe [2012.12.19 22:16:54 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\aicon [2009.11.13 13:55:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Apple Computer [2012.05.16 15:56:08 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Audacity [2011.12.24 16:42:57 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AVS4YOU [2009.09.01 11:21:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\becker [2009.03.27 10:06:38 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Bytemobile [2009.12.01 00:30:10 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DassaultSystemes [2009.12.01 00:36:22 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\EDrawings [2009.11.30 20:40:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FreeCAD [2009.04.07 21:50:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FRITZ! [2012.03.10 23:44:26 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GARMIN [2009.03.27 10:20:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Google [2009.12.01 00:33:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GuthCAD [2009.09.18 18:20:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\HCM Updater [2007.03.09 10:52:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Identities [2009.06.19 07:34:04 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\InterTrust [2010.05.24 09:39:43 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\InterVideo [2009.03.26 23:39:03 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Macromedia [2012.12.21 23:18:51 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Malwarebytes [2012.11.19 21:47:54 | 000,000,000 | --SD | M] -- C:\Users\Admin\AppData\Roaming\Microsoft [2009.06.25 06:29:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Mozilla [2010.02.13 23:19:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\NAVI [2012.12.19 23:15:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PerformerSoft [2009.09.03 21:07:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Personal [2009.11.30 23:52:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\RibbonSoft [2012.05.15 23:07:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Roxio [2011.07.27 21:59:12 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SolidDocuments [2010.01.30 10:54:41 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Sony Corporation [2011.11.15 16:41:48 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SumatraPDF [2009.09.18 18:32:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\T-Mobile [2010.09.13 15:16:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\T-Mobile Internet Manager [2009.11.30 23:51:02 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\U3 [2011.12.24 17:09:46 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\vlc [2012.11.14 13:31:57 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\VSO [2010.02.21 17:09:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\WIB2 < %appdata%\*.* > [2010.02.14 20:47:01 | 000,000,923 | -H-- | M] () -- C:\Users\Admin\AppData\Roaming\eSReg.ini < %localappdata%\*. > [2012.01.10 21:37:48 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\ACD Systems [2012.10.10 10:39:33 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Adobe [2009.03.26 15:15:33 | 000,000,000 | -HSD | M] -- C:\Users\Admin\AppData\Local\Anwendungsdaten [2009.05.05 13:24:59 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Apple [2009.11.13 13:52:50 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Apple Computer [2009.12.01 00:30:10 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\DassaultSystemes [2012.12.22 20:06:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\DoNotTrackPlus [2012.03.09 21:23:44 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Downloaded Installations [2009.04.07 21:50:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\FRITZ! [2012.03.10 23:43:19 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Garmin [2012.03.10 23:42:54 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\GARMIN_Corp [2012.03.31 20:06:44 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Google [2012.07.16 18:45:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Macromedia [2012.07.16 18:45:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Microsoft [2010.01.01 16:11:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Microsoft Help [2009.06.25 06:29:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Mozilla [2007.03.09 15:31:51 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Seven Zip [2012.12.23 14:49:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Temp [2009.03.26 15:15:33 | 000,000,000 | -HSD | M] -- C:\Users\Admin\AppData\Local\Temporary Internet Files [2009.03.26 16:25:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Toshiba [2009.03.26 15:15:33 | 000,000,000 | -HSD | M] -- C:\Users\Admin\AppData\Local\Verlauf [2009.04.03 09:45:08 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\VirtualStore [2010.05.15 20:43:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\VSO [2012.01.13 13:50:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Western Digital [2012.01.13 13:45:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\Western_Digital [2009.03.26 23:37:51 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Local\WindowsUpdate < %localappdata%\*.* > [2011.04.27 15:43:01 | 000,001,356 | ---- | M] () -- C:\Users\Admin\AppData\Local\d3d9caps.dat [2012.11.26 14:41:16 | 000,015,872 | ---- | M] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.12.04 10:03:51 | 000,132,376 | ---- | M] () -- C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT [2012.12.23 13:49:12 | 004,558,953 | -H-- | M] () -- C:\Users\Admin\AppData\Local\IconCache.db < %allusersprofile%\*. > [2012.09.23 11:51:45 | 000,000,000 | ---D | M] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2012.01.13 19:31:06 | 000,000,000 | ---D | M] -- C:\ProgramData\ACD Systems [2012.11.13 23:15:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten [2009.11.13 13:50:06 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple [2009.05.05 13:26:49 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple Computer [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data [2012.12.23 13:47:55 | 000,000,000 | ---D | M] -- C:\ProgramData\Avira [2011.12.24 16:42:57 | 000,000,000 | ---D | M] -- C:\ProgramData\AVS4YOU [2012.12.19 23:16:56 | 000,000,000 | ---D | M] -- C:\ProgramData\BrowserProtect [2009.05.29 18:20:37 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ [2009.12.01 00:32:59 | 000,000,000 | ---D | M] -- C:\ProgramData\DassaultSystemes [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente [2011.11.15 16:23:07 | 000,000,000 | ---D | M] -- C:\ProgramData\ebro electronic [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites [2012.03.10 23:44:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Garmin [2007.03.09 15:17:08 | 000,000,000 | ---D | M] -- C:\ProgramData\Google [2011.12.27 21:54:00 | 000,000,000 | ---D | M] -- C:\ProgramData\hps [2009.12.30 18:10:08 | 000,000,000 | ---D | M] -- C:\ProgramData\JVComm32 [2012.12.21 23:18:33 | 000,000,000 | ---D | M] -- C:\ProgramData\Malwarebytes [2010.09.09 23:26:05 | 000,000,000 | ---D | M] -- C:\ProgramData\McAfee [2012.12.22 23:00:17 | 000,000,000 | --SD | M] -- C:\ProgramData\Microsoft [2012.12.12 21:56:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft Help [2012.04.26 09:30:58 | 000,000,000 | ---D | M] -- C:\ProgramData\Mozilla [2009.09.10 19:07:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Office Genuine Advantage [2012.05.15 23:07:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Roxio [2009.12.28 16:46:52 | 000,000,000 | ---D | M] -- C:\ProgramData\SeaTTY [2010.03.08 17:28:49 | 000,000,000 | ---D | M] -- C:\ProgramData\SolidDocuments [2010.01.30 10:59:48 | 000,000,000 | ---D | M] -- C:\ProgramData\Sonic [2007.03.09 11:04:04 | 000,000,000 | ---D | M] -- C:\ProgramData\Sony [2009.03.27 17:17:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Sony Corporation [2012.12.22 14:26:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Spybot - Search & Destroy [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü [2010.10.12 13:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\Sun [2009.04.05 21:18:14 | 000,000,000 | ---D | M] -- C:\ProgramData\Symantec [2012.04.02 17:43:55 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP [2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates [2011.12.29 07:13:25 | 000,000,000 | ---D | M] -- C:\ProgramData\tmp [2009.03.26 15:31:41 | 000,000,000 | ---D | M] -- C:\ProgramData\UIB [2009.03.26 15:49:07 | 000,000,000 | ---D | M] -- C:\ProgramData\VAIO Media Platform [2007.03.09 10:49:39 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen [2012.01.13 13:33:01 | 000,000,000 | ---D | M] -- C:\ProgramData\Western Digital [2010.07.14 18:38:57 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch [2010.07.18 09:19:46 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2007.03.09 15:32:04 | 000,000,000 | ---D | M] -- C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1} [2009.09.14 15:31:37 | 000,000,000 | ---D | M] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD} [2009.05.05 13:27:07 | 000,000,000 | ---D | M] -- C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} < %allusersprofile%\*.* > < > [2006.11.02 14:01:23 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT [2006.11.02 14:01:23 | 000,032,510 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2009.03.27 10:07:03 | 000,000,418 | -H-- | C] () -- C:\Windows\Tasks\User_Feed_Synchronization-{A6581A79-7EC0-4E1F-82C4-B00E007E92B1}.job [2012.03.31 20:02:13 | 000,001,092 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job [2012.03.31 20:02:17 | 000,001,096 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job ========== Files - Unicode (All) ========== [2012.12.21 23:43:05 | 000,000,000 | ---D | M](C:\ProgramData\?U?U0) -- C:\ProgramData\䗈Ǔ䉸Ǔ0 [2012.12.21 23:43:05 | 000,000,000 | ---D | M](C:\ProgramData\?U?U0) -- C:\ProgramData\䗈Ǔ䉸Ǔ0 [2012.12.21 23:43:05 | 000,000,000 | ---D | C](C:\ProgramData\?U?U0) -- C:\ProgramData\䗈Ǔ䉸Ǔ0 [2012.12.21 23:08:44 | 000,000,000 | ---D | M](C:\ProgramData\?k?k0) -- C:\ProgramData\䗈ǩ䉸ǩ0 [2012.12.21 23:08:44 | 000,000,000 | ---D | M](C:\ProgramData\?k?k0) -- C:\ProgramData\䗈ǩ䉸ǩ0 [2012.12.21 23:08:44 | 000,000,000 | ---D | C](C:\ProgramData\?k?k0) -- C:\ProgramData\䗈ǩ䉸ǩ0 [2012.12.21 23:03:08 | 000,000,000 | ---D | M](C:\ProgramData\?ø?ø0) -- C:\ProgramData\䗈ø䉸ø0 [2012.12.21 23:03:08 | 000,000,000 | ---D | M](C:\ProgramData\?ø?ø0) -- C:\ProgramData\䗈ø䉸ø0 [2012.12.21 23:03:08 | 000,000,000 | ---D | C](C:\ProgramData\?ø?ø0) -- C:\ProgramData\䗈ø䉸ø0 [2012.12.21 22:56:06 | 000,000,000 | ---D | M](C:\ProgramData\?G?G0) -- C:\ProgramData\䗈Ǥ䉸Ǥ0 [2012.12.21 22:56:06 | 000,000,000 | ---D | M](C:\ProgramData\?G?G0) -- C:\ProgramData\䗈Ǥ䉸Ǥ0 [2012.12.21 22:56:06 | 000,000,000 | ---D | C](C:\ProgramData\?G?G0) -- C:\ProgramData\䗈Ǥ䉸Ǥ0 [2012.12.21 22:10:20 | 000,000,000 | ---D | M](C:\ProgramData\?e?e0) -- C:\ProgramData\䗈ē䉸ē0 [2012.12.21 22:10:20 | 000,000,000 | ---D | M](C:\ProgramData\?e?e0) -- C:\ProgramData\䗈ē䉸ē0 [2012.12.21 22:10:20 | 000,000,000 | ---D | C](C:\ProgramData\?e?e0) -- C:\ProgramData\䗈ē䉸ē0 [2012.12.21 21:49:28 | 000,000,000 | ---D | M](C:\ProgramData\?þ?þ0) -- C:\ProgramData\䗈þ䉸þ0 [2012.12.21 21:49:28 | 000,000,000 | ---D | M](C:\ProgramData\?þ?þ0) -- C:\ProgramData\䗈þ䉸þ0 [2012.12.21 21:49:28 | 000,000,000 | ---D | C](C:\ProgramData\?þ?þ0) -- C:\ProgramData\䗈þ䉸þ0 [2012.12.21 20:46:02 | 000,000,000 | ---D | M](C:\ProgramData\?¢?¢0) -- C:\ProgramData\䗈¢䉸¢0 [2012.12.21 20:46:02 | 000,000,000 | ---D | M](C:\ProgramData\?¢?¢0) -- C:\ProgramData\䗈¢䉸¢0 [2012.12.21 20:46:02 | 000,000,000 | ---D | C](C:\ProgramData\?¢?¢0) -- C:\ProgramData\䗈¢䉸¢0 [2012.12.21 08:48:24 | 000,000,000 | ---D | M](C:\ProgramData\?x?x0) -- C:\ProgramData\䗈x䉸x0 [2012.12.21 08:48:24 | 000,000,000 | ---D | M](C:\ProgramData\?x?x0) -- C:\ProgramData\䗈x䉸x0 [2012.12.21 08:48:24 | 000,000,000 | ---D | C](C:\ProgramData\?x?x0) -- C:\ProgramData\䗈x䉸x0 [2012.12.21 08:03:09 | 000,000,000 | ---D | M](C:\ProgramData\?ë?ë0) -- C:\ProgramData\䗈ë䉸ë0 [2012.12.21 08:03:09 | 000,000,000 | ---D | M](C:\ProgramData\?ë?ë0) -- C:\ProgramData\䗈ë䉸ë0 [2012.12.21 08:03:09 | 000,000,000 | ---D | C](C:\ProgramData\?ë?ë0) -- C:\ProgramData\䗈ë䉸ë0 [2012.12.21 01:46:03 | 000,000,000 | ---D | M](C:\ProgramData\?H?H0) -- C:\ProgramData\䗈Ĥ䉸Ĥ0 [2012.12.21 01:46:03 | 000,000,000 | ---D | M](C:\ProgramData\?H?H0) -- C:\ProgramData\䗈Ĥ䉸Ĥ0 [2012.12.21 01:46:03 | 000,000,000 | ---D | C](C:\ProgramData\?H?H0) -- C:\ProgramData\䗈Ĥ䉸Ĥ0 [2012.12.20 23:58:04 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䗈Ȉ䉸Ȉ0 [2012.12.20 23:58:04 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䗈Ȉ䉸Ȉ0 [2012.12.20 23:58:04 | 000,000,000 | ---D | C](C:\ProgramData\????0) -- C:\ProgramData\䗈Ȉ䉸Ȉ0 [2012.12.20 23:30:59 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䗈ƴ䉸ƴ0 [2012.12.20 23:30:59 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䗈ƴ䉸ƴ0 [2012.12.20 23:30:59 | 000,000,000 | ---D | C](C:\ProgramData\????0) -- C:\ProgramData\䗈ƴ䉸ƴ0 [2012.12.20 21:23:14 | 000,000,000 | ---D | M](C:\ProgramData\?D?D0) -- C:\ProgramData\䗈D䉸D0 [2012.12.20 21:23:14 | 000,000,000 | ---D | M](C:\ProgramData\?D?D0) -- C:\ProgramData\䗈D䉸D0 [2012.12.20 21:23:14 | 000,000,000 | ---D | C](C:\ProgramData\?D?D0) -- C:\ProgramData\䗈D䉸D0 [2012.12.20 06:57:33 | 000,000,000 | ---D | M](C:\ProgramData\?o?o0) -- C:\ProgramData\䗈ǒ䉸ǒ0 [2012.12.20 06:57:33 | 000,000,000 | ---D | M](C:\ProgramData\?o?o0) -- C:\ProgramData\䗈ǒ䉸ǒ0 [2012.12.20 06:57:33 | 000,000,000 | ---D | C](C:\ProgramData\?o?o0) -- C:\ProgramData\䗈ǒ䉸ǒ0 ========== Alternate Data Streams ========== @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Rote Tasche.JPG:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Reihenklemme.jpg:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Loftahammar.JPG:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Flaschenverschluss.JPG:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Deckstrennstelle.JPG:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Atomkraft-nein-danke.jpg:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\Admin\Documents\Atomkraft-nein-danke [1600x1200].jpg:VsoSummaryInformation @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:5F64C164 < End of report > Code:
ATTFilter OTL Extras logfile created on: 23.12.2012 14:50:20 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Admin\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 0,91 Gb Available Physical Memory | 45,39% Memory free
4,23 Gb Paging File | 3,04 Gb Available in Paging File | 71,85% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 86,31 Gb Total Space | 7,03 Gb Free Space | 8,15% Space Free | Partition Type: NTFS
Drive D: | 100,00 Gb Total Space | 45,71 Gb Free Space | 45,71% Space Free | Partition Type: NTFS
Drive F: | 43,65 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: XXXXXXX | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_USERS\S-1-5-21-934988780-789137344-2609288493-1004\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDSee 14.Manage] -- "C:\Program Files\ACD Systems\ACDSee\14.0\ACDSeeQV14.exe" "%1" (ACD Systems International Inc.)
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Program Files\dm\dm-Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [dm-Fotowelt] -- "C:\Program Files\dm\dm-Fotowelt\dm-Fotowelt.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C76B1AD-F64B-48EE-8B0A-6EFD37954781}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{131C038A-88D3-4944-8D19-A35089E4F792}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{14EF6F75-0C06-42C3-A6B6-B2C5D7F67978}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{2E0672DF-3AC6-4E08-8DC2-3AB22EF901A4}" = rport=2869 | protocol=6 | dir=out | app=system |
"{326D7AAD-F89E-4822-8BA6-2AF2E6C383BB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{40540950-0ADB-46CE-8C4A-E234965FD3E5}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{4F269FAD-60AE-49B6-8154-B3A8C9D4727F}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{5F7A3095-B451-4356-9FE2-0FEE5DA61C39}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{627626FB-30DA-4FEC-9E3B-50480916D874}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{718F0A82-A8AD-4CEA-AB4B-B105293BA5A0}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{7CFACBF0-33DE-4E9B-9649-A7835765BE72}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{8E2F3B87-707D-44C3-AA3F-0F0D109DCB36}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{98A68F34-C3B4-4FD9-819C-EA0CA13A2111}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{A5BF901B-C537-4D0F-88F3-B4BB07319356}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C6192795-E5A9-47A3-B839-26F97B949A0C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D1A48B3D-946B-43CB-BE04-4DF27A87F5DF}" = lport=2869 | protocol=6 | dir=in | app=system |
"{E704DAA4-0CFE-4946-B239-2ACFD394A6FC}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1CA23F8C-98A4-4FB4-A64D-FAE46D92752D}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe |
"{1DD85682-DC32-4A0B-8287-E46ED4D0473C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{26766BE8-2F65-4300-B6C2-DB83A831B910}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{387564E2-BD38-47C3-BD65-5552CFA57A28}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{66A96803-BFAC-4432-B39A-0383162B4612}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe |
"{6861CCA5-BFF3-4F7A-8191-CBFB6584817A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{82627E82-88D4-4797-B9E7-546697779323}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{8BF8D836-8598-4350-B556-B62480E005B4}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe |
"{9D6716E7-E866-4440-8E21-C24978DA1082}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{AF700E13-9819-42DD-86DC-EA6D93BAC3BF}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe |
"{B950ABE6-1615-4296-8549-1D75F59F3835}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe |
"{E1DF5D75-1CD6-4504-A2EF-62C43067EDDF}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{E22C5F4E-EFE8-457D-B6B2-2BA02BAD550A}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe |
"{FE42EA36-99DE-4B51-863D-9AF79B186EE4}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"TCP Query User{2F9CE069-D6E9-4484-A9AC-C5ED0D6FB9CB}C:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe" = protocol=6 | dir=in | app=c:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe |
"TCP Query User{33A43DD4-956F-4BFA-9144-329489DE42F2}C:\windows\system32\ftp.exe" = protocol=6 | dir=in | app=c:\windows\system32\ftp.exe |
"TCP Query User{574EC694-3F75-4C2D-ACC9-27251587B01E}C:\program files\trackmaker\trackmaker.exe" = protocol=6 | dir=in | app=c:\program files\trackmaker\trackmaker.exe |
"TCP Query User{700B38F4-F7DA-42E4-8C61-5BF53133774A}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{9009642B-94E7-4CE4-9275-4A4AD1392A15}C:\program files\java\jre1.6.0\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0\bin\java.exe |
"TCP Query User{C265AF90-5A3C-4DE3-8565-D6DC72A052B4}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{C3F511ED-226B-4BF8-8F0D-7662FBB81219}C:\program files\spybot - search & destroy 2\sdupdate.exe" = protocol=6 | dir=in | app=c:\program files\spybot - search & destroy 2\sdupdate.exe |
"TCP Query User{CDBA811F-EFC9-4013-ABCC-A6694911240C}C:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe" = protocol=6 | dir=in | app=c:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe |
"UDP Query User{57955B5F-D901-4FD6-B3FC-C13E57A5C93F}C:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe" = protocol=17 | dir=in | app=c:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe |
"UDP Query User{6824E8A8-3B46-4848-AE25-C30FA207D8A3}C:\program files\trackmaker\trackmaker.exe" = protocol=17 | dir=in | app=c:\program files\trackmaker\trackmaker.exe |
"UDP Query User{7D17D5E7-063D-44AE-81D0-0AA12117FAC6}C:\program files\spybot - search & destroy 2\sdupdate.exe" = protocol=17 | dir=in | app=c:\program files\spybot - search & destroy 2\sdupdate.exe |
"UDP Query User{8D7BEF79-7D48-4734-8CE5-780A84DFF041}C:\program files\java\jre1.6.0\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0\bin\java.exe |
"UDP Query User{8F7B5C06-33B3-4AC4-917F-DC12FB601C6F}C:\windows\system32\ftp.exe" = protocol=17 | dir=in | app=c:\windows\system32\ftp.exe |
"UDP Query User{9C6E22AD-E2DF-449A-B25A-0589E48EDE26}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{DF8D8676-4222-4C81-8195-D8183C1D5B33}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{E871705B-008A-45A3-946A-78229ED7427D}C:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe" = protocol=17 | dir=in | app=c:\users\admin\downloads\jperf-2.0.0\bin\iperf.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"@icon sushi_is1" = @icon sushi 1.21
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{009E7FB7-1775-4D89-8956-F5C9A1C019FC}" = DSD Playback Plug-in
"{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}" = Sony Video Shared Library
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (VAIO_VEDB)
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent
"{0AF342A7-A435-4980-940A-9DA4AD48E399}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{0F6F6876-6334-4977-B5DD-CFC12E193420}" = iTunes
"{10113A44-CBFF-4FF7-8A13-BD1EC4180C56}" = Protector Suite QL 5.6
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP100_series" = Canon iP100 series
"{1417F599-1DBD-4499-9375-B2813E9F890C}" = VAIO Camera Utility
"{17C7703E-0B2A-4593-9CB7-E2FE14B6F8EA}" = Sony Snymsico for Vista
"{1B8FE958-A304-4902-BF7A-4E2F0F5B7017}_is1" = GPSBabel 1.4.3
"{1FEE9698-33D4-4633-B7BA-7368C87E49AA}" = GPS TrackMaker
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"{2063C2E8-3812-4BBD-9998-6610F80C1DD4}" = VAIO Media AC3 Decoder 1.0
"{220DD62A-F30A-4279-8A4B-2B7F9777593B}" = Garmin BaseCamp
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23C08587-19F4-4BBC-9078-26CF8EB02256}" = PL-2303 Vista Driver Installer-ATEN
"{2457326B-C110-40C3-89B0-889CC913871A}" = AVM FRITZ!DSL
"{24960AC2-C413-4A86-B1C1-E4CCADCA44D3}" = VAIO Information FLOW
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{2A0F3EF9-68EE-49E9-A05B-ED5B82DF63E5}" = Wireless Switch Setting Utility
"{2A2FF7F5-6F0E-4A5D-A881-39365E718BD6}" = VAIO Cozy Orange Wallpaper
"{37FD2F04-EC91-41AE-B5AB-AFF904BF20EE}" = Mobile Broadband Drivers
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1" = VSO Image Resizer 3.0.1.76
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{500162A0-4DD5-460A-BAFD-895AAE48C532}" = VAIO Media Content Collection 6.0
"{500C3FDC-5E5F-485F-BDF5-2C445839CBE0}" =
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{5090D628-C12F-4EB0-830D-819EFD52D950}" = JVComm32
"{537575D6-3B96-474C-BD8F-DFF667363DBD}" = Naviextras Toolbox Prerequesities
"{55B781F0-060E-11D4-99D7-00C04FCCB775}" =
"{560F6B2E-F0DF-44E5-8190-A4A161F0E205}" = VAIO Media 6.0
"{569B6909-302A-4661-8EBC-9E8647A7E71A}" = SolidConverterDWG
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{5855C127-1F20-404D-B7FB-1FD84D7EAB5E}" = VAIO Media Redistribution 6.0
"{59452470-A902-477F-9338-9B88101681BD}" = Setting Utility Series
"{5958CAC6-373E-402F-84FE-0A699AA920B9}" = LAN Setting Utility
"{5E343EF6-D27C-4CFC-9FAE-9AAFB541BCEE}" = VAIO Photo 2007
"{6332AFF1-9D9A-429C-AA03-F82749FA4F49}" = SonicStage Mastering Studio
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{664BCF28-C038-4F06-8BF4-A0F2D24C44EE}" = MapSource - Atlantic BlueChart v4.00
"{685BCC47-B8EC-45EC-BBCE-77DF2451502C}" = DVgate Plus
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B1F20F2-6321-4669-A58C-33DF8E7517FF}" = VAIO Entertainment Platform
"{6D2576EC-A0E9-418A-A09A-409933A3B6F4}" = VAIO Camera Capture Utility
"{6F5A71BD-9EC9-4A59-BFBD-CA63CFB4885D}" = ACDSee 14
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{785EB1D4-ECEC-4195-99B4-73C47E187721}" = VAIO Media Integrated Server 6.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{82D5BACA-3619-4D34-99DB-3A65CFB4DA33}" = DSD Direct
"{83CDA18E-0BF3-4ACA-872C-B4CDABF2360E}" = VAIO Update 4
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{934A3213-1CB6-4264-84A2-EE080C017BCA}" = VAIO Tender Green Wallpaper
"{97260AE9-A1EE-492E-8DCC-FD0AFF785720}" =
"{97BCD719-6ECB-458F-97D6-F38D2E07375E}" = VAIO Aqua Breeze Wallpaper
"{98D451C4-4ACA-4273-BB47-57CFE46B048E}" = WD SmartWare
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C1C8A04-F8CA-4472-A92D-4288CE32DE86}" = SonicStage Mastering Studio Plug-Ins
"{9E319E96-ED8E-4B01-9775-C521A1869A25}" = VAIO Power Management
"{9E407618-D9CD-4F39-9490-9ED45294073D}" = Click to DVD 2.0.05 Menu Data
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO
"{A0EB195B-5876-48E6-879D-33D4B2102610}" = SonicStage 4.3
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{A947C2B3-7445-42C4-9063-EE704CACCB22}" = VAIO Hardware Diagnostics
"{AA721D14-CFE2-410E-B975-79FE5F82F99F}" = MSVCMergeModules
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AC76BA86-7AD7-5760-0000-800000000003}" = Japanese Fonts Support For Adobe Reader 8
"{AF9A04EB-7D8E-41DE-9EDE-4AB9BB2B71B6}" = VAIO Media Registration Tool 6.0
"{AFAC914D-9E83-4A89-8ABE-427521C82CCF}" = Safari
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B5829416-1236-47AE-AAED-B2B3F9503FF7}" = Crystal Report Modules
"{B7FB0C86-41A4-4402-9A33-912C462042A0}" = Roxio Easy Media Creator Home
"{BBFFB027-7D53-4E1B-95BC-35A2216D1D60}" = VAIO Long Battery Life Wallpaper
"{C183A21C-395A-490F-99D4-CCAB35E32859}" =
"{C50F5635-A47F-4889-9303-8FA5D337F9D0}" = Garmin BlueChart Atlantic 2008.5
"{C518C7BF-A345-4019-815B-FFDF32EBCAD9}" = VAIO HDD Protection
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{D6F26C8C-FE5A-4F05-B897-35DCA97F4861}" = Winlog.basic
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DF7DB916-90E5-40F2-9010-B8125EB5FD6F}" = SonicStage Mastering Studio Audio Filter
"{E2B38044-AEF2-40AF-BDD8-FEDE799A8633}" =
"{E809063C-51A3-4269-8984-D1EB742F2151}" = Click to DVD 2.6.00
"{EC37A846-53AC-4DA7-98FA-76A4E74AA900}" = Benutzerdefinierte Voreinstellungen für SonicStage Mastering Studio Audio Filter
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{EF3D45BB-2260-4008-88EA-492E7744A9DF}" = Sony Utilities DLL
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0D85ADD-DD61-4B43-87A0-6DA52A211A8B}" = VAIO Event Service
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F570A6CC-53ED-4AA9-8B08-551CD3E38D8B}" =
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone-Konfigurationsprogramm
"{FC37C108-821D-4EDE-8F40-D5B497586805}" = VAIO Control Center
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"09B0389E270BD7AF25027552C702E5A1710355BA" = Windows Driver Package - ebro Electronic GmbH & Co. KG (ebro_ser2pl) Ports (07/07/2010 3.3.11.165)
"47D9E29CE022498902361431291130558B1BC810" = Windows Driver Package - ebro Electronic GmbH & Co. KG ebro USB Driver (03/24/2010 2.73.00)
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"53A88972B866B64F80E2A1A53DAB131532A5CD54" = Windows Driver Package - ebro Electronic GmbH & Co. KG ebro USB Driver (03/24/2010 2.73.00)
"6F18EE7CAB5FC8A721C71764B9A575B728CEE697" = Windows Driver Package - ebro Electronic GmbH & Co. KG ebro USB Driver (03/24/2010 2.73.00)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Admiralty Digital Catalogue 1.6" = Admiralty Digital Catalogue 1.6
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe FrameMaker 7.0" = Adobe FrameMaker v7.0
"Any DWG DXF Converter_is1" = Any DWG DXF Converter 2010
"Audacity_is1" = Audacity 2.0
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"Becker Content Manager" = Becker Content Manager
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"Canon iP100 series Benutzerregistrierung" = Canon iP100 series Benutzerregistrierung
"Canon Setup Utility 2.4" = Canon Setup Utility 2.4
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_104D0200" = HDAUDIO SoftV92 Data Fax Modem with SmartCP
"Content Manager 2" = Content Manager 2
"Corse-Topo_is1" = Corse-Topo für MapSource
"dm-Fotowelt" = dm-Fotowelt
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Gartrip_is1" = Gartrip 210e
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"GPL Ghostscript 9.05" = GPL Ghostscript
"GSview 5.0" = GSview 5.0
"Hauppauge WinTV 7" = Hauppauge WinTV 7
"Hauppauge WinTV Infrared Remote" = Hauppauge WinTV Infrared Remote
"Hauppauge WinTV2000" = Hauppauge WinTV2000
"Hauppauge WinTV-PVR USB Drivers" = Hauppauge WinTV-PVR USB Drivers
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"High Resolution World Data" = High Resolution World Data
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"Island-Topo_is1" = Island-Topo für MapSource
"korsika1_is1" = Topo Korsika 0.1.0.7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"OpenMG HotFix4.7-07-13-22-01" = OpenMG Limited Patch 4.7-07-14-05-01
"OSM Roadmap Norway" = OSM Roadmap Norway
"OSM SKJ Roadmap Norway" = OSM SKJ Roadmap Norway
"OSM SKJ Topo Summer Norway" = OSM SKJ Topo Summer Norway
"OSM Topo Summer Norway" = OSM Topo Summer Norway
"PDF-XChange 3_is1" = PDF-XChange 3
"Personal" = Personal 4.18.3
"POI FINDER (Becker)_is1" = POI FINDER 3.73 (Becker)
"PROHYBRIDR" = 2007 Microsoft Office system
"QCAD Professional" = QCAD Professional 2.2.2.1
"SeaTTY_is1" = SeaTTY V2.30
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"TAD Designer Lite_is1" = TAD Designer Lite 5.7
"Telia mobile broadband" = Telia mobile broadband
"T-Mobile Internet Manager" = T-Mobile Internet Manager
"VLC media player" = VLC media player 1.1.11
"WIB2_is1" = WIB2 1.0.15
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 22.12.2012 15:39:17 | Computer Name = XXXXXXX | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16457, Zeitstempel
0x50a2f9e3, fehlerhaftes Modul gdiplus.dll_unloaded, Version 0.0.0.0, Zeitstempel
0x4f2bf90a, Ausnahmecode 0xc0000005, Fehleroffset 0x74c974b2, Prozess-ID 0x674,
Anwendungsstartzeit 01cde0775f22a508.
Error - 22.12.2012 16:16:30 | Computer Name = XXXXXXX | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 964 Anfangszeit: 01cde080aa193f3c Zeitpunkt der Beendigung:
15
Error - 22.12.2012 16:27:00 | Computer Name = XXXXXXX | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 1268 Anfangszeit: 01cde081d25e3f8c Zeitpunkt der Beendigung:
78
Error - 22.12.2012 16:27:52 | Computer Name = XXXXXXX | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: a78 Anfangszeit: 01cde082bfaa1cac Zeitpunkt der Beendigung:
16
Error - 23.12.2012 07:24:18 | Computer Name = XXXXXXX | Source = VzCdbSvc | ID = 7
Description = Das Plug-In-Modul konnte nicht geladen werden. (GUID = {F508055A-CDBF-4D4D-BC8F-4D8E0D9B9E81})
(Fehlercode = 0x80004005)
Error - 23.12.2012 07:51:37 | Computer Name = XXXXXXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 23.12.2012 07:51:37 | Computer Name = XXXXXXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 19328
Error - 23.12.2012 07:51:37 | Computer Name = XXXXXXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 19328
Error - 23.12.2012 08:21:16 | Computer Name = XXXXXXX | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16457, Zeitstempel
0x50a2f9e3, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5,
Ausnahmecode 0xc0000374, Fehleroffset 0x000b06b7, Prozess-ID 0x151c, Anwendungsstartzeit
01cde106c4f14cf0.
Error - 23.12.2012 08:32:19 | Computer Name = XXXXXXX | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung PEV.exe, Version 0.0.0.0, Zeitstempel 0x4e06cfe8,
fehlerhaftes Modul PEV.exe, Version 0.0.0.0, Zeitstempel 0x4e06cfe8, Ausnahmecode
0x40000015, Fehleroffset 0x0008d1c0, Prozess-ID 0x4fc, Anwendungsstartzeit 01cde1098c8499a0.
[ OSession Events ]
Error - 10.02.2011 06:27:09 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5
seconds with 0 seconds of active time. This session ended with a crash.
Error - 04.04.2011 09:42:37 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 28
seconds with 0 seconds of active time. This session ended with a crash.
Error - 26.04.2011 14:41:17 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6550.5004, Microsoft Office Version: 12.0.6425.1000. This session lasted 7
seconds with 0 seconds of active time. This session ended with a crash.
Error - 26.05.2011 08:51:24 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 22321
seconds with 1980 seconds of active time. This session ended with a crash.
Error - 03.06.2011 14:57:03 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6550.5004, Microsoft Office Version: 12.0.6425.1000. This session lasted 17
seconds with 0 seconds of active time. This session ended with a crash.
Error - 13.12.2011 20:19:19 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6
seconds with 0 seconds of active time. This session ended with a crash.
Error - 22.12.2011 18:08:51 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6654.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 4
seconds with 0 seconds of active time. This session ended with a crash.
Error - 22.12.2011 18:29:49 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6654.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.
Error - 30.01.2012 05:09:52 | Computer Name = XXXXXXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 1200
seconds with 300 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 23.12.2012 08:42:30 | Computer Name = XXXXXXX | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
Error - 23.12.2012 08:52:18 | Computer Name = XXXXXXX | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
Error - 23.12.2012 08:52:24 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7000
Description =
Error - 23.12.2012 08:53:29 | Computer Name = XXXXXXX | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
Error - 23.12.2012 09:00:02 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7031
Description =
Error - 23.12.2012 09:00:23 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7034
Description =
Error - 23.12.2012 09:02:54 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7030
Description =
Error - 23.12.2012 09:10:06 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7030
Description =
Error - 23.12.2012 09:15:47 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7030
Description =
Error - 23.12.2012 09:17:29 | Computer Name = XXXXXXX | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
< End of report >
|
|
| Themen zu Claro Search auf Windows Vista entfernen |
| anzahl, eingefangen, entferne, entfernen, frage, fragen, gefundenen, gen, installieren, konnte, laptop, modus, neu, platt, search, software, system, unterwegs, verschiedene, vista, windows, windows vista, woche, würde |
Textbox.
Linear-Darstellung
