![]() |
|
Plagegeister aller Art und deren Bekämpfung: GVU Trojaner (Exploit.drop.gsa)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #1 |
![]() | ![]() GVU Trojaner (Exploit.drop.gsa) Hallo liebes Trojaner-Board-Team, vor zwei bis drei Wochen bekam ich zum ersten mal bei Thunderbird folgende Fehlermeldung beim Versenden von Mails: Fehler beim Senden der Nachricht: Der Mail-Server antwortete: Dynamic IP Addresses See: hxxp://www.sorbs.net/lookup.shtml?217.84.114.46. Bitte überprüfen Sie die E-Mail-Adresse info@*** und wiederholen Sie den Vorgang. Anfangs hat es noch funktioniert, den Router neu zu starten und mit der neuen IP-Adresse konnte ich dann für eine gewisse Zeit Mails versenden. Inzwischen geht das auch nicht mehr. Allerdings bin ich mir nicht sicher, ob das überhaupt mit o.g. Trojaner zu tun hat (wollte es aber der Vollständigkeit halber erwähnt haben). Vorgestern tat sich plötzlich am Laptop nichts mehr, es war nur der Desktop zu sehen, keine Windowsleiste, keine Verknüfpungen und ich hab schon Böses geahnt. Eine halbe Minute später ging dann ein Sperrbildschirm auf mit dem Bild meiner Webcam. Ich konnte oben rechts noch "Telekom" und eine IP-Adresse erkennen, da war der Spuk schon wieder vorbei. Da wir schonmal den Bundestrojaner hatten (anderer Laptop, System neu aufgesetzt), war ich natürlich alamiert und habe erstmal mit Avast gescannt. Ergebnis: ein Fund in einer recht alten Datei MID:CVE-2012-0003 Danach habe ich einen Bootscan ausgeführt und zwei weitere Funde gehabt: VodafoneDE_MMS.jpeg.exe - Bedrohung:Win32:URAUSY ebayshortcuts.exe - Bedrohung: Win32:YABECTOR Gestern ging dann plötzlich die Webcam an und ich konnte den Task-Manager nicht mehr starten, bzw. er hat sich sofort wieder von selbst geschlossen. Daraufhin hab ich Malewarebytes drüber laufen lassen, hier die LOG-Daten Code:
ATTFilter Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.12.24.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Kerstin :: LAPPI [limited] 25.12.2012 15:00:01 mbam-log-2012-12-25 (15-00-01).txt Scan type: Full scan (C:\|D:\|E:\|F:\|K:\|L:\|S:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 465378 Time elapsed: 1 hour(s), 28 minute(s), 33 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 1 C:\Users\Kerstin\wgsdgsdgdsgsd.dll (Exploit.Drop.GS) -> Delete on reboot. Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully. Folders Detected: 0 (No malicious items detected) Files Detected: 3 C:\Users\Kerstin\wgsdgsdgdsgsd.dll (Exploit.Drop.GS) -> Delete on reboot. C:\ProgramData\dsgsdgdsgdsgw.pad (Exploit.Drop.GSA) -> Quarantined and deleted successfully. C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk (Trojan.Ransom.SUGen) -> Quarantined and deleted successfully. (end) Später nochmal Malewarebytes drüber mit folgendem LOG Code:
ATTFilter Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.12.24.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Kerstin :: LAPPI [limited] 25.12.2012 20:26:46 mbam-log-2012-12-25 (20-26-46).txt Scan type: Full scan (C:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 306955 Time elapsed: 46 minute(s), 19 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\ProgramData\dsgsdgdsgdsgw.pad (Exploit.Drop.GSA) -> Quarantined and deleted successfully. (end) Mails verschicken geht nach wie vor nicht (hängt das überhaupt damit zusammen ?!?!?). Trotzdem glaub ich nicht wirklich, dass das System sauber ist, deshalb der (sehr lange) Post hier :-). Nun noch die OTL-Dateien Code:
ATTFilter OTL logfile created on: 26.12.2012 07:26:03 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Kerstin\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,91 Gb Available Physical Memory | 63,73% Memory free 5,99 Gb Paging File | 4,74 Gb Available in Paging File | 79,07% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 123,60 Gb Total Space | 74,71 Gb Free Space | 60,44% Space Free | Partition Type: NTFS Drive D: | 9,77 Gb Total Space | 0,43 Gb Free Space | 4,43% Space Free | Partition Type: NTFS Drive E: | 10,00 Gb Total Space | 5,75 Gb Free Space | 57,51% Space Free | Partition Type: NTFS Drive F: | 99,17 Gb Total Space | 49,92 Gb Free Space | 50,34% Space Free | Partition Type: NTFS Drive K: | 162,57 Gb Total Space | 19,73 Gb Free Space | 12,14% Space Free | Partition Type: NTFS Drive L: | 9,76 Gb Total Space | 2,72 Gb Free Space | 27,84% Space Free | Partition Type: NTFS Drive S: | 50,78 Gb Total Space | 33,85 Gb Free Space | 66,65% Space Free | Partition Type: NTFS Computer Name: LAPPI | User Name: Admin | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.12.25 22:26:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kerstin\Desktop\OTL.exe PRC - [2012.11.16 06:23:09 | 000,255,992 | ---- | M] (Microsoft Corporation) -- C:\Users\Kerstin\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe PRC - [2012.10.30 23:50:59 | 004,297,136 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe PRC - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe PRC - [2012.08.22 11:01:22 | 000,841,824 | ---- | M] (Jumping Bytes) -- C:\Program Files (x86)\PureSync\PureSyncTray.exe PRC - [2012.07.30 13:50:42 | 000,603,648 | ---- | M] (PC Remote) -- C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.05.15 11:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.05.15 01:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2007.05.09 16:01:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM02Mon.exe PRC - [2006.11.02 19:40:12 | 000,174,656 | ---- | M] () -- C:\Windows\SysWOW64\PSIService.exe PRC - [2006.03.21 12:19:40 | 000,069,632 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpWareSE4.exe ========== Modules (No Company Name) ========== MOD - [2012.11.30 15:38:26 | 002,297,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\239d84cfdb9de9730c1efb43840ef2eb\System.Core.ni.dll MOD - [2012.11.30 15:37:41 | 000,220,672 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\c07aa49ffd41a39bffaf653289f44038\CustomMarshalers.ni.dll MOD - [2012.11.30 15:24:48 | 001,806,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\f2fb3f4856c403795db6db3f354f1f0b\System.Deployment.ni.dll MOD - [2012.11.30 15:24:46 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll MOD - [2012.11.30 15:24:25 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll MOD - [2012.11.30 15:24:07 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll MOD - [2012.11.30 15:24:03 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll MOD - [2012.11.30 15:24:01 | 007,988,736 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll MOD - [2012.11.30 15:23:55 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll MOD - [2010.11.05 02:57:39 | 000,069,120 | ---- | M] () -- C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll MOD - [2009.07.14 18:58:17 | 000,397,312 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Deployment.resources\2.0.0.0_de_b03f5f7f11d50a3a\System.Deployment.resources.dll ========== Services (SafeList) ========== SRV - [2012.12.11 18:37:20 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus) SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.05.15 11:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.05.15 01:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2011.08.05 11:53:12 | 000,467,680 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Zune\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc) SRV - [2011.08.05 11:53:12 | 000,306,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Zune\WMZuneComm.exe -- (WMZuneComm) SRV - [2011.08.05 11:53:06 | 008,277,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Zune\ZuneNss.exe -- (ZuneNetworkSvc) SRV - [2011.03.28 20:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.09.22 17:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008.01.28 11:23:14 | 000,143,360 | ---- | M] (Cybit AG) [verify-U]) [verify-U]-Service [Auto | Stopped] -- C:\Program Files (x86)\[verify-U] AVS\[verify-U]-Service.exe -- ([verify-U]) SRV - [2006.11.02 19:40:12 | 000,174,656 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PSIService.exe -- (ProtexisLicensing) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.10.30 23:51:56 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi) DRV:64bit: - [2012.10.30 23:51:55 | 000,984,144 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx) DRV:64bit: - [2012.10.30 23:51:55 | 000,370,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP) DRV:64bit: - [2012.10.30 23:51:55 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt) DRV:64bit: - [2012.10.30 23:51:53 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk) DRV:64bit: - [2012.10.15 17:59:28 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr) DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92) DRV:64bit: - [2009.06.10 22:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac) DRV:64bit: - [2009.06.10 22:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA) DRV:64bit: - [2009.06.10 21:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) DRV:64bit: - [2009.06.10 21:34:35 | 000,087,552 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b44amd64.sys -- (bcm44amd64) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2007.10.10 16:03:00 | 000,266,624 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OEM02Dev.sys -- (OEM02Dev) DRV:64bit: - [2007.07.27 18:45:52 | 000,057,856 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp) DRV:64bit: - [2007.07.26 19:33:54 | 000,055,296 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk) DRV:64bit: - [2007.03.19 11:09:36 | 000,055,808 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk) DRV:64bit: - [2007.03.05 09:55:48 | 000,012,288 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OEM02Vfx.sys -- (OEM02Vfx) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2007.11.07 15:21:18 | 000,016,128 | ---- | M] (Cybits AG) [verify-U]_System) [verify-U]_System [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\[verify-U]-driver.sys -- ([verify-U]_System) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E2 73 54 D2 66 75 CD 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689 IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searc} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.defaulturl: "hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=971163" FF - prefs.js..browser.search.selectedEngine: "Amazon.de" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.facebook.de" FF - prefs.js..extensions.charles.settings.disabled.network.proxy.http: "10.10.10.1" FF - prefs.js..extensions.charles.settings.disabled.network.proxy.http_port: 8080 FF - prefs.js..extensions.charles.settings.disabled.network.proxy.no_proxies_on: "localhost, 127.0.0.1" FF - prefs.js..extensions.charles.settings.disabled.network.proxy.share_proxy_settings: false FF - prefs.js..extensions.charles.settings.disabled.network.proxy.socks: "" FF - prefs.js..extensions.charles.settings.disabled.network.proxy.socks_port: 0 FF - prefs.js..extensions.charles.settings.disabled.network.proxy.ssl: "" FF - prefs.js..extensions.charles.settings.disabled.network.proxy.ssl_port: 0 FF - prefs.js..extensions.charles.settings.disabled.network.proxy.type: 4 FF - prefs.js..extensions.charles.settings.enabled.network.proxy.http: "127.0.0.1" FF - prefs.js..extensions.charles.settings.enabled.network.proxy.http_port: 8888 FF - prefs.js..extensions.charles.settings.enabled.network.proxy.no_proxies_on: "" FF - prefs.js..extensions.charles.settings.enabled.network.proxy.share_proxy_settings: false FF - prefs.js..extensions.charles.settings.enabled.network.proxy.socks: "" FF - prefs.js..extensions.charles.settings.enabled.network.proxy.socks_port: 0 FF - prefs.js..extensions.charles.settings.enabled.network.proxy.ssl: "127.0.0.1" FF - prefs.js..extensions.charles.settings.enabled.network.proxy.ssl_port: 8888 FF - prefs.js..extensions.charles.settings.enabled.network.proxy.type: 1 FF - prefs.js..extensions.enabledAddons: faviconizetab@espion.just-size.jp:1.0.6 FF - prefs.js..extensions.enabledAddons: optout@google.com:1.5 FF - prefs.js..extensions.enabledAddons: socialfixer@mattkruse.com:6.301 FF - prefs.js..extensions.enabledAddons: toolbar-ff@payback.de:1.1.9.99 FF - prefs.js..extensions.enabledAddons: {3e9a3920-1b27-11da-8cd6-0800200c9a66}:3.6.4 FF - prefs.js..extensions.enabledAddons: betterfacebook@mattkruse.com:6.603 FF - prefs.js..extensions.enabledAddons: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.17 FF - prefs.js..extensions.enabledAddons: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.4.7 FF - prefs.js..extensions.enabledAddons: brief@mozdev.org:1.6.1 FF - prefs.js..extensions.enabledAddons: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:12.6 FF - prefs.js..extensions.enabledAddons: ns@gutscheine4you.com:1.1 FF - prefs.js..extensions.enabledAddons: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9 FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.9 FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.20 FF - prefs.js..extensions.enabledAddons: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.10 FF - prefs.js..extensions.enabledAddons: wrc@avast.com:7.0.1456 FF - prefs.js..extensions.enabledAddons: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.5rc2 FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.4.4.118 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6 FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.13 FF - prefs.js..extensions.enabledItems: brief@mozdev.org:1.5.4 FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5 FF - prefs.js..extensions.enabledItems: optout@google.com:1.2 FF - prefs.js..extensions.enabledItems: {b8cbd8e0-e642-11dd-ba2f-0800200c9a66}:1.6 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6 FF - prefs.js..extensions.enabledItems: faviconizetab@espion.just-size.jp:1.0.1 FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.9.3 FF - prefs.js..extensions.enabledItems: {84b24861-62f6-364b-eba5-2e5e2061d7e6}:0.9.3 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.07100121 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.1.0.3 FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9 FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1 FF - prefs.js..extensions.enabledItems: ietab@ip.cn:1.98.20110322 FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.2.26 FF - prefs.js..extensions.enabledItems: toolbar-ff@payback.de:1.1.1.88 FF - prefs.js..extensions.enabledItems: ns@gutscheine4you.com:1.1 FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.91 FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10395&locale=de_DE&apn_uid=dd7ca73f-ff2a-4481-bfa9-eb1cc092174f&apn_ptnrs=%5EABT&apn_sauid=92EF3618-CC66-44C8-A53A-157DF3D04F44&apn_dtid=%5EYYYYYY%5EYY%5EDE&&q=" FF - prefs.js..network.proxy.http: "10.10.10.1" FF - prefs.js..network.proxy.http_port: 8080 FF - prefs.js..network.proxy.type: 4 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll () FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.11.08 06:26:46 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Internet\Mozilla Firefox\components [2012.11.06 09:50:17 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Internet\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0\extensions\\Components: C:\Program Files (x86)\Internet\Mozilla Thunderbird\components [2012.07.23 20:04:35 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0\extensions\\Plugins: C:\Program Files (x86)\Internet\Mozilla Thunderbird\plugins [2012.07.23 17:58:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions [2012.08.09 16:28:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions [2012.07.23 19:40:32 | 000,000,000 | ---D | M] (Azerty I) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\{0441798B-805D-4f2d-9321-F3FCC8171127} [2012.07.23 19:40:32 | 000,000,000 | ---D | M] (Azerty III) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\{04CA07AB-7FC3-4110-A83F-EF1E6B75D5B0} [2012.07.23 19:40:32 | 000,000,000 | ---D | M] (Vista-aero) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb} [2012.07.23 19:40:33 | 000,000,000 | ---D | M] (PDF Download) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250} [2012.07.23 19:40:33 | 000,000,000 | ---D | M] (Zynga Community Toolbar) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822} [2012.07.23 19:40:33 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.07.23 19:40:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012.07.23 19:40:33 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12} [2012.07.23 19:40:34 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2012.07.23 19:40:31 | 000,000,000 | ---D | M] (Bcool) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\4fc906cce8e99@4fc906cce8ed2.info [2012.07.23 19:40:31 | 000,000,000 | ---D | M] (IE Tab Plus) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\ietab@ip.cn [2012.07.23 19:40:31 | 000,000,000 | ---D | M] (Gutscheine4you.com) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\ns@gutscheine4you.com [2012.07.23 19:40:31 | 000,000,000 | ---D | M] (Andasa iCat) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\plugin@andasa.de [2012.08.09 16:28:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\staged [2012.07.23 19:40:32 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\toolbar@ask.com [2012.07.23 19:40:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\y8rsm8mg.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions [2012.06.02 19:39:35 | 000,138,110 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\betterfacebook@mattkruse.com.xpi [2012.07.21 12:15:26 | 000,242,784 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\brief@mozdev.org.xpi [2011.08.31 19:39:04 | 000,010,259 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\faviconizetab@espion.just-size.jp.xpi [2011.07.28 08:36:41 | 000,008,363 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\optout@google.com.xpi [2012.01.29 08:52:46 | 000,128,128 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\socialfixer@mattkruse.com.xpi [2012.03.14 20:15:30 | 000,128,837 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\toolbar-ff@payback.de.xpi [2012.07.21 12:15:26 | 000,084,548 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}.xpi [2012.07.17 13:27:55 | 000,457,304 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi [2012.07.18 18:19:05 | 000,339,888 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2012.03.14 20:15:30 | 000,009,524 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\{3e9a3920-1b27-11da-8cd6-0800200c9a66}.xpi [2012.07.26 12:52:33 | 000,525,941 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012.07.26 12:41:56 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2008.03.30 17:05:38 | 000,940,845 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\{0441798B-805D-4f2d-9321-F3FCC8171127}\chrome\tmp.xpi [2009.08.01 10:27:26 | 000,726,223 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\{04CA07AB-7FC3-4110-A83F-EF1E6B75D5B0}\chrome\tmp.xpi [2008.03.20 13:43:48 | 000,001,502 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\xpinstall\xpinstallConfirm.css [2008.03.26 12:50:46 | 000,001,362 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\xpinstall\xpinstallItemGeneric.png [2012.08.09 16:28:55 | 000,242,942 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\staged\brief@mozdev.org.xpi [2012.08.09 16:28:58 | 000,526,260 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\extensions\staged\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2008.03.30 09:08:14 | 000,002,520 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\searchplugins\mozilla-add-ons.xml [2012.06.01 19:25:44 | 000,002,203 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\searchplugins\MyStart Search.xml [2009.09.01 21:09:42 | 000,001,196 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\searchplugins\winamp-search.xml [2009.02.22 21:52:05 | 000,002,109 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\y8rsm8mg.default\searchplugins\youtube-videosuche.xml [2012.11.08 06:26:46 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files (x86)\Canon\Easy-WebPrint\EWPBrowseLoader.dll () O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files (x86)\Canon\Easy-WebPrint\Toolband.dll () O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O4:64bit: - HKLM..\Run: [Zune Launcher] C:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation) O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [OpwareSE4] C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.) O4 - HKCU..\Run: [PC Remote Server] C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe (PC Remote) O4 - HKLM..\RunOnce: [aswAhAScr.dll] C:\Program Files\AVAST Software\Avast\aswRegSvr.exe (AVAST Software) O4 - HKLM..\RunOnce: [aswasOutExt.dll] C:\Program Files\AVAST Software\Avast\aswRegSvr.exe (AVAST Software) O4 - HKLM..\RunOnce: [aswasOutExt64.dll] C:\Program Files\AVAST Software\Avast\aswRegSvr64.exe (AVAST Software) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKCU..\RunOnce: [RunCanonMsetUp] C:\Users\Admin\AppData\Local\Temp\MasterReboot\CANON_IJ\MCDCheck.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found O8:64bit: - Extra context menu item: Easy-WebPrint - Drucken - C:\Program Files (x86)\Canon\Easy-WebPrint\Toolband.dll () O8:64bit: - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Program Files (x86)\Canon\Easy-WebPrint\Toolband.dll () O8:64bit: - Extra context menu item: Easy-WebPrint - Vorschau - C:\Program Files (x86)\Canon\Easy-WebPrint\Toolband.dll () O8:64bit: - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Program Files (x86)\Canon\Easy-WebPrint\Toolband.dll () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Program Files (x86)\Canon\Easy-WebPrint\Toolband.dll () O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Program Files (x86)\Canon\Easy-WebPrint\Toolband.dll () O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Program Files (x86)\Canon\Easy-WebPrint\Toolband.dll () O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Program Files (x86)\Canon\Easy-WebPrint\Toolband.dll () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{653886E8-E125-4788-BF58-5DAD9846AC5D}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9F14BD10-0391-4400-9567-CFA40416C564}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.12.25 15:04:10 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\WinRAR [2012.12.25 15:04:10 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR [2012.12.25 15:04:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR [2012.12.25 15:04:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinRAR [2012.12.24 21:02:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\[verify-U] AVS [2012.12.24 21:02:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\[verify-U] AVS [2012.12.24 07:17:08 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes [2012.12.24 07:16:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.12.24 07:16:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.12.24 07:16:40 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.12.24 07:16:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.11.29 12:49:55 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lugert Verlag [2012.11.29 12:49:18 | 000,856,064 | ---- | C] (Essien Research & Development) -- C:\Windows\SysWow64\mpgfiltr.ax [2012.11.29 12:49:18 | 000,155,648 | ---- | C] (Viscom Software www.viscomsoft.com) -- C:\Windows\SysWow64\viscomwaveform.dll [2012.11.29 12:49:18 | 000,155,648 | ---- | C] (Viscom Software www.viscomsoft.com) -- C:\Windows\SysWow64\AudioCapture.ocx [2012.11.29 12:49:18 | 000,081,920 | ---- | C] (Viscom Software) -- C:\Windows\SysWow64\viscomwave.dll [2012.11.29 12:49:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lugert Verlag [2012.11.29 11:28:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2012.11.29 11:28:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2012.11.29 11:27:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2012.11.29 11:23:05 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\7-PDFSplitMerge [2012.11.29 11:23:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-PDF [2012.11.29 11:23:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-PDF [2012.11.29 11:21:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Phone [2012.11.29 11:21:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Phone [2012.11.29 11:07:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Applications ========== Files - Modified Within 30 Days ========== [2012.12.26 07:24:26 | 000,000,000 | ---- | M] () -- C:\Users\Admin\defogger_reenable [2012.12.26 07:14:40 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.26 07:14:40 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.26 07:11:52 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.12.26 07:11:52 | 000,696,870 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.12.26 07:11:52 | 000,652,148 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.12.26 07:11:52 | 000,148,134 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.12.26 07:11:52 | 000,121,080 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.12.26 07:06:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.12.26 07:06:50 | 2414,379,008 | -HS- | M] () -- C:\hiberfil.sys [2012.12.25 22:36:13 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.12.24 22:55:54 | 000,002,940 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.js [2012.12.21 06:11:36 | 000,451,112 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.11.30 13:04:57 | 001,589,650 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI ========== Files Created - No Company Name ========== [2012.12.26 07:24:26 | 000,000,000 | ---- | C] () -- C:\Users\Admin\defogger_reenable [2012.12.24 22:55:54 | 000,002,940 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.js [2012.11.29 11:15:04 | 001,589,650 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.10.06 20:05:41 | 000,000,431 | ---- | C] () -- C:\Windows\MAXLINK.INI [2012.05.15 01:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.11.29 11:23:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\7-PDFSplitMerge [2012.09.18 09:33:47 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Advanced Chemistry Development [2012.10.16 12:23:59 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AshampooPack [2012.11.23 07:36:00 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DVDVideoSoft [2012.11.23 07:35:57 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers [2012.07.27 08:10:50 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\gp-Untis [2012.08.07 17:06:54 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Mikrotik [2012.08.23 10:36:47 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PC Remote [2012.07.24 20:42:48 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\pdfforge [2012.10.06 20:05:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ScanSoft [2012.07.23 20:04:44 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Thunderbird [2012.07.27 19:23:18 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TuneUp Software ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 26.12.2012 07:26:03 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Kerstin\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,91 Gb Available Physical Memory | 63,73% Memory free 5,99 Gb Paging File | 4,74 Gb Available in Paging File | 79,07% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 123,60 Gb Total Space | 74,71 Gb Free Space | 60,44% Space Free | Partition Type: NTFS Drive D: | 9,77 Gb Total Space | 0,43 Gb Free Space | 4,43% Space Free | Partition Type: NTFS Drive E: | 10,00 Gb Total Space | 5,75 Gb Free Space | 57,51% Space Free | Partition Type: NTFS Drive F: | 99,17 Gb Total Space | 49,92 Gb Free Space | 50,34% Space Free | Partition Type: NTFS Drive K: | 162,57 Gb Total Space | 19,73 Gb Free Space | 12,14% Space Free | Partition Type: NTFS Drive L: | 9,76 Gb Total Space | 2,72 Gb Free Space | 27,84% Space Free | Partition Type: NTFS Drive S: | 50,78 Gb Total Space | 33,85 Gb Free Space | 66,65% Space Free | Partition Type: NTFS Computer Name: LAPPI | User Name: Admin | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0147F19B-5C5E-4226-A9D2-729201C68DAF}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | "{0E4C3BC6-1292-49DA-88F3-1B51950F3B16}" = rport=139 | protocol=6 | dir=out | app=system | "{10B76103-B7E5-4244-AD43-65D1040BBCB5}" = lport=445 | protocol=6 | dir=in | app=system | "{18A1A538-B0D9-4A9D-8CC9-DA0996A6268F}" = lport=1900 | protocol=17 | dir=in | app=%programfiles%\zune\zune.exe | "{237B3F5B-B249-47CC-9E09-345BFD439119}" = rport=10243 | protocol=6 | dir=out | app=system | "{2B74C79E-652B-420E-AFB0-EEACBCE7B420}" = lport=137 | protocol=17 | dir=in | app=system | "{4238C091-A136-4EE8-8CFD-8D055EE00D5B}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | "{44674E2F-27F0-462B-A221-36B4B633AA37}" = lport=2869 | protocol=6 | dir=in | app=system | "{45CE93EC-5201-4263-8F48-496A4665B14C}" = lport=138 | protocol=17 | dir=in | app=system | "{5457D7E4-FF1C-46F5-AB4B-75BF18D57280}" = lport=10243 | protocol=6 | dir=in | app=system | "{5EE30C44-0EC2-42E8-96DC-8A3350F54C49}" = rport=138 | protocol=17 | dir=out | app=system | "{5F3A36B3-BB29-4CF3-BAC5-E7AEB2003E18}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{681FD363-4452-4D44-8399-F6FE0E4F2DCC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{6EFB9B8B-43F8-43CF-9FC0-BC0B809B081A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{7EC9735D-E881-4132-9FC5-9F6FE1305380}" = lport=2869 | protocol=6 | dir=in | app=system | "{89229A69-0E36-44F6-B9A6-617236DE6760}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{8A157507-4D5E-4984-9BFC-91BBD2791DC5}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{96D9B097-49E8-4795-80B3-ED29297FABE9}" = lport=2869 | protocol=6 | dir=in | app=system | "{9DEE7803-ADD6-4606-B395-351E79F5875A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{AA2FA38B-2801-4A2D-9CDB-F92E54545D1C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{C3AD116C-1A58-421F-8968-874D80427F52}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{C5384071-4CCD-4EC3-BFEF-3EFEA9E903CC}" = rport=137 | protocol=17 | dir=out | app=system | "{C88F6ABE-DF24-42F4-BA31-9D1DB36997CB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{CE16E9C0-C954-441A-BB71-494C721C5F76}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{D44C5E7F-27BD-4D2F-A05E-828FCC573D35}" = lport=139 | protocol=6 | dir=in | app=system | "{D69EAFB6-B6C6-42D1-B551-AA25E8FBBD13}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{D6E37E0B-2FA5-4F87-89C3-2587A69BEA13}" = rport=445 | protocol=6 | dir=out | app=system | "{E5037C32-DD14-422D-9FC5-4CF4EC8093A0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{F0BB78DE-40BC-42F3-B31A-F87DAA19603D}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{F9ADDC20-88A5-4018-BD5D-3CB656995C74}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0F480A6F-0D3A-4B4C-B64A-42E8A3442B92}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{17558C89-7CD3-4C75-B94D-E9B4ABD16472}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{1FD7922D-889C-4A9E-B4A6-6F553CCB6B39}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{3CB5590D-8450-4A58-9271-3B0A85A1961A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{43F2B72A-D0D5-4089-89B4-F16FCCAA4C29}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{45CFAA3F-9960-4117-B5BD-92DF34A91B25}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{5DCE63DC-CDC9-4384-8503-3FE48568EE1C}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{60AD3D45-88D2-4E57-AFBB-C12919923687}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | "{7EEE815F-6626-4C14-A9AC-544ECA26CB03}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{7F56C510-FF97-4469-AE9C-B3DD6080A9EA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{82D61078-B8B6-4B13-984C-F164007B2B93}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | "{8E812D71-AC28-45AC-B2A8-2644C1412FEC}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{9EF022F5-0B62-41A6-B4C0-503E659F695F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{A30CDCBB-414F-474D-ADF8-B416EAB9962C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | "{AA49FB56-E131-477A-8395-4452F2566C77}" = dir=in | app=c:\users\kerstin\appdata\local\microsoft\skydrive\skydrive.exe | "{ABC4C9C3-93F4-4ECA-91C9-9E85DCD597BB}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{B00F12BC-1FE7-4618-8ABF-69E411C15D01}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | "{B3C5A9E1-6896-4EFF-A319-5229B2625EA2}" = protocol=6 | dir=out | app=system | "{BB9B30F4-EDDB-46F2-81BF-8FB1AB3EDCE2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{BDDF286A-D0BD-438A-982A-88A7DC97973C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{C0E0C16C-5BF5-4275-9B7E-3743416F5B87}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{D952E0EE-353F-48B2-BFFF-3123B0A591D9}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{DBF0CBD1-7B89-4C02-A10C-7E051CCF70B9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{DD05E62B-AAAC-4CC7-BB30-E6B38000F115}" = dir=in | app=c:\program files (x86)\pc remote\pc remote\pcremote.exe | "{F08C967C-FFF3-4324-9007-BC7474729D3F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{FBCC637A-2CEB-4130-8041-9AC7EC6F88FB}" = dir=in | app=c:\users\admin\appdata\local\microsoft\skydrive\skydrive.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector "{07EEE598-5F21-4B57-B40B-46592625B3D9}" = Zune Language Pack (PTB) "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP460" = Canon MP460 "{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant "{2A9DFFD8-4E09-4B91-B957-454805B0D7C4}" = Zune Language Pack (CHS) "{3589A659-F732-4E65-A89A-5438C332E59D}" = Zune Language Pack (ELL) "{51C839E1-2BE4-4E77-A1BA-CCEA5DAFA741}" = Zune Language Pack (KOR) "{57C51D56-B287-4C11-9192-EC3C46EF76A4}" = Zune Language Pack (RUS) "{5C93E291-A1CC-4E51-85C6-E194209FCDB4}" = Zune Language Pack (PTG) "{5DEFD397-4012-46C3-B6DA-E8013E660772}" = Zune Language Pack (NOR) "{6740BCB0-5863-47F4-80F4-44F394DE4FE2}" = Zune Language Pack (NLD) "{6B33492E-FBBC-4EC3-8738-09E16E395A10}" = Zune Language Pack (ESP) "{6EB931CD-A7DA-4A44-B74A-89C8EB50086F}" = Zune Language Pack (SVE) "{76BA306B-2AA0-47C0-AB6B-F313AB56C136}" = Zune Language Pack (MSL) "{8960A0A1-BB5A-479E-92CF-65AB9D684B43}" = Zune Language Pack (PLK) "{8B112338-2B08-4851-AF84-E7CAD74CEB32}" = Zune Language Pack (DAN) "{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007 "{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007 "{92ECE3F9-591E-4C12-8A62-B9FCE38BF646}" = Zune Language Pack (IND) "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{9B75648B-6C30-4A0D-9DE6-0D09D20AF5A5}" = Zune "{A5A53EA8-A11E-49F0-BDF5-AE536426A31A}" = Zune Language Pack (CHT) "{A8F2E50B-86E2-4D96-9BD2-9758BCC6F9B3}" = Zune Language Pack (CSY) "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 301.42 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 301.42 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 301.42 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.8.15 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components "{B4870774-5F3A-46D9-9DFE-06FB5599E26B}" = Zune Language Pack (FIN) "{BE236D9A-52EC-4A17-82DA-84B5EAD31E3E}" = Zune Language Pack (DEU) "{C5D37FFA-7483-410B-982B-91E93FD3B7DA}" = Zune Language Pack (ITA) "{C68D33B1-0204-4EBE-BC45-A6E432B1D13A}" = Zune Language Pack (FRA) "{C6BE19C6-B102-4038-B2A6-1C313872DBB4}" = Zune Language Pack (HUN) "{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources "{D8A781C9-3892-4E2E-9320-480CF896CFBB}" = Zune Language Pack (JPN) "{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources "{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client "{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service "{F2CB8C3C-9C9E-4FAB-9067-655601C5F748}" = Windows Mobile Device Updater Component "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "CCleaner" = CCleaner "Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011) "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended "Zune" = Zune [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "[verify-U] AVS" = [verify-U] AVS 2.1.9 "_{0C180787-F8C8-42FD-A9D3-689BA44BEAAF}" = Corel Painter Essentials 3 "{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer "{0C180787-F8C8-42FD-A9D3-689BA44BEAAF}" = Corel Painter Essentials 3 "{15803703-25FA-4C01-A062-3F4A59937E87}" = Ulead PhotoImpact X3 "{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YTD Video Downloader 3.9 "{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions "{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9 "{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2 "{29D851C2-048C-4B5E-8D1F-25D473342BB5}" = ScanSoft OmniPage SE 4.0 "{2C403E20-29F9-4987-8DDB-5E1B8590494E}" = PC Remote "{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery "{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack "{3AAB5D08-28EA-4A4F-88C5-6906B880E81B}" = Windows Phone "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Media Driver Ver.3.53.02 "{6220202F-4863-4C7D-904C-5E60AC3D1F42}" = PureSync "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0015-0407-0000-0000000FF1CE}_PROPLUSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_PROPLUSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_PROPLUSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}_PROPLUSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}_PROPLUSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_PROPLUSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_PROPLUSR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_PROPLUSR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_PROPLUSR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_PROPLUSR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-002A-0000-1000-0000000FF1CE}_PROPLUSR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-002A-0407-1000-0000000FF1CE}_PROPLUSR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}_PROPLUSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_PROPLUSR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{91120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007 "{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3) "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common "{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch "{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh "{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie "{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common "{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform "{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX "{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10 "{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker "{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger "{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10 "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5 "{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials "7-PDF Split & Merge_is1" = 7-PDF Split & Merge Version 2.0.4 (Build 112) "ACDLabs in C__Program_Files_(x86)_ACDFREE12_" = ACD/Labs Software in C:\Program Files (x86)\ACDFREE12\ "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.15 "Ashampoo Burning Studio 7_is1" = Ashampoo Burning Studio 7.33 "Ashampoo Multimedia Pack 2" = Ashampoo Multimedia Pack 2 "Ashampoo Music Studio 3_is1" = Ashampoo Music Studio 3 3.51 "Ashampoo StartUp Tuner 2_is1" = Ashampoo StartUp Tuner 2.00 "avast" = avast! Free Antivirus "Canon MP460 Benutzerregistrierung" = Canon MP460 Benutzerregistrierung "Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint "Easy-WebPrint" = Easy-WebPrint "FORTE 4 Free" = FORTE 4 - Free Edition "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.35.1031 "InstallShield_{15803703-25FA-4C01-A062-3F4A59937E87}" = Ulead PhotoImpact X3 "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000 "Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de) "Mozilla Thunderbird 15.0 (x86 de)" = Mozilla Thunderbird 15.0 (x86 de) "MP Navigator 3.0" = Canon MP Navigator 3.0 "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver "Picasa 3" = Picasa 3 "PROPLUSR" = Microsoft Office Professional Plus 2007 "PureSync" = PureSync 3.6.2 "Untis 2013" = Untis 2013 "WinLiveSuite" = Windows Live Essentials "WinRAR archiver" = WinRAR 4.20 (32-Bit) "WinX Free WMV to MP4 Converter_is1" = WinX Free WMV to MP4 Converter 2.0.4 ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "SkyDriveSetup.exe" = Microsoft SkyDrive ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 26.10.2012 17:28:20 | Computer Name = Lappi | Source = Application Hang | ID = 1002 Description = Programm Iedit_.exe, Version 13.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1068 Startzeit: 01cdb3c049c133b2 Endzeit: 124 Anwendungspfad: C:\Program Files (x86)\Corel\Ulead PhotoImpact X3\Iedit_.exe Berichts-ID: 08a7fd53-1fb4-11e2-a408-001f3adf264c Error - 27.10.2012 00:30:31 | Computer Name = Lappi | Source = Application Hang | ID = 1002 Description = Programm Iedit_.exe, Version 13.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: df4 Startzeit: 01cdb3c0d3b650e2 Endzeit: 160 Anwendungspfad: C:\Program Files (x86)\Corel\Ulead PhotoImpact X3\Iedit_.exe Berichts-ID: 011893d6-1fef-11e2-a408-001f3adf264c Error - 27.10.2012 01:17:11 | Computer Name = Lappi | Source = Application Hang | ID = 1002 Description = Programm Iedit_.exe, Version 13.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 47c Startzeit: 01cdb3fc16196e15 Endzeit: 203 Anwendungspfad: C:\Program Files (x86)\Corel\Ulead PhotoImpact X3\Iedit_.exe Berichts-ID: 834dc916-1ff5-11e2-a408-001f3adf264c Error - 01.11.2012 01:19:31 | Computer Name = Lappi | Source = Application Hang | ID = 1002 Description = Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 9a8 Startzeit: 01cdb73d87bb8351 Endzeit: 597 Anwendungspfad: C:\Windows\Explorer.EXE Berichts-ID: acf40bba-23e3-11e2-a6bf-001f3adf264c Error - 07.11.2012 01:17:53 | Computer Name = Lappi | Source = Microsoft-Windows-RestartManager | ID = 10006 Description = Die Anwendung oder der Dienst "PureSync Tray Application" konnte nicht heruntergefahren werden. Error - 08.11.2012 09:25:22 | Computer Name = Lappi | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: EXCEL.EXE, Version: 12.0.6661.5000, Zeitstempel: 0x4f7cda6d Name des fehlerhaften Moduls: EXCEL.EXE, Version: 12.0.6661.5000, Zeitstempel: 0x4f7cda6d Ausnahmecode: 0xc0000005 Fehleroffset: 0x00013246 ID des fehlerhaften Prozesses: 0xd3c Startzeit der fehlerhaften Anwendung: 0x01cdbdb3427e1ad2 Pfad der fehlerhaften Anwendung: C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE Pfad des fehlerhaften Moduls: C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE Berichtskennung: bf254dff-29a7-11e2-9387-001f3adf264c Error - 28.11.2012 15:47:19 | Computer Name = Lappi | Source = MsiInstaller | ID = 11719 Description = Error - 29.11.2012 06:08:08 | Computer Name = Lappi | Source = MsiInstaller | ID = 10005 Description = Error - 29.11.2012 06:37:14 | Computer Name = Lappi | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: EXCEL.EXE, Version: 12.0.6665.5003, Zeitstempel: 0x5061d2a8 Name des fehlerhaften Moduls: EXCEL.EXE, Version: 12.0.6665.5003, Zeitstempel: 0x5061d2a8 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00049988 ID des fehlerhaften Prozesses: 0x178 Startzeit der fehlerhaften Anwendung: 0x01cdce1d7a1a12c5 Pfad der fehlerhaften Anwendung: C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE Pfad des fehlerhaften Moduls: C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE Berichtskennung: bcef2c9e-3a10-11e2-ae4a-001f3adf264c Error - 05.12.2012 03:07:39 | Computer Name = Lappi | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: PureSync.exe, Version: 3.6.0.2392, Zeitstempel: 0x50349fd3 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc000041d Fehleroffset: 0x75334f0d ID des fehlerhaften Prozesses: 0x1614 Startzeit der fehlerhaften Anwendung: 0x01cdd2b71d61a0ff Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\PureSync\PureSync.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 73b769a3-3eaa-11e2-9e0f-001f3adf264c [ System Events ] Error - 25.12.2012 11:46:02 | Computer Name = Lappi | Source = Service Control Manager | ID = 7023 Description = Der Dienst "[verify-U]-Service" wurde mit folgendem Fehler beendet: %%2 Error - 25.12.2012 11:46:04 | Computer Name = Lappi | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: [verify-U]_System Error - 25.12.2012 13:23:36 | Computer Name = Lappi | Source = Microsoft-Windows-HAL | ID = 12 Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte Firmware verfügbar ist. Error - 25.12.2012 15:12:18 | Computer Name = Lappi | Source = BTHUSB | ID = 327697 Description = Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen. Error - 25.12.2012 17:16:07 | Computer Name = Lappi | Source = Application Popup | ID = 1060 Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\[verify-U]-driver.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten. Error - 25.12.2012 17:16:46 | Computer Name = Lappi | Source = Service Control Manager | ID = 7023 Description = Der Dienst "[verify-U]-Service" wurde mit folgendem Fehler beendet: %%2 Error - 25.12.2012 17:16:49 | Computer Name = Lappi | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: [verify-U]_System Error - 26.12.2012 02:06:46 | Computer Name = Lappi | Source = Application Popup | ID = 1060 Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\[verify-U]-driver.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten. Error - 26.12.2012 02:07:27 | Computer Name = Lappi | Source = Service Control Manager | ID = 7023 Description = Der Dienst "[verify-U]-Service" wurde mit folgendem Fehler beendet: %%2 Error - 26.12.2012 02:07:30 | Computer Name = Lappi | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: [verify-U]_System < End of report > Ich bedanke mich schonmal im Voraus Kerstin |
Themen zu GVU Trojaner (Exploit.drop.gsa) |
adobe, antivirus, autorun, avast, brief, canon, converter, desktop, dsgsdgdsgdsgw.pad, error, exploit.drop.gs, exploit.drop.gsa, fehlermeldung, firefox, flash player, hängt, install.exe, logfile, msiinstaller, nvidia update, office 2007, plug-in, popup, pum.hijack.startmenu, registry, runctf.lnk, security, software, starten, svchost.exe, system, system neu, temp, trojan.ransom.sugen, trojaner, wgsdgsdgdsgsd.dll |