|
Plagegeister aller Art und deren Bekämpfung: Plötzlich überall Werbung!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
12.01.2013, 13:31 | #1 |
| Plötzlich überall Werbung! Hallo, mir ist aufgefallen, dass bei mir, egal auf welcher Interseite ich mich befinde, Werbung auftaucht. Diese Werbung ist zum Teil nicht gerade jugendfrei. Zusätzlich verfärben sich nun auch viele einzelne Wörter auf den Seiten und beim Hinübergehen über diese, erscheinen Links mit unmoralische Angeboten auf Ich hoffe ihr könnt mir helfen. Ich habe mir bereits OTL heruntergeladen, falls das hilfreich ist. Gruß grass |
12.01.2013, 13:54 | #2 |
/// TB-Ausbilder | Plötzlich überall Werbung!Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Schritt 1 Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop (falls noch nicht vorhanden).
Code:
ATTFilter activex netsvcs msconfig drivers32 safebootminimal safebootnetwork hklm\software\clients\startmenuinternet|command /rs hklm\software\clients\startmenuinternet|command /64 /rs CREATERESTOREPOINT
Schritt 2 Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
Schritt 3 Bitte
Bitte poste mit deiner nächsten Antwort
|
12.01.2013, 14:27 | #3 |
| Plötzlich überall Werbung!Code:
ATTFilter OTL logfile created on: 1/12/2013 2:14:56 PM - Run 3 OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\User\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2.93 Gb Total Physical Memory | 2.12 Gb Available Physical Memory | 72.32% Memory free 5.86 Gb Paging File | 4.80 Gb Available in Paging File | 81.84% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 141.49 Gb Total Space | 96.32 Gb Free Space | 68.08% Space Free | Partition Type: NTFS Drive D: | 141.50 Gb Total Space | 5.94 Gb Free Space | 4.20% Space Free | Partition Type: NTFS Drive E: | 1.15 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: USER-PC | User Name: User | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012/11/23 03:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2012/11/22 16:58:14 | 001,522,312 | ---- | M] (pdfforge GbR) -- C:\Program Files\PDF Architect\HelperService.exe PRC - [2012/11/22 16:56:10 | 000,905,864 | ---- | M] (pdfforge GbR) -- C:\Program Files\PDF Architect\ConversionService.exe PRC - [2012/03/24 21:56:22 | 002,077,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe PRC - [2012/03/24 21:56:17 | 000,725,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe PRC - [2012/03/24 19:03:14 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe PRC - [2012/03/24 19:03:14 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe PRC - [2012/03/24 19:03:12 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe PRC - [2012/03/24 19:03:11 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe PRC - [2012/03/24 12:55:45 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe PRC - [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2011/01/17 17:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe PRC - [2011/01/17 17:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin PRC - [2010/04/16 13:11:02 | 000,650,920 | ---- | M] () -- C:\PROGRA~1\samsung\SAMSUN~2\SUPNOT~1.EXE PRC - [2009/09/08 00:47:52 | 000,832,512 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe PRC - [2009/09/07 11:42:04 | 000,093,184 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe PRC - [2009/08/23 05:47:34 | 000,716,800 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe PRC - [2009/08/06 08:46:06 | 002,242,048 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe ========== Modules (No Company Name) ========== MOD - [2012/04/13 16:04:43 | 000,985,088 | ---- | M] () -- C:\Program Files\OpenOffice.org 3\program\libxml2.dll MOD - [2010/04/16 13:11:02 | 000,650,920 | ---- | M] () -- C:\PROGRA~1\samsung\SAMSUN~2\SUPNOT~1.EXE MOD - [2010/04/16 13:11:02 | 000,155,648 | ---- | M] () -- C:\PROGRA~1\samsung\SAMSUN~2\HMXML.dll MOD - [2006/08/12 04:48:40 | 000,049,152 | ---- | M] () -- C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll ========== Win32 Services (SafeList) ========== SRV - [2013/01/11 11:37:18 | 000,115,760 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013/01/08 21:34:34 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012/11/22 16:58:14 | 001,522,312 | ---- | M] (pdfforge GbR) [Auto | Running] -- C:\Program Files\PDF Architect\HelperService.exe -- (PDF Architect Helper Service) SRV - [2012/11/22 16:56:10 | 000,905,864 | ---- | M] (pdfforge GbR) [Auto | Running] -- C:\Program Files\PDF Architect\ConversionService.exe -- (PDF Architect Service) SRV - [2012/03/24 19:03:14 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd) SRV - [2012/03/24 19:03:12 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc) SRV - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService) SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - [2012/03/24 19:03:15 | 000,243,152 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (AvgTdiX) DRV - [2012/03/24 19:03:14 | 000,029,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (AvgMfx86) DRV - [2012/03/24 19:03:12 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (AvgLdx86) DRV - [2010/11/20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010/11/20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2009/12/27 21:01:38 | 000,114,496 | ---- | M] (Protection Technology Co.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\prodrv04.sys -- (prodrv04) DRV - [2009/09/21 17:58:28 | 001,218,048 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.chatzum.com/ IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://search.chatzum.com/?q={searchTerms} IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = 04 00 AB 03 0B 00 00 00 72 DB 23 44 01 00 00 80 06 00 AB 03 00 00 00 00 [binary data] IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\..\SearchScopes,DefaultScope = {96bd48dd-741b-41ae-ac4a-aff96ba00f7e} IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://search.chatzum.com/?q={searchTerms} IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = hxxp://search.chatzum.com/?q={SearchTerms} IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1131658597-4005637612-88016806-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..keyword.URL: "hxxp://utils.chatzum.com/?url=" FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files\PDF Architect\FFPDFArchitectExt [2013/01/06 19:19:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/01/11 11:37:19 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/01/11 11:37:10 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/01/11 11:37:19 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/01/11 11:37:10 | 000,000,000 | ---D | M] [2010/04/19 19:45:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Extensions [2013/01/07 12:11:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\9zpofac7.default\extensions [2013/01/07 12:11:33 | 000,000,000 | ---D | M] (SaveByclick) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\9zpofac7.default\extensions\50e9c0c09d2eb@50e9c0c09d324.com [2012/07/17 11:59:56 | 000,000,000 | ---D | M] ("Star Stable Online") -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\9zpofac7.default\extensions\plugin@starstable.com [2012/11/03 12:54:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions [2012/03/24 17:41:51 | 000,000,000 | ---D | M] (Winload) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} [2012/03/24 17:41:50 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012/03/24 17:41:48 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2012/11/03 12:54:40 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012/03/24 17:41:51 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\engine@conduit.com [2012/03/24 17:41:51 | 000,000,000 | ---D | M] (Videos) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\jid1-npQlxRhRimvmWQ@jetpack [2012/03/24 17:41:51 | 000,000,000 | ---D | M] (1-Click YouTube Video Downloader) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\YoutubeDownloader@PeterOlayev.com [2012/09/15 10:35:47 | 000,000,642 | ---- | M] () -- C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\9zpofac7.default\searchplugins\search-safer.xml [2013/01/11 11:37:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions [2013/01/06 19:19:49 | 000,000,000 | ---D | M] (PDF Architect Converter For Firefox) -- C:\PROGRAM FILES\PDF ARCHITECT\FFPDFARCHITECTEXT () (No name found) -- C:\USERS\USER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9ZPOFAC7.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}.XPI () (No name found) -- C:\USERS\USER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9ZPOFAC7.DEFAULT\EXTENSIONS\DIVXWEBPLAYER@DIVX.COM.XPI [2013/01/11 11:37:19 | 000,262,704 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012/04/13 16:03:23 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2012/11/29 10:19:31 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012/11/29 10:19:31 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012/11/29 10:19:31 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012/11/29 10:19:32 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012/11/29 10:19:31 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012/11/29 10:19:31 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - Extension: SaveByclick = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\phhiffhnigbokadpnjpichlmgcmiacpo\1\ O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (SaveByclick) - {364D121B-2EEE-CF90-F500-5C703532DA11} - C:\ProgramData\SaveByclick\50e9c0c09d467.dll File not found O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GbR) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (PDF Architect Toolbar) - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GbR) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKU\S-1-5-21-1131658597-4005637612-88016806-1000..\Run: [eType Setup403431.exe] "C:\Users\User\AppData\Local\Temp\eType Setup403431.exe" /XML="C:\Users\User\AppData\Local\Temp\FFF2.tmp" /STP=0:1 File not found O4 - HKU\S-1-5-21-1131658597-4005637612-88016806-1000..\Run: [Speech Recognition] C:\windows\Speech\Common\sapisvr.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\User\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 10.5.1) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 10.5.1) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7504C383-01A4-4CA1-8C46-062F533D0D98}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E366DA8A-EC55-4CAC-9A1B-0C76A4645162}: DhcpNameServer = 192.168.178.100 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (avgrsstx.dll) - C:\windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2006/07/27 11:11:04 | 000,000,040 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{e8951791-c8cf-11de-83f7-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{e8951791-c8cf-11de-83f7-806e6f6e6963}\Shell\AutoRun\command - "" = E:\setup.exe -- [2002/12/02 14:33:00 | 000,107,512 | R--- | M] (InstallShield Software Corporation) O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.) SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: mcmscsvc - Service SafeBootMin: MCODS - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: mcmscsvc - Service SafeBootNet: MCODS - Service SafeBootNet: Messenger - Service SafeBootNet: MpfService - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2013/01/11 11:37:09 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013/01/10 01:53:25 | 000,000,000 | ---D | C] -- C:\0df949960074e422ac71cd6f01af [2013/01/10 01:39:17 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\win32k.sys [2013/01/10 01:39:02 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\conhost.exe [2013/01/10 01:39:02 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\winsrv.dll [2013/01/10 01:39:02 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-security-base-l1-1-0.dll [2013/01/10 01:39:02 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-file-l1-1-0.dll [2013/01/10 01:39:02 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-threadpool-l1-1-0.dll [2013/01/10 01:39:02 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-processthreads-l1-1-0.dll [2013/01/10 01:39:02 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll [2013/01/10 01:39:02 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-synch-l1-1-0.dll [2013/01/10 01:39:02 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-misc-l1-1-0.dll [2013/01/10 01:39:02 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-localregistry-l1-1-0.dll [2013/01/10 01:39:02 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-localization-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-xstate-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-memory-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-interlocked-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-heap-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-util-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-string-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-profile-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-io-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-handle-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-fibers-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-delayload-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-debug-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-datetime-l1-1-0.dll [2013/01/10 01:39:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-console-l1-1-0.dll [2013/01/10 01:38:42 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\gameux.dll [2013/01/10 01:38:42 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\Wpc.dll [2013/01/10 01:38:42 | 000,046,592 | ---- | C] (Microsoft) -- C:\windows\System32\fpb.rs [2013/01/10 01:38:42 | 000,045,568 | ---- | C] (Microsoft) -- C:\windows\System32\oflc-nz.rs [2013/01/10 01:38:42 | 000,044,544 | ---- | C] (Microsoft) -- C:\windows\System32\pegibbfc.rs [2013/01/10 01:38:42 | 000,043,520 | ---- | C] (Microsoft) -- C:\windows\System32\csrr.rs [2013/01/10 01:38:42 | 000,040,960 | ---- | C] (Microsoft) -- C:\windows\System32\cob-au.rs [2013/01/10 01:38:42 | 000,030,720 | ---- | C] (Microsoft) -- C:\windows\System32\usk.rs [2013/01/10 01:38:42 | 000,021,504 | ---- | C] (Microsoft) -- C:\windows\System32\grb.rs [2013/01/10 01:38:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\windows\System32\pegi-pt.rs [2013/01/10 01:38:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\windows\System32\pegi.rs [2013/01/10 01:38:42 | 000,015,360 | ---- | C] (Microsoft) -- C:\windows\System32\djctq.rs [2013/01/10 01:38:41 | 000,051,712 | ---- | C] (Microsoft) -- C:\windows\System32\esrb.rs [2013/01/10 01:38:40 | 000,055,296 | ---- | C] (Microsoft) -- C:\windows\System32\cero.rs [2013/01/10 01:38:40 | 000,023,552 | ---- | C] (Microsoft) -- C:\windows\System32\oflc.rs [2013/01/10 01:38:40 | 000,020,480 | ---- | C] (Microsoft) -- C:\windows\System32\pegi-fi.rs [2013/01/10 01:38:30 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ncrypt.dll [2013/01/10 01:38:30 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\taskhost.exe [2013/01/06 20:35:01 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\UDC Profiles [2013/01/06 20:34:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Universal Document Converter [2013/01/06 20:34:44 | 000,026,088 | ---- | C] (fCoder Group, Inc.) -- C:\windows\System32\udcpm.dll [2013/01/06 20:34:44 | 000,000,000 | R--D | C] -- C:\Users\User\Documents\UDC Output Files [2013/01/06 20:34:39 | 000,000,000 | ---D | C] -- C:\Program Files\Universal Document Converter [2013/01/06 20:27:46 | 000,000,000 | ---D | C] -- C:\Users\User\Documents\4Videosoft Studio [2013/01/06 20:27:45 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\4Videosoft Studio [2013/01/06 19:26:32 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\PDF Architect [2013/01/06 19:20:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SaveByclick [2013/01/06 19:20:16 | 000,000,000 | ---D | C] -- C:\ProgramData\SaveByclick [2013/01/06 19:20:07 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\APP_NAME_NON_STRING [2013/01/06 19:19:59 | 000,000,000 | ---D | C] -- C:\Users\User\Documents\PDF Architect Files [2013/01/06 19:19:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect [2013/01/06 19:19:48 | 000,000,000 | ---D | C] -- C:\Program Files\PDF Architect [2013/01/06 19:19:29 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\pdfforge [2013/01/06 19:19:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator [2013/01/06 19:19:26 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MSCOMCT2.OCX [2013/01/06 19:19:26 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MSMAPI32.OCX [2013/01/06 19:19:26 | 000,088,576 | ---- | C] (pdfforge GbR) -- C:\windows\System32\pdfcmon.dll [2013/01/06 19:19:24 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MSCMCDE.DLL [2013/01/06 19:19:24 | 000,125,712 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\VB6DE.DLL [2013/01/06 19:19:24 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MSCC2DE.DLL [2013/01/06 19:19:24 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MSMPIDE.DLL [2013/01/06 19:19:24 | 000,000,000 | ---D | C] -- C:\Program Files\PDFCreator [2012/12/21 23:16:20 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- C:\windows\System32\atmfd.dll [2012/12/21 23:16:20 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\windows\System32\atmlib.dll ========== Files - Modified Within 30 Days ========== [2013/01/12 13:31:00 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2013/01/12 12:24:48 | 000,014,832 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/01/12 12:24:48 | 000,014,832 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/01/12 12:22:54 | 105,740,586 | ---- | M] () -- C:\windows\System32\drivers\Avg\incavi.avm [2013/01/12 12:16:58 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2013/01/12 12:16:57 | 2362,920,960 | -HS- | M] () -- C:\hiberfil.sys [2013/01/10 12:52:49 | 000,432,944 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT [2013/01/10 01:57:19 | 000,654,166 | ---- | M] () -- C:\windows\System32\perfh007.dat [2013/01/10 01:57:19 | 000,616,008 | ---- | M] () -- C:\windows\System32\perfh009.dat [2013/01/10 01:57:19 | 000,130,006 | ---- | M] () -- C:\windows\System32\perfc007.dat [2013/01/10 01:57:19 | 000,106,388 | ---- | M] () -- C:\windows\System32\perfc009.dat [2013/01/08 21:34:32 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerApp.exe [2013/01/08 21:34:32 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerCPLApp.cpl [2013/01/06 20:34:52 | 000,000,727 | ---- | M] () -- C:\Users\Public\Desktop\UDC Output Files.lnk [2013/01/06 19:20:12 | 000,000,963 | ---- | M] () -- C:\Users\User\Desktop\PDF Architect.lnk [2013/01/06 19:19:31 | 000,000,989 | ---- | M] () -- C:\Users\Public\Desktop\PDFCreator.lnk [2013/01/06 17:58:38 | 000,018,059 | ---- | M] () -- C:\Users\User\Documents\Bewerbungsanschreiben.odt [2013/01/06 17:58:05 | 000,013,150 | ---- | M] () -- C:\Users\User\Documents\lebenslauf2.odt [2012/12/16 15:13:28 | 000,295,424 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\atmfd.dll [2012/12/16 15:13:20 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\windows\System32\atmlib.dll [2012/12/15 17:31:00 | 000,012,931 | ---- | M] () -- C:\Users\User\Documents\kundengespräch.odt ========== Files Created - No Company Name ========== [2013/01/06 20:34:52 | 000,000,727 | ---- | C] () -- C:\Users\Public\Desktop\UDC Output Files.lnk [2013/01/06 19:20:12 | 000,000,963 | ---- | C] () -- C:\Users\User\Desktop\PDF Architect.lnk [2013/01/06 19:19:31 | 000,000,989 | ---- | C] () -- C:\Users\Public\Desktop\PDFCreator.lnk [2013/01/02 22:25:53 | 000,018,059 | ---- | C] () -- C:\Users\User\Documents\Bewerbungsanschreiben.odt [2012/12/15 17:30:58 | 000,012,931 | ---- | C] () -- C:\Users\User\Documents\kundengespräch.odt [2012/05/17 17:22:01 | 000,001,043 | ---- | C] () -- C:\windows\eReg.dat [2012/03/24 16:24:03 | 000,000,000 | ---- | C] () -- C:\ProgramData\ilaiwoseniw.dat [2012/03/24 16:23:58 | 000,166,400 | --S- | C] () -- C:\ProgramData\arjquitoco.dat [2011/12/14 03:57:20 | 001,568,178 | -H-- | C] () -- C:\ProgramData\winesowiali.dat [2011/06/12 16:13:33 | 000,009,530 | -HS- | C] () -- C:\Users\User\AppData\Local\dbm44e48s8 [2011/06/12 16:13:33 | 000,008,946 | -HS- | C] () -- C:\ProgramData\dbm44e48s8 [2011/05/06 17:22:04 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011/04/29 10:34:40 | 000,010,044 | -HS- | C] () -- C:\Users\User\AppData\Local\551ms412n37o86v68g7548dpwq8wjtc1 [2011/04/29 10:34:40 | 000,010,044 | -HS- | C] () -- C:\ProgramData\551ms412n37o86v68g7548dpwq8wjtc1 ========== Custom Scans ========== < hklm\software\clients\startmenuinternet|command /rs > HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2013/01/11 11:37:17 | 000,866,728 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2013/01/11 11:37:17 | 000,866,728 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2013/01/11 11:37:17 | 000,866,728 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2013/01/11 11:37:18 | 000,917,552 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2013/01/11 11:37:18 | 000,917,552 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2013/01/11 11:37:18 | 000,917,552 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2012/03/25 00:32:11 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2012/03/25 00:32:11 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2012/03/25 00:32:11 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2012/11/16 17:33:24 | 000,757,280 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2012/11/16 17:33:24 | 000,757,280 | ---- | M] (Microsoft Corporation) < hklm\software\clients\startmenuinternet|command /64 /rs > HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2013/01/11 11:37:17 | 000,866,728 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2013/01/11 11:37:17 | 000,866,728 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2013/01/11 11:37:17 | 000,866,728 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2013/01/11 11:37:18 | 000,917,552 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2013/01/11 11:37:18 | 000,917,552 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2013/01/11 11:37:18 | 000,917,552 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2012/03/25 00:32:11 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2012/03/25 00:32:11 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2012/03/25 00:32:11 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2012/11/16 17:33:24 | 000,757,280 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2012/11/16 17:33:24 | 000,757,280 | ---- | M] (Microsoft Corporation) ========== Alternate Data Streams ========== @Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:A42A9F39 @Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:4CF61E54 @Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:ABE89FFE @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:E1F04E8D < End of report > Code:
ATTFilter OTL Extras logfile created on: 1/12/2013 2:14:56 PM - Run 3 OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\User\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2.93 Gb Total Physical Memory | 2.12 Gb Available Physical Memory | 72.32% Memory free 5.86 Gb Paging File | 4.80 Gb Available in Paging File | 81.84% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 141.49 Gb Total Space | 96.32 Gb Free Space | 68.08% Space Free | Partition Type: NTFS Drive D: | 141.50 Gb Total Space | 5.94 Gb Free Space | 4.20% Space Free | Partition Type: NTFS Drive E: | 1.15 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: USER-PC | User Name: User | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation) [HKEY_USERS\S-1-5-21-1131658597-4005637612-88016806-1000\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator "{094FABA0-4865-11D4-95B6-000103485DB6}" = Theme Park TM Manager "{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1 "{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4 "{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager "{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}" = EasyBatteryManager "{1AFA1FEF-8CF9-4A51-AC46-64FAA7F3D9E2}" = AnyPC Client "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22 "{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5 "{26B5A6D1-1F75-3B59-5825-E4D4CAE3445D}" = SaveByclick "{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie "{30B41B7A-3C9D-44DE-A7A1-949011F33CC3}" = PDF Architect "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker "{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger "{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3 "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4D2121FE-5CCC-4D47-B3A0-BF56045A5099}" = Samsung Support Center "{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}" = Paint.NET v3.5.10 "{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent "{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call "{63eafc52-b963-4297-a7eb-d412944e7065}_is1" = Game Pack "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour "{7C32C567-DC0F-4C80-B06C-7873850A2E06}" = Die Sims - Tierisch gut drauf "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114072167}" = Go-Go Gourmet "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}" = Dairy Dash "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}" = Farm Frenzy 2 "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1" = ClipGrab 3.2.0.9 "{8B92D97D-DB3D-4926-A8F7-718FE7C5EE18}" = iTunes "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager "{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003 "{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195 "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{994223F3-A99B-4DDD-9E1D-0190A17C6860}" = Windows Live Family Safety "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager "{AA16A9E5-40E9-44F5-801E-6B3D3CFE79E5}" = BatteryLifeExtender "{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9 "{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide "{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail "{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program "{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus "{DB833EF9-A198-49BE-970A-BD46F30BFBB4}" = ANNO 1503 GOLD "{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer "{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update "{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support "{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager "{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "AVG9Uninstall" = AVG Free 9.0 "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.35.1031 "HDMI" = Intel(R) Graphics Media Accelerator Driver "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Mozilla Firefox 18.0 (x86 de)" = Mozilla Firefox 18.0 (x86 de) "MozillaMaintenanceService" = Mozilla Maintenance Service "PhotoScape" = PhotoScape "SynTPDeinstKey" = Synaptics Pointing Device Driver "Universal Document Converter_is1" = Universal Document Converter (Demo) "WinLiveSuite_Wave3" = Windows Live Essentials "Zoo Tycoon 1.0" = Zoo Tycoon: Complete Collection ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 7/31/2011 12:36:28 PM | Computer Name = User-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledEvent 8439 Error - 7/31/2011 12:36:28 PM | Computer Name = User-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledSPRetry 8439 Error - 7/31/2011 12:36:29 PM | Computer Name = User-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: Continuously busy for more than a second Error - 7/31/2011 12:36:29 PM | Computer Name = User-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledEvent 9453 Error - 7/31/2011 12:36:29 PM | Computer Name = User-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledSPRetry 9453 Error - 7/31/2011 12:36:30 PM | Computer Name = User-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: Continuously busy for more than a second Error - 7/31/2011 12:36:30 PM | Computer Name = User-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledEvent 10467 Error - 7/31/2011 12:36:30 PM | Computer Name = User-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledSPRetry 10467 Error - 7/31/2011 1:42:56 PM | Computer Name = User-PC | Source = Microsoft-Windows-Backup | ID = 517 Description = Fehler bei der um 2011-07-31T17:10:49.758616300Z gestarteten Sicherung. Fehlercode: "2155348269" (%%2155348269). Suchen Sie in den Ereignisdetails nach einer Lösung, und führen Sie die Sicherung erneut aus, nachdem das Problem behoben wurde. Error - 7/31/2011 1:43:03 PM | Computer Name = User-PC | Source = Windows Backup | ID = 4104 Description = [ Media Center Events ] Error - 5/16/2011 12:11:04 PM | Computer Name = User-PC | Source = MCUpdate | ID = 0 Description = 18:11:04 - Fehler beim Herstellen der Internetverbindung. 18:11:04 - Serververbindung konnte nicht hergestellt werden.. Error - 5/16/2011 12:11:14 PM | Computer Name = User-PC | Source = MCUpdate | ID = 0 Description = 18:11:09 - Fehler beim Herstellen der Internetverbindung. 18:11:09 - Serververbindung konnte nicht hergestellt werden.. Error - 5/16/2011 1:11:21 PM | Computer Name = User-PC | Source = MCUpdate | ID = 0 Description = 19:11:21 - Fehler beim Herstellen der Internetverbindung. 19:11:21 - Serververbindung konnte nicht hergestellt werden.. Error - 5/16/2011 1:11:30 PM | Computer Name = User-PC | Source = MCUpdate | ID = 0 Description = 19:11:27 - Fehler beim Herstellen der Internetverbindung. 19:11:27 - Serververbindung konnte nicht hergestellt werden.. Error - 5/16/2011 2:16:05 PM | Computer Name = User-PC | Source = MCUpdate | ID = 0 Description = 20:16:00 - Fehler beim Herstellen der Internetverbindung. 20:16:01 - Serververbindung konnte nicht hergestellt werden.. Error - 5/16/2011 2:19:47 PM | Computer Name = User-PC | Source = MCUpdate | ID = 0 Description = 20:16:21 - Fehler beim Herstellen der Internetverbindung. 20:16:21 - Serververbindung konnte nicht hergestellt werden.. Error - 5/16/2011 3:22:47 PM | Computer Name = User-PC | Source = MCUpdate | ID = 0 Description = 21:22:47 - Fehler beim Herstellen der Internetverbindung. 21:22:47 - Serververbindung konnte nicht hergestellt werden.. Error - 5/16/2011 3:25:24 PM | Computer Name = User-PC | Source = MCUpdate | ID = 0 Description = 21:22:58 - Fehler beim Herstellen der Internetverbindung. 21:22:58 - Serververbindung konnte nicht hergestellt werden.. Error - 5/24/2011 8:46:12 AM | Computer Name = User-PC | Source = MCUpdate | ID = 0 Description = 14:46:09 - Fehler beim Herstellen der Internetverbindung. 14:46:09 - Serververbindung konnte nicht hergestellt werden.. [ System Events ] Error - 1/5/2013 8:29:43 PM | Computer Name = User-PC | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: prodrv04 Error - 1/6/2013 8:10:12 AM | Computer Name = User-PC | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: prodrv04 Error - 1/7/2013 7:10:57 AM | Computer Name = User-PC | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: prodrv04 Error - 1/8/2013 7:54:56 AM | Computer Name = User-PC | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: prodrv04 Error - 1/9/2013 8:25:42 AM | Computer Name = User-PC | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: prodrv04 Error - 1/10/2013 7:53:19 AM | Computer Name = User-PC | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: prodrv04 Error - 1/11/2013 5:42:12 AM | Computer Name = User-PC | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: prodrv04 Error - 1/12/2013 7:17:44 AM | Computer Name = User-PC | Source = Service Control Manager | ID = 7009 Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Oberon Media Game Console service erreicht. Error - 1/12/2013 7:17:44 AM | Computer Name = User-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "Oberon Media Game Console service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error - 1/12/2013 7:17:45 AM | Computer Name = User-PC | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: prodrv04 < End of report > Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 14:31 on 12/01/2013 (User) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Code:
ATTFilter GMER 2.0.18444 - hxxp://www.gmer.net Rootkit scan 2013-01-12 14:59:18 Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB3O 298,09GB Running: m9quy3j0.exe; Driver: C:\Users\User\AppData\Local\Temp\kxldapob.sys ---- Kernel code sections - GMER 2.0 ---- .text ntoskrnl.exe!ZwRollbackEnlistment + 1401 82C799C9 1 Byte [06] .text ntoskrnl.exe!KiDispatchInterrupt + 5A2 82C994E2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} ---- EOF - GMER 2.0 ---- |
12.01.2013, 17:02 | #4 |
/// TB-Ausbilder | Plötzlich überall Werbung! Servus, klar hilft das. Ich sehe in der Logdatei von OTL Malware, die auf April 2011 schließen lassen... Schritt 1 Downloade Dir bitte AdwCleaner auf deinen Desktop.
Schritt 2 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden. Bitte lade Junkware Removal Tool auf Deinen Desktop.
Schritt 3 Scan mit Combofix
Bitte poste mit deiner nächsten Antwort
|
13.01.2013, 16:30 | #5 |
| Plötzlich überall Werbung!Code:
ATTFilter # AdwCleaner v2.105 - Datei am 13/01/2013 um 16:26:33 erstellt # Aktualisiert am 08/01/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits) # Benutzer : User - USER-PC # Bootmodus : Normal # Ausgeführt unter : C:\Users\User\Downloads\adwcleaner.exe # Option [Löschen] **** [Dienste] **** ***** [Dateien / Ordner] ***** Ordner Gelöscht : C:\Program Files\ChatZum Toolbar Ordner Gelöscht : C:\Program Files\FunWebProducts Ordner Gelöscht : C:\Program Files\ICQ6Toolbar Ordner Gelöscht : C:\Program Files\MyWebSearch Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar Ordner Gelöscht : C:\ProgramData\Partner Ordner Gelöscht : C:\ProgramData\Trymedia ***** [Registrierungsdatenbank] ***** Schlüssel Gelöscht : HKCU\Software\ChatZum Toolbar Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{96BD48DD-741B-41AE-AC4A-AFF96BA00F7E} Schlüssel Gelöscht : HKCU\Software\Softonic Schlüssel Gelöscht : HKLM\Software\ChatZum Toolbar Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\chatzum_nt_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\chatzum_nt_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS ***** [Internet Browser] ***** -\\ Internet Explorer v9.0.8112.16457 Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.chatzum.com/ --> hxxp://www.google.com -\\ Mozilla Firefox v18.0 (de) -\\ Google Chrome v [Version kann nicht ermittelt werden] ************************* AdwCleaner[S1].txt - [2053 octets] - [13/01/2013 16:26:33] ########## EOF - C:\AdwCleaner[S1].txt - [2113 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.4.2 (01.08.2013:1) OS: Windows 7 Home Premium x86 Ran by User on 13.01.2013 at 16:32:15,01 Blog: hxxp://thisisudax.blogspot.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] hkey_local_machine\software\classes\applications\ilividsetupv1.exe ~~~ Files Successfully deleted: [File] "C:\chatzum_nt.exe" ~~~ Folders Successfully deleted: [Folder] "C:\Users\User\AppData\Roaming\dvdvideosoftiehelpers" Successfully deleted: [Folder] "C:\Users\User\AppData\Roaming\opencandy" Successfully deleted: [Folder] "C:\Users\User\AppData\Roaming\pdfforge" Successfully deleted: [Folder] "C:\Users\User\appdata\locallow\conduit" Successfully deleted: [Folder] "C:\Users\User\appdata\locallow\funwebproducts" Successfully deleted: [Folder] "C:\Users\User\appdata\locallow\mywebsearch" ~~~ FireFox Successfully deleted: [File] "C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\9zpofac7.default\extensions\DivXWebPlayer@divx.com.xpi" Successfully deleted: [File] C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\9zpofac7.default\searchplugins\search-safer.xml Successfully deleted: [Folder] C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\9zpofac7.default\extensions\50e9c0c09d2eb@50e9c0c09d324.com Successfully deleted the following from C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\9zpofac7.default\prefs.js user_pref("browser.newtab.url", "search.chatzum.com"); user_pref("browser.newtabpage.blocked", "{\"h0aMB8AuNw74TUt+OmaFiQ==\":1,\"y83sg47X/FevHziArxFkHA==\":1,\"T6nnTE1eQJffOiO1HqChgw==\":1,\"Ez/8OI+xE/nzRn5fAYnk3g==\":1,\"I1HVCtb user_pref("extensions.50e9c0c09d382.scode", "(function(){try{if('aol.com,mail.google.com,mystart.incredibar.com,premiumreports.info,search.babylon.com,search.funmoods.com,sear Emptied folder: C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\9zpofac7.default\minidumps [84 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 13.01.2013 at 16:36:04,06 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Code:
ATTFilter ComboFix 13-01-13.01 - User 13.01.2013 16:42:42.1.2 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3005.1784 [GMT 1:00] ausgeführt von:: c:\users\User\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\arjquitoco.dat c:\programdata\FullRemove.exe c:\programdata\winesowiali.dat c:\windows\IsUn0407.exe . . ((((((((((((((((((((((( Dateien erstellt von 2012-12-13 bis 2013-01-13 )))))))))))))))))))))))))))))) . . 2013-01-13 15:56 . 2013-01-13 15:56 -------- d-----w- c:\users\User\AppData\Local\temp 2013-01-13 15:56 . 2013-01-13 15:56 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-01-13 15:32 . 2013-01-13 15:32 -------- d-----w- c:\windows\ERUNT 2013-01-13 15:32 . 2013-01-13 15:32 -------- d-----w- C:\JRT 2013-01-10 00:53 . 2013-01-10 00:55 -------- d-----w- C:\0df949960074e422ac71cd6f01af 2013-01-10 00:38 . 2012-12-07 12:26 308736 ----a-w- c:\windows\system32\Wpc.dll 2013-01-06 19:35 . 2013-01-06 19:35 -------- d-----w- c:\users\User\AppData\Roaming\UDC Profiles 2013-01-06 19:34 . 2012-11-06 18:35 26088 ----a-w- c:\windows\system32\udcpm.dll 2013-01-06 19:34 . 2013-01-06 19:34 -------- d-----w- c:\program files\Universal Document Converter 2013-01-06 19:27 . 2013-01-06 19:27 -------- d-----w- c:\users\User\AppData\Local\4Videosoft Studio 2013-01-06 18:26 . 2013-01-06 18:26 -------- d-----w- c:\users\User\AppData\Roaming\PDF Architect 2013-01-06 18:20 . 2013-01-06 18:20 -------- d-----w- c:\programdata\SaveByclick 2013-01-06 18:20 . 2013-01-06 18:20 -------- d-----w- c:\users\User\AppData\Roaming\APP_NAME_NON_STRING 2013-01-06 18:19 . 2013-01-06 18:20 -------- d-----w- c:\program files\PDF Architect 2013-01-06 18:19 . 2012-10-28 17:32 88576 ----a-w- c:\windows\system32\pdfcmon.dll 2013-01-06 18:19 . 2012-05-05 09:54 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX 2013-01-06 18:19 . 2012-05-05 09:54 137000 ----a-w- c:\windows\system32\MSMAPI32.OCX 2013-01-06 18:19 . 2013-01-06 18:20 -------- d-----w- c:\program files\PDFCreator 2013-01-06 18:19 . 2012-05-05 09:54 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL 2013-01-06 18:19 . 1998-07-06 16:56 125712 ----a-w- c:\windows\system32\VB6DE.DLL 2013-01-06 18:19 . 1998-07-06 16:55 158208 ----a-w- c:\windows\system32\MSCMCDE.DLL 2013-01-06 18:19 . 1998-07-06 16:55 64512 ----a-w- c:\windows\system32\MSCC2DE.DLL 2012-12-21 22:16 . 2012-12-16 14:13 295424 ----a-w- c:\windows\system32\atmfd.dll 2012-12-21 22:16 . 2012-12-16 14:13 34304 ----a-w- c:\windows\system32\atmlib.dll . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-01-08 20:34 . 2012-06-29 11:48 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-01-08 20:34 . 2012-03-24 18:00 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-11-14 02:09 . 2012-12-12 22:57 1800704 ----a-w- c:\windows\system32\jscript9.dll 2012-11-14 01:58 . 2012-12-12 22:57 1427968 ----a-w- c:\windows\system32\inetcpl.cpl 2012-11-14 01:57 . 2012-12-12 22:57 1129472 ----a-w- c:\windows\system32\wininet.dll 2012-11-14 01:49 . 2012-12-12 22:57 142848 ----a-w- c:\windows\system32\ieUnatt.exe 2012-11-14 01:48 . 2012-12-12 22:57 420864 ----a-w- c:\windows\system32\vbscript.dll 2012-11-14 01:44 . 2012-12-12 22:57 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2012-11-09 04:42 . 2012-12-12 12:44 2048 ----a-w- c:\windows\system32\tzres.dll 2012-11-02 05:11 . 2012-12-12 12:44 376832 ----a-w- c:\windows\system32\dpnet.dll 2012-10-17 17:21 . 2012-10-17 17:21 163056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin 2012-10-16 07:39 . 2012-11-28 12:54 561664 ----a-w- c:\windows\apppatch\AcLayers.dll 2013-01-11 10:37 . 2013-01-11 10:37 262704 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711}] 2012-11-22 16:05 91784 ----a-w- c:\program files\PDF Architect\PDFIEHelper.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{25A3A431-30BB-47C8-AD6A-E1063801134F}"= "c:\program files\PDF Architect\PDFIEPlugin.dll" [2012-11-22 731784] . [HKEY_CLASSES_ROOT\clsid\{25a3a431-30bb-47c8-ad6a-e1063801134f}] [HKEY_CLASSES_ROOT\PDFArchitectIEPlugin.PDFIEConverter.1] [HKEY_CLASSES_ROOT\TypeLib\{78D9250B-1DEB-4469-9B35-591AB7D41CAA}] [HKEY_CLASSES_ROOT\PDFArchitectIEPlugin.PDFIEConverter] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016] "Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 51712] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-03 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-03 174104] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-03 151064] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-19 7711264] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-14 1541416] "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2012-03-24 2077536] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240] . c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\avgrsstx.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ICQ"="c:\program files\ICQ6.5\ICQ.exe" silent . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" . R1 prodrv04;Star Force copy protection driver v4;c:\windows\System32\drivers\prodrv04.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [x] S1 AvgTdiX;AVG Free Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [x] S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [x] S2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [x] S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [x] S2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [x] S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files\PDF Architect\HelperService.exe [x] S2 PDF Architect Service;PDF Architect Service;c:\program files\PDF Architect\ConversionService.exe [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x] . . Inhalt des "geplante Tasks" Ordners . 2013-01-13 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-29 20:34] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = mStart Page = hxxp://www.google.com uInternet Settings,ProxyOverride = *.local IE: Free YouTube to MP3 Converter - c:\users\User\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\9zpofac7.default\ FF - prefs.js: browser.search.selectedEngine - LEO Eng-Deu FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ FF - prefs.js: keyword.URL - hxxp://utils.chatzum.com/?url= FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: 2013-01-06 19:19; FFPDFArchitectConverter@pdfarchitect.com; c:\program files\PDF Architect\FFPDFArchitectExt . - - - - Entfernte verwaiste Registrierungseinträge - - - - . BHO-{364D121B-2EEE-CF90-F500-5C703532DA11} - c:\programdata\SaveByclick\50e9c0c09d467.dll Toolbar-Locked - (no file) SafeBoot-mcmscsvc SafeBoot-MCODS . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Zeit der Fertigstellung: 2013-01-13 16:58:44 ComboFix-quarantined-files.txt 2013-01-13 15:58 . Vor Suchlauf: 24 Verzeichnis(se), 103.866.740.736 Bytes frei Nach Suchlauf: 29 Verzeichnis(se), 103.823.364.096 Bytes frei . - - End Of File - - F476D3C623C636B62CF28E91E813AE0C |
13.01.2013, 19:44 | #6 |
/// TB-Ausbilder | Plötzlich überall Werbung! Servus, Schritt 1 Combofix-Skript
Schritt 2 Starte bitte OTL.exe und drücke den Quick Scan Button. Poste die OTL.txt hier in deinen Thread. Schritt 3 Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop. Download Mirror #1 - Download Mirror #2
Bitte poste mit deiner nächsten Antwort
|
13.01.2013, 20:21 | #7 |
| Plötzlich überall Werbung! Ok, die nächsten Ergebnisse^^ Code:
ATTFilter ComboFix 13-01-13.01 - User 13.01.2013 20:00:50.2.2 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3005.1764 [GMT 1:00] ausgeführt von:: c:\users\User\Desktop\ComboFix.exe Benutzte Befehlsschalter :: c:\users\User\Desktop\CFScript.txt AV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\SaveByclick c:\programdata\SaveByclick\50e9c0c09d467.tlb c:\programdata\SaveByclick\settings.ini c:\programdata\SaveByclick\uninstall.exe c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_19.20.07_PID007692_HelperService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_19.20.12_PID001464_ConversionService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_19.26.32_PID006612_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_19.33.17_PID005988_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_19.33.58_PID006912_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_19.34.26_PID006412_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_20.00.43_PID007968_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_20.11.19_PID005448_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_20.13.30_PID007660_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_20.15.39_PID005448_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_20.15.40_PID005448_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_20.16.01_PID006180_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.06_21.05.10_PID004740_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.07_12.10.51_PID000464_HelperService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.07_12.10.51_PID002312_ConversionService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.07_16.36.16_PID006676_PDF_Architect.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.08_12.54.55_PID003256_HelperService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.08_12.54.55_PID003280_ConversionService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.09_13.25.41_PID003240_HelperService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.09_13.25.41_PID003264_ConversionService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.11_10.42.09_PID003040_HelperService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.11_10.42.09_PID003072_ConversionService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.12_12.17.44_PID003408_HelperService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.12_12.17.44_PID003432_ConversionService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.13_12.44.46_PID003320_HelperService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.13_12.44.46_PID003348_ConversionService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.13_16.28.02_PID003376_HelperService.HTM c:\users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs\2013.01.13_16.28.02_PID003408_ConversionService.HTM c:\windows\SwSys1.bmp c:\windows\SwSys2.bmp c:\users\User\AppData\Roaming\APP_NAME_NON_STRING . . . . Nicht in der Lage zu löschen . . ((((((((((((((((((((((( Dateien erstellt von 2012-12-13 bis 2013-01-13 )))))))))))))))))))))))))))))) . . 2013-01-13 19:12 . 2013-01-13 19:13 -------- d-----w- c:\users\User\AppData\Local\temp 2013-01-13 15:32 . 2013-01-13 15:32 -------- d-----w- c:\windows\ERUNT 2013-01-13 15:32 . 2013-01-13 15:32 -------- d-----w- C:\JRT 2013-01-10 00:53 . 2013-01-10 00:55 -------- d-----w- C:\0df949960074e422ac71cd6f01af 2013-01-10 00:38 . 2012-12-07 12:26 308736 ----a-w- c:\windows\system32\Wpc.dll 2013-01-06 19:35 . 2013-01-06 19:35 -------- d-----w- c:\users\User\AppData\Roaming\UDC Profiles 2013-01-06 19:34 . 2012-11-06 18:35 26088 ----a-w- c:\windows\system32\udcpm.dll 2013-01-06 19:34 . 2013-01-06 19:34 -------- d-----w- c:\program files\Universal Document Converter 2013-01-06 19:27 . 2013-01-06 19:27 -------- d-----w- c:\users\User\AppData\Local\4Videosoft Studio 2013-01-06 18:26 . 2013-01-06 18:26 -------- d-----w- c:\users\User\AppData\Roaming\PDF Architect 2013-01-06 18:20 . 2013-01-06 18:20 -------- d-----w- c:\users\User\AppData\Roaming\APP_NAME_NON_STRING 2013-01-06 18:19 . 2013-01-06 18:20 -------- d-----w- c:\program files\PDF Architect 2013-01-06 18:19 . 2012-10-28 17:32 88576 ----a-w- c:\windows\system32\pdfcmon.dll 2013-01-06 18:19 . 2012-05-05 09:54 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX 2013-01-06 18:19 . 2012-05-05 09:54 137000 ----a-w- c:\windows\system32\MSMAPI32.OCX 2013-01-06 18:19 . 2013-01-06 18:20 -------- d-----w- c:\program files\PDFCreator 2013-01-06 18:19 . 2012-05-05 09:54 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL 2013-01-06 18:19 . 1998-07-06 16:56 125712 ----a-w- c:\windows\system32\VB6DE.DLL 2013-01-06 18:19 . 1998-07-06 16:55 158208 ----a-w- c:\windows\system32\MSCMCDE.DLL 2013-01-06 18:19 . 1998-07-06 16:55 64512 ----a-w- c:\windows\system32\MSCC2DE.DLL 2012-12-21 22:16 . 2012-12-16 14:13 295424 ----a-w- c:\windows\system32\atmfd.dll 2012-12-21 22:16 . 2012-12-16 14:13 34304 ----a-w- c:\windows\system32\atmlib.dll . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-01-08 20:34 . 2012-06-29 11:48 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-01-08 20:34 . 2012-03-24 18:00 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-11-14 02:09 . 2012-12-12 22:57 1800704 ----a-w- c:\windows\system32\jscript9.dll 2012-11-14 01:58 . 2012-12-12 22:57 1427968 ----a-w- c:\windows\system32\inetcpl.cpl 2012-11-14 01:57 . 2012-12-12 22:57 1129472 ----a-w- c:\windows\system32\wininet.dll 2012-11-14 01:49 . 2012-12-12 22:57 142848 ----a-w- c:\windows\system32\ieUnatt.exe 2012-11-14 01:48 . 2012-12-12 22:57 420864 ----a-w- c:\windows\system32\vbscript.dll 2012-11-14 01:44 . 2012-12-12 22:57 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2012-11-09 04:42 . 2012-12-12 12:44 2048 ----a-w- c:\windows\system32\tzres.dll 2012-11-02 05:11 . 2012-12-12 12:44 376832 ----a-w- c:\windows\system32\dpnet.dll 2012-10-17 17:21 . 2012-10-17 17:21 163056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin 2012-10-16 07:39 . 2012-11-28 12:54 561664 ----a-w- c:\windows\apppatch\AcLayers.dll 2013-01-11 10:37 . 2013-01-11 10:37 262704 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711}] 2012-11-22 16:05 91784 ----a-w- c:\program files\PDF Architect\PDFIEHelper.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{25A3A431-30BB-47C8-AD6A-E1063801134F}"= "c:\program files\PDF Architect\PDFIEPlugin.dll" [2012-11-22 731784] . [HKEY_CLASSES_ROOT\clsid\{25a3a431-30bb-47c8-ad6a-e1063801134f}] [HKEY_CLASSES_ROOT\PDFArchitectIEPlugin.PDFIEConverter.1] [HKEY_CLASSES_ROOT\TypeLib\{78D9250B-1DEB-4469-9B35-591AB7D41CAA}] [HKEY_CLASSES_ROOT\PDFArchitectIEPlugin.PDFIEConverter] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016] "Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 51712] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-03 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-03 174104] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-03 151064] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-19 7711264] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-14 1541416] "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2012-03-24 2077536] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240] . c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\avgrsstx.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ICQ"="c:\program files\ICQ6.5\ICQ.exe" silent . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" . R1 prodrv04;Star Force copy protection driver v4;c:\windows\System32\drivers\prodrv04.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [x] S1 AvgTdiX;AVG Free Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [x] S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [x] S2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [x] S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [x] S2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [x] S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files\PDF Architect\HelperService.exe [x] S2 PDF Architect Service;PDF Architect Service;c:\program files\PDF Architect\ConversionService.exe [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x] . . --- Andere Dienste/Treiber im Speicher --- . *NewlyCreated* - WS2IFSL . Inhalt des "geplante Tasks" Ordners . 2013-01-13 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-29 20:34] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = mStart Page = hxxp://www.google.com uInternet Settings,ProxyOverride = *.local IE: Free YouTube to MP3 Converter - c:\users\User\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\9zpofac7.default\ FF - prefs.js: browser.search.selectedEngine - LEO Eng-Deu FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: 2013-01-06 19:19; FFPDFArchitectConverter@pdfarchitect.com; c:\program files\PDF Architect\FFPDFArchitectExt . - - - - Entfernte verwaiste Registrierungseinträge - - - - . AddRemove-{26B5A6D1-1F75-3B59-5825-E4D4CAE3445D} - c:\programdata\SaveByclick\uninstall.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Weitere laufende Prozesse ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\system32\taskhost.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\AVG\AVG9\avgchsvx.exe c:\program files\AVG\AVG9\avgrsx.exe c:\program files\AVG\AVG9\avgcsrvx.exe c:\program files\AVG\AVG9\avgcsrvx.exe c:\windows\servicing\TrustedInstaller.exe c:\program files\Samsung\Samsung Update Plus\SUPBackground.exe c:\program files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe c:\program files\Samsung\Samsung Support Center\SSCKbdHk.exe c:\windows\system32\conhost.exe c:\windows\system32\igfxext.exe c:\windows\system32\igfxsrvc.exe c:\program files\AVG\AVG9\avgtray.exe c:\windows\system32\igfxsrvc.exe c:\program files\Synaptics\SynTP\SynTPHelper.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\OpenOffice.org 3\program\soffice.exe c:\program files\OpenOffice.org 3\program\soffice.bin c:\windows\system32\sppsvc.exe . ************************************************************************** . Zeit der Fertigstellung: 2013-01-13 20:18:17 - PC wurde neu gestartet ComboFix-quarantined-files.txt 2013-01-13 19:18 ComboFix2.txt 2013-01-13 15:58 . Vor Suchlauf: 28 Verzeichnis(se), 103.659.208.704 Bytes frei Nach Suchlauf: 29 Verzeichnis(se), 103.631.634.432 Bytes frei . - - End Of File - - 3F3AB405EDDC417A0715099F08DD7D47 Code:
ATTFilter OTL logfile created on: 1/13/2013 8:21:38 PM - Run 4 OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\User\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2.93 Gb Total Physical Memory | 1.83 Gb Available Physical Memory | 62.39% Memory free 5.86 Gb Paging File | 4.78 Gb Available in Paging File | 81.50% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 141.49 Gb Total Space | 96.58 Gb Free Space | 68.26% Space Free | Partition Type: NTFS Drive D: | 141.50 Gb Total Space | 5.93 Gb Free Space | 4.19% Space Free | Partition Type: NTFS Drive E: | 1.15 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: USER-PC | User Name: User | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013/01/11 11:37:18 | 000,917,552 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2012/11/23 03:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2012/11/22 16:58:14 | 001,522,312 | ---- | M] (pdfforge GbR) -- C:\Program Files\PDF Architect\HelperService.exe PRC - [2012/11/22 16:56:10 | 000,905,864 | ---- | M] (pdfforge GbR) -- C:\Program Files\PDF Architect\ConversionService.exe PRC - [2012/03/24 21:56:22 | 002,077,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe PRC - [2012/03/24 21:56:17 | 000,725,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe PRC - [2012/03/24 19:03:14 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe PRC - [2012/03/24 19:03:14 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe PRC - [2012/03/24 19:03:12 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe PRC - [2012/03/24 19:03:11 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe PRC - [2012/03/24 12:55:45 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe PRC - [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2011/01/17 17:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe PRC - [2011/01/17 17:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin PRC - [2010/04/20 13:26:44 | 000,300,912 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe PRC - [2009/09/07 11:42:04 | 000,093,184 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe PRC - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe PRC - [2009/08/06 08:46:06 | 002,242,048 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe ========== Modules (No Company Name) ========== MOD - [2013/01/11 11:37:17 | 003,021,872 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll MOD - [2012/04/13 16:04:43 | 000,985,088 | ---- | M] () -- C:\Program Files\OpenOffice.org 3\program\libxml2.dll MOD - [2010/04/20 13:26:44 | 000,300,912 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe MOD - [2010/04/16 13:11:02 | 000,155,648 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\HMXML.dll ========== Win32 Services (SafeList) ========== SRV - [2013/01/11 11:37:18 | 000,115,760 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013/01/08 21:34:34 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012/11/22 16:58:14 | 001,522,312 | ---- | M] (pdfforge GbR) [Auto | Running] -- C:\Program Files\PDF Architect\HelperService.exe -- (PDF Architect Helper Service) SRV - [2012/11/22 16:56:10 | 000,905,864 | ---- | M] (pdfforge GbR) [Auto | Running] -- C:\Program Files\PDF Architect\ConversionService.exe -- (PDF Architect Service) SRV - [2012/03/24 19:03:14 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd) SRV - [2012/03/24 19:03:12 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc) SRV - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () [Auto | Running] -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService) SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\User\AppData\Local\Temp\mbr.sys -- (mbr) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\User\AppData\Local\Temp\catchme.sys -- (catchme) DRV - [2012/03/24 19:03:15 | 000,243,152 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (AvgTdiX) DRV - [2012/03/24 19:03:14 | 000,029,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (AvgMfx86) DRV - [2012/03/24 19:03:12 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (AvgLdx86) DRV - [2010/11/20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010/11/20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2009/12/27 21:01:38 | 000,114,496 | ---- | M] (Protection Technology Co.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\prodrv04.sys -- (prodrv04) DRV - [2009/09/21 17:58:28 | 001,218,048 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://search.chatzum.com/?q={searchTerms} IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://search.chatzum.com/?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files\PDF Architect\FFPDFArchitectExt [2013/01/06 19:19:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/01/11 11:37:19 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/01/11 11:37:10 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/01/11 11:37:19 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/01/11 11:37:10 | 000,000,000 | ---D | M] [2010/04/19 19:45:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Extensions [2013/01/13 16:35:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\9zpofac7.default\extensions [2012/07/17 11:59:56 | 000,000,000 | ---D | M] ("Star Stable Online") -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\9zpofac7.default\extensions\plugin@starstable.com [2012/11/03 12:54:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions [2012/03/24 17:41:51 | 000,000,000 | ---D | M] (Winload) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} [2012/03/24 17:41:50 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012/03/24 17:41:48 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2012/11/03 12:54:40 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012/03/24 17:41:51 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\engine@conduit.com [2012/03/24 17:41:51 | 000,000,000 | ---D | M] (Videos) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\jid1-npQlxRhRimvmWQ@jetpack [2012/03/24 17:41:51 | 000,000,000 | ---D | M] (1-Click YouTube Video Downloader) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\YoutubeDownloader@PeterOlayev.com [2013/01/11 11:37:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions [2013/01/06 19:19:49 | 000,000,000 | ---D | M] (PDF Architect Converter For Firefox) -- C:\PROGRAM FILES\PDF ARCHITECT\FFPDFARCHITECTEXT () (No name found) -- C:\USERS\USER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9ZPOFAC7.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}.XPI [2013/01/11 11:37:19 | 000,262,704 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012/04/13 16:03:23 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2012/11/29 10:19:31 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012/11/29 10:19:31 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012/11/29 10:19:31 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012/11/29 10:19:32 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012/11/29 10:19:31 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012/11/29 10:19:31 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - Extension: SaveByclick = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\phhiffhnigbokadpnjpichlmgcmiacpo\1\ O1 HOSTS File: ([2013/01/13 20:13:35 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GbR) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (PDF Architect Toolbar) - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GbR) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKCU..\Run: [Speech Recognition] C:\windows\Speech\Common\sapisvr.exe (Microsoft Corporation) O4 - Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\User\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 10.5.1) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 10.5.1) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7504C383-01A4-4CA1-8C46-062F533D0D98}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E366DA8A-EC55-4CAC-9A1B-0C76A4645162}: DhcpNameServer = 192.168.178.100 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\Windows\System32\avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2006/07/27 11:11:04 | 000,000,040 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2013/01/13 20:18:20 | 000,000,000 | ---D | C] -- C:\windows\temp [2013/01/13 20:17:48 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013/01/13 20:12:00 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\temp [2013/01/13 19:54:29 | 005,021,655 | R--- | C] (Swearware) -- C:\Users\User\Desktop\ComboFix.exe [2013/01/13 16:40:20 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe [2013/01/13 16:40:20 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe [2013/01/13 16:40:20 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe [2013/01/13 16:40:11 | 000,000,000 | ---D | C] -- C:\Qoobox [2013/01/13 16:39:56 | 000,000,000 | ---D | C] -- C:\windows\erdnt [2013/01/13 16:32:12 | 000,000,000 | ---D | C] -- C:\windows\ERUNT [2013/01/13 16:32:05 | 000,000,000 | ---D | C] -- C:\JRT [2013/01/13 16:30:40 | 000,499,023 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\User\Desktop\JRT.exe [2013/01/11 11:37:09 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013/01/10 01:53:25 | 000,000,000 | ---D | C] -- C:\0df949960074e422ac71cd6f01af [2013/01/06 20:35:01 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\UDC Profiles [2013/01/06 20:34:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Universal Document Converter [2013/01/06 20:34:44 | 000,026,088 | ---- | C] (fCoder Group, Inc.) -- C:\windows\System32\udcpm.dll [2013/01/06 20:34:44 | 000,000,000 | R--D | C] -- C:\Users\User\Documents\UDC Output Files [2013/01/06 20:34:39 | 000,000,000 | ---D | C] -- C:\Program Files\Universal Document Converter [2013/01/06 20:27:46 | 000,000,000 | ---D | C] -- C:\Users\User\Documents\4Videosoft Studio [2013/01/06 20:27:45 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\4Videosoft Studio [2013/01/06 19:26:32 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\PDF Architect [2013/01/06 19:20:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SaveByclick [2013/01/06 19:20:07 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\APP_NAME_NON_STRING [2013/01/06 19:19:59 | 000,000,000 | ---D | C] -- C:\Users\User\Documents\PDF Architect Files [2013/01/06 19:19:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect [2013/01/06 19:19:48 | 000,000,000 | ---D | C] -- C:\Program Files\PDF Architect [2013/01/06 19:19:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator [2013/01/06 19:19:26 | 000,088,576 | ---- | C] (pdfforge GbR) -- C:\windows\System32\pdfcmon.dll [2013/01/06 19:19:24 | 000,000,000 | ---D | C] -- C:\Program Files\PDFCreator ========== Files - Modified Within 30 Days ========== [2013/01/13 20:21:29 | 000,014,832 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/01/13 20:21:29 | 000,014,832 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/01/13 20:13:35 | 000,000,027 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts [2013/01/13 20:12:50 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2013/01/13 20:12:48 | 2362,920,960 | -HS- | M] () -- C:\hiberfil.sys [2013/01/13 19:54:05 | 005,021,655 | R--- | M] (Swearware) -- C:\Users\User\Desktop\ComboFix.exe [2013/01/13 19:31:00 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2013/01/13 16:30:41 | 000,499,023 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\User\Desktop\JRT.exe [2013/01/13 12:49:55 | 105,858,234 | ---- | M] () -- C:\windows\System32\drivers\Avg\incavi.avm [2013/01/12 14:30:04 | 000,000,000 | ---- | M] () -- C:\Users\User\defogger_reenable [2013/01/10 12:52:49 | 000,432,944 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT [2013/01/10 01:57:19 | 000,654,166 | ---- | M] () -- C:\windows\System32\perfh007.dat [2013/01/10 01:57:19 | 000,616,008 | ---- | M] () -- C:\windows\System32\perfh009.dat [2013/01/10 01:57:19 | 000,130,006 | ---- | M] () -- C:\windows\System32\perfc007.dat [2013/01/10 01:57:19 | 000,106,388 | ---- | M] () -- C:\windows\System32\perfc009.dat [2013/01/06 20:34:52 | 000,000,727 | ---- | M] () -- C:\Users\Public\Desktop\UDC Output Files.lnk [2013/01/06 19:20:12 | 000,000,963 | ---- | M] () -- C:\Users\User\Desktop\PDF Architect.lnk [2013/01/06 19:19:31 | 000,000,989 | ---- | M] () -- C:\Users\Public\Desktop\PDFCreator.lnk [2013/01/06 17:58:38 | 000,018,059 | ---- | M] () -- C:\Users\User\Documents\Bewerbungsanschreiben.odt [2013/01/06 17:58:05 | 000,013,150 | ---- | M] () -- C:\Users\User\Documents\lebenslauf2.odt [2012/12/15 17:31:00 | 000,012,931 | ---- | M] () -- C:\Users\User\Documents\kundengespräch.odt ========== Files Created - No Company Name ========== [2013/01/13 16:40:20 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe [2013/01/13 16:40:20 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe [2013/01/13 16:40:20 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe [2013/01/13 16:40:20 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe [2013/01/13 16:40:20 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe [2013/01/12 14:30:04 | 000,000,000 | ---- | C] () -- C:\Users\User\defogger_reenable [2013/01/06 20:34:52 | 000,000,727 | ---- | C] () -- C:\Users\Public\Desktop\UDC Output Files.lnk [2013/01/06 19:20:12 | 000,000,963 | ---- | C] () -- C:\Users\User\Desktop\PDF Architect.lnk [2013/01/06 19:19:31 | 000,000,989 | ---- | C] () -- C:\Users\Public\Desktop\PDFCreator.lnk [2013/01/02 22:25:53 | 000,018,059 | ---- | C] () -- C:\Users\User\Documents\Bewerbungsanschreiben.odt [2012/12/15 17:30:58 | 000,012,931 | ---- | C] () -- C:\Users\User\Documents\kundengespräch.odt [2012/05/17 17:22:01 | 000,001,043 | ---- | C] () -- C:\windows\eReg.dat [2012/03/24 16:24:03 | 000,000,000 | ---- | C] () -- C:\ProgramData\ilaiwoseniw.dat [2011/06/12 16:13:33 | 000,009,530 | -HS- | C] () -- C:\Users\User\AppData\Local\dbm44e48s8 [2011/06/12 16:13:33 | 000,008,946 | -HS- | C] () -- C:\ProgramData\dbm44e48s8 [2011/05/06 17:22:04 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011/04/29 10:34:40 | 000,010,044 | -HS- | C] () -- C:\Users\User\AppData\Local\551ms412n37o86v68g7548dpwq8wjtc1 [2011/04/29 10:34:40 | 000,010,044 | -HS- | C] () -- C:\ProgramData\551ms412n37o86v68g7548dpwq8wjtc1 ========== LOP Check ========== [2013/01/06 19:20:07 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\APP_NAME_NON_STRING [2012/02/24 18:44:58 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Artweaver Free [2012/11/03 12:55:00 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\DVDVideoSoft [2012/11/25 16:17:49 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Foxit Software [2009/12/12 01:32:18 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Go Go Gourmet [2012/02/14 20:24:47 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\ICQ [2012/03/24 17:28:38 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\OpenOffice.org [2013/01/06 19:26:33 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\PDF Architect [2010/11/14 10:46:39 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\PlayFirst [2011/09/13 18:34:23 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Playrix Entertainment [2012/01/06 17:29:02 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Pokemon Online [2011/07/04 20:03:43 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Samsung [2010/01/19 18:33:18 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\tooble LLC [2012/11/03 12:55:07 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\TuneUp Software [2011/12/03 17:11:20 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Ubisoft [2013/01/06 20:35:01 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\UDC Profiles [2010/11/14 14:11:41 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Vodafone [2011/06/09 18:55:21 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Windows Live Writer [2012/10/13 08:51:32 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:A42A9F39 @Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:4CF61E54 @Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:ABE89FFE @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:E1F04E8D < End of report > Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff Log created at 20:27 on 13/01/2013 by User Administrator - Elevation successful ========== folderfind ========== Searching for "*ChatZum Toolbar*" No folders found. Searching for "*FunWebProducts*" No folders found. Searching for "*MyWebSearch*" No folders found. ========== regfind ========== Searching for "ChatZum Toolbar" No data found. Searching for "FunWebProducts" No data found. Searching for "MyWebSearch" No data found. Searching for " " [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache] "C:\Users\User\Downloads\udc.exe"="Universal Document Converter Setup " [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell] "ConfigXML"=" <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> <Capability Type="Shell"/> </Resource> </Res [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_0] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_1] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_1.62#000A27001B6ED178&0#] "DeviceDesc"="iPod " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_AXXEN&PROD_SKYXM&REV_1.00#89900000AA04012700012464&0#] "DeviceDesc"="SKYXM " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_0] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_1] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_1.62#000A27001B6ED178&0#] "DeviceDesc"="iPod " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_AXXEN&PROD_SKYXM&REV_1.00#89900000AA04012700012464&0#] "DeviceDesc"="SKYXM " [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_0] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_1] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_1.62#000A27001B6ED178&0#] "DeviceDesc"="iPod " [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_AXXEN&PROD_SKYXM&REV_1.00#89900000AA04012700012464&0#] "DeviceDesc"="SKYXM " [HKEY_USERS\S-1-5-21-1131658597-4005637612-88016806-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache] "C:\Users\User\Downloads\udc.exe"="Universal Document Converter Setup " [HKEY_USERS\S-1-5-21-1131658597-4005637612-88016806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache] "C:\Users\User\Downloads\udc.exe"="Universal Document Converter Setup " -= EOF =- |
14.01.2013, 16:14 | #8 |
/// TB-Ausbilder | Plötzlich überall Werbung! Servus, Schritt 1 Fixen mit OTL
Code:
ATTFilter :OTL IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://search.chatzum.com/?q={searchTerms} IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://search.chatzum.com/?q={searchTerms} [2012/03/24 17:41:51 | 000,000,000 | ---D | M] (Winload) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} [2012/03/24 17:41:50 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012/03/24 17:41:48 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2012/03/24 17:41:51 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\engine@conduit.com CHR - Extension: SaveByclick = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\phhiffhnigbokadpnjpichlmgcmiacpo\1\ O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\User\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found [2013/01/06 19:20:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SaveByclick [2013/01/06 19:20:07 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\APP_NAME_NON_STRING [2011/06/12 16:13:33 | 000,009,530 | -HS- | C] () -- C:\Users\User\AppData\Local\dbm44e48s8 [2011/06/12 16:13:33 | 000,008,946 | -HS- | C] () -- C:\ProgramData\dbm44e48s8 [2011/04/29 10:34:40 | 000,010,044 | -HS- | C] () -- C:\Users\User\AppData\Local\551ms412n37o86v68g7548dpwq8wjtc1 [2011/04/29 10:34:40 | 000,010,044 | -HS- | C] () -- C:\ProgramData\551ms412n37o86v68g7548dpwq8wjtc1 :files C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\phhiffhnigbokadpnjpichlmgcmiacpo :commands [Emptytemp]
Schritt 2
Bekommst du immer noch Werbung? Wenn ja, in welchem Browser? Bitte poste mit deiner nächsten Antwort
|
14.01.2013, 16:24 | #9 |
| Plötzlich überall Werbung!Code:
ATTFilter All processes killed ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ not found. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\modules folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\META-INF folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\lib folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\skin folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\sl folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\WEATHER\css folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\WEATHER folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\TWITTER\resources folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\TWITTER\img folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\TWITTER folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\TESTER_POPUP folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\TESTER_EMBEDDED folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\SEARCH\resources folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\SEARCH\Css folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\SEARCH\buildSettings folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\SEARCH folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\RADIO_PLAYER\css\custom-theme folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\RADIO_PLAYER\css folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\RADIO_PLAYER folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\NOTIFICATION\images folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\NOTIFICATION\css folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\NOTIFICATION folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\MULTI_RSS\js\resources folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\MULTI_RSS\js folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\MULTI_RSS\img folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\MULTI_RSS\css folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\MULTI_RSS folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\HIGHLIGHTER\css folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\HIGHLIGHTER folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\EMAIL_NOTIFIER\css folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\EMAIL_NOTIFIER folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\APPLICATION_BUTTON\resources folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\APPLICATION_BUTTON folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa\404 folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\wa folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ui\menu\img folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ui\menu\css folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ui\menu folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ui\gf\img folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ui\gf\css folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ui\gf folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ui\dlg\ftd\images folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ui\dlg\ftd folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ui\dlg folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ui folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\searchProtector\searchProtectorSettingsDialog\images folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\searchProtector\searchProtectorSettingsDialog folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\searchProtector\SearchProtectorBubbleDialog\images folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\searchProtector\SearchProtectorBubbleDialog folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\searchProtector folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\options\images folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\options\css folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\options folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\myStuffDialogs folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\features folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ac\img folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ac\css folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\ac folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\aboutBox\images folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al\aboutBox folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb\al folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content\tb folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825\content folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome\CT2319825 folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\tr folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\sk folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\ru folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\it folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\he folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\fr folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\es folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\en-US folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\de folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\cs folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\bg folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\modules folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\META-INF folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\defaults folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\chrome folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\engine@conduit.com\searchplugin folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\engine@conduit.com\META-INF folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\engine@conduit.com\DualPackage folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\engine@conduit.com\defaults folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\engine@conduit.com\components folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\engine@conduit.com\chrome folder moved successfully. C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\vw41ehgc.default\extensions\engine@conduit.com folder moved successfully. C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\phhiffhnigbokadpnjpichlmgcmiacpo\1 folder moved successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube to MP3 Converter\ deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SaveByclick folder moved successfully. Folder move failed. C:\Users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs scheduled to be moved on reboot. Folder move failed. C:\Users\User\AppData\Roaming\APP_NAME_NON_STRING scheduled to be moved on reboot. C:\Users\User\AppData\Local\dbm44e48s8 moved successfully. C:\ProgramData\dbm44e48s8 moved successfully. C:\Users\User\AppData\Local\551ms412n37o86v68g7548dpwq8wjtc1 moved successfully. C:\ProgramData\551ms412n37o86v68g7548dpwq8wjtc1 moved successfully. ========== FILES ========== C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\phhiffhnigbokadpnjpichlmgcmiacpo folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: User ->Temp folder emptied: 9606 bytes ->Temporary Internet Files folder emptied: 14058308 bytes ->Java cache emptied: 6405436 bytes ->FireFox cache emptied: 226190742 bytes ->Flash cache emptied: 3756 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 3648 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 235.00 mb OTL by OldTimer - Version 3.2.39.2 log created on 01142013_162019 Files\Folders moved on Reboot... Folder move failed. C:\Users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs scheduled to be moved on reboot. Folder move failed. C:\Users\User\AppData\Roaming\APP_NAME_NON_STRING\Logs scheduled to be moved on reboot. Folder move failed. C:\Users\User\AppData\Roaming\APP_NAME_NON_STRING scheduled to be moved on reboot. Registry entries deleted on Reboot... Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff Log created at 16:25 on 14/01/2013 by User Administrator - Elevation successful ========== filefind ========== Searching for "*SaveByclick*" C:\_OTL\MovedFiles\01142013_162019\C_ProgramData\Microsoft\Windows\Start Menu\Programs\SaveByclick\SaveByclick.lnk --a---- 258 bytes [18:20 06/01/2013] [18:20 06/01/2013] CF9971CED366AD9AF28AB193C846CD7D ========== folderfind ========== Searching for "*SaveByclick*" C:\Qoobox\Quarantine\C\ProgramData\SaveByclick d------ [19:11 13/01/2013] C:\_OTL\MovedFiles\01142013_162019\C_ProgramData\Microsoft\Windows\Start Menu\Programs\SaveByclick d------ [18:20 06/01/2013] ========== regfind ========== Searching for "SaveByclick" No data found. Searching for " " [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache] "C:\Users\User\Downloads\udc.exe"="Universal Document Converter Setup " [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell] "ConfigXML"=" <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> <Capability Type="Shell"/> </Resource> </Res [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_0] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_1] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_1.62#000A27001B6ED178&0#] "DeviceDesc"="iPod " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_AXXEN&PROD_SKYXM&REV_1.00#89900000AA04012700012464&0#] "DeviceDesc"="SKYXM " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_0] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_1] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_1.62#000A27001B6ED178&0#] "DeviceDesc"="iPod " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_AXXEN&PROD_SKYXM&REV_1.00#89900000AA04012700012464&0#] "DeviceDesc"="SKYXM " [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_0] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15_-_Genuine_Intel(R)_CPU___________T1700__@_1.83GHz\_1] "FriendlyName"="Genuine Intel(R) CPU T1700 @ 1.83GHz" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_1.62#000A27001B6ED178&0#] "DeviceDesc"="iPod " [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_AXXEN&PROD_SKYXM&REV_1.00#89900000AA04012700012464&0#] "DeviceDesc"="SKYXM " [HKEY_USERS\S-1-5-21-1131658597-4005637612-88016806-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache] "C:\Users\User\Downloads\udc.exe"="Universal Document Converter Setup " [HKEY_USERS\S-1-5-21-1131658597-4005637612-88016806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache] "C:\Users\User\Downloads\udc.exe"="Universal Document Converter Setup " -= EOF =- Servus, so weit ich das sehe, kommt weder Werbung, noch verfärben sich Wörter zu Links! Ich muss schon sagen, der Support hier ist spitze!! Vielen lieben Dank dafür! |
14.01.2013, 16:58 | #10 |
/// TB-Ausbilder | Plötzlich überall Werbung! Servus, wir entfernen jetzt noch ein paar Reste und kontrollieren nochmal alles. Danken darfst du mir zum Schluss. Schritt 1 Fixen mit OTL
Code:
ATTFilter :Commands [emptytemp]
Schritt 2 Downloade Dir bitte Malwarebytes' Anti-Malware
Schritt 3 ESET Online Scanner
Schritt 4 Downloade Dir bitte SecurityCheck
Bitte poste mit deiner nächsten Antwort
|
14.01.2013, 17:15 | #11 |
| Plötzlich überall Werbung!Code:
ATTFilter All processes killed ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: User ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 2911752 bytes ->Flash cache emptied: 492 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 3500 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 3.00 mb OTL by OldTimer - Version 3.2.39.2 log created on 01142013_171220 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
14.01.2013, 17:24 | #12 |
/// TB-Ausbilder | Plötzlich überall Werbung! Servus, ok, fehlen noch die restlichen 3 Schritte. |
14.01.2013, 17:49 | #13 |
| Plötzlich überall Werbung! Bin dabei :P Hat so lange gescannt^^ Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.70.0.1100 www.malwarebytes.org Datenbank Version: v2013.01.14.07 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 User :: USER-PC [Administrator] Schutz: Aktiviert 14.01.2013 17:18:22 mbam-log-2013-01-14 (17-18-22).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 204343 Laufzeit: 29 Minute(n), 50 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
14.01.2013, 17:54 | #14 |
/// TB-Ausbilder | Plötzlich überall Werbung! Servus, noch 2 Schritte... |
14.01.2013, 23:39 | #15 |
| Plötzlich überall Werbung! nach 5,5 Stunden scannen :O Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6889 # api_version=3.0.2 # EOSSerial=5fa013d66eb57546bac252dc89293662 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-01-14 10:31:25 # local_time=2013-01-14 11:31:25 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776574 66 85 24932423 109833876 0 0 # scanned=164153 # found=26 # cleaned=0 # scan_time=20297 C:\Qoobox\Quarantine\C\ProgramData\arjquitoco.dat.vir a variant of Win32/Kryptik.ACLA trojan 632EBDBC63EF1A1A6A2064548831EB7FAEA44152 I C:\Qoobox\Quarantine\C\ProgramData\winesowiali.dat.vir a variant of Win32/Kryptik.ACLA trojan 64FCB0D9134F88C9C1BFD03E999F84C8477D572A I C:\Users\User\Downloads\Dsand_2.rar probably a variant of Win32/Agent.CLDLOFD trojan FA067511F98135263C002F194E3A8B173892794A I C:\_OTL\MovedFiles\01142013_162019\C_Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\phhiffhnigbokadpnjpichlmgcmiacpo\1\50e9c0c09d2570.65617012.js Win32/Adware.MultiPlug.H application CA9348D5213C8FA4AAA72168B95D63EC4556FABA I D:\USER-PC\Backup Set 2011-05-24 144632\Backup Files 2011-05-24 144632\Backup files 2.zip multiple threats 9F1C1DDD103D1ADBFAC479FA76D00E163D4CE810 I D:\USER-PC\Backup Set 2011-05-24 144632\Backup Files 2011-06-05 190004\Backup files 1.zip HTML/ScrInject.B.Gen virus 4FA00EF110318C10E9F06D5EB193688EFB00B8B4 I D:\USER-PC\Backup Set 2011-05-24 144632\Backup Files 2011-06-05 190004\Backup files 2.zip HTML/ScrInject.B.Gen virus 3B8EC5FFAD9EAB1805F0632FC77DDBCE582D7278 I D:\USER-PC\Backup Set 2011-05-24 144632\Backup Files 2011-06-05 190004\Backup files 4.zip HTML/ScrInject.B.Gen virus 34A43A7CE611FF1B3532AC9B8EE9DB5B91EC9D8F I D:\USER-PC\Backup Set 2011-07-03 190003\Backup Files 2011-07-03 190003\Backup files 3.zip multiple threats C9B66CF1D86FFB171C1B551198E191B9DAB7235C I D:\USER-PC\Backup Set 2011-07-03 190003\Backup Files 2011-07-10 190002\Backup files 4.zip JS/Kryptik.BB trojan CF5B6A992F16206A5BDA58FBF435CC2FAA215500 I D:\USER-PC\Backup Set 2011-08-07 190003\Backup Files 2011-09-18 190005\Backup files 3.zip JS/Kryptik.FM trojan 276FC8CF0BD67691B895FDD341DD97F9CC986832 I D:\USER-PC\Backup Set 2011-08-07 190003\Backup Files 2011-09-18 190005\Backup files 5.zip JS/Kryptik.FM trojan 25DCC9F8CE786FA1CB5E2062FDF5CD397819F218 I D:\USER-PC\Backup Set 2011-09-25 190003\Backup Files 2011-10-02 190003\Backup files 14.zip multiple threats DB09D97BE9050C974204C5C444B68101270C6A63 I D:\USER-PC\Backup Set 2011-09-25 190003\Backup Files 2011-10-02 190003\Backup files 2.zip JS/Kryptik.DJ trojan D6D03C5473730911272EDC0A14326A40CC5CCF2A I D:\USER-PC\Backup Set 2011-09-25 190003\Backup Files 2011-10-23 190003\Backup files 9.zip HTML/ScrInject.B.Gen virus 56E0B1C4A9E088C43E0DE73DD4B03252554222A7 I D:\USER-PC\Backup Set 2011-12-04 190005\Backup Files 2011-12-04 190005\Backup files 17.zip multiple threats 013F02FD5968080D7A826E5D6A58E259CDA6F73A I D:\USER-PC\Backup Set 2012-10-21 191207\Backup Files 2012-10-21 191207\Backup files 50.zip probably a variant of Win32/Agent.CLDLOFD trojan D912829B924E3971FA333FA2A75D369864D8B90E I D:\USER-PC\Backup Set 2012-10-21 191207\Backup Files 2012-10-21 191207\Backup files 9.zip multiple threats F7DD458C252E8DA29B6048B231119A183C3DDBF1 I D:\USER-PC\Backup Set 2012-12-09 213523\Backup Files 2012-12-09 213523\Backup files 4.zip multiple threats AB1D71B60FCACC0B8C5F5165F20ED797089FB08B I D:\USER-PC\Backup Set 2012-12-09 213523\Backup Files 2012-12-09 213523\Backup files 48.zip probably a variant of Win32/Agent.CLDLOFD trojan 99554EA41F01C27A61B0A7F7F9A54CCF71A5D1B6 I D:\USER-PC\Backup Set 2012-12-16 190004\Backup Files 2012-12-16 190004\Backup files 4.zip multiple threats 1E014AB15A230EFA39D55E34221EB5E34B92F0EF I D:\USER-PC\Backup Set 2012-12-16 190004\Backup Files 2012-12-16 190004\Backup files 50.zip probably a variant of Win32/Agent.CLDLOFD trojan 69B573051D910449F9D09A7EB40F3709CA907964 I D:\USER-PC\Backup Set 2013-01-06 190003\Backup Files 2013-01-10 142317\Backup files 1.zip Win32/Adware.MultiPlug.H application 9A06BD53B55C3DD6898980906733FA7E0F558094 I D:\USER-PC\Backup Set 2013-01-06 190003\Backup Files 2013-01-10 142317\Backup files 2.zip Win32/Adware.MultiPlug.H application 8F5D0469ADD1585C199EEE2C941C7A74F061F029 I D:\USER-PC\Backup Set 2013-01-06 190003\Backup Files 2013-01-10 142317\Backup files 4.zip multiple threats CCAA07ED78EA5E27A1A9D32CA021C1C26CF00347 I D:\USER-PC\Backup Set 2013-01-06 190003\Backup Files 2013-01-10 142317\Backup files 50.zip probably a variant of Win32/Agent.CLDLOFD trojan D853BE738F04FD2E410A163E9E47D5FE1D1533E0 I Code:
ATTFilter Results of screen317's Security Check version 0.99.57 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` AVG Anti-Virus Free Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.70.0.1100 JavaFX 2.1.1 Java(TM) 6 Update 22 Java(TM) 7 Update 5 Java version out of Date! Adobe Flash Player 11.5.502.146 Adobe Reader 9 Adobe Reader out of Date! Mozilla Firefox (18.0) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe AVG avgwdsvc.exe AVG avgtray.exe AVG avgrsx.exe AVG avgemc.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
Themen zu Plötzlich überall Werbung! |
angeboten, bereits, einzelne, erscheine, erscheinen, hilfreich, hoffe, links, plötzlich, seiten, werbung, werbung;links;wörter, wörter, überall |