| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
15.01.2013, 12:19
| #1 |
| |  GVU Trojaner Hallo, auch ich bin betroffen vom GVU Trojaner allerdings war es noch letztes Jahr so um die Weihnachtszeit herum. Bevor ich dann in den Urlaub gefahren bin habe ich den am nahesten liegenden Systemwiederherstellungspunkt gewählt im abgesicherten Modus und seitdem funktioniert der PC wieder einwandfrei. Nun brauchte ich ihn dieses Jahr für eine Präsentation und Abschlussarbeiten und habe ihn intensiv genutzt auch mit USB Stick anschließen und so weiter. Nun zu meiner Frage. Der Trojaner befindet sich vermutlich noch auf dem PC, wie sollte ich nun weiter vorgehen und kann sich der Trojaner auch auf die Daten auf dem USB-Stick auswirken? Geändert von Pocca (15.01.2013 um 12:25 Uhr) |
|
15.01.2013, 17:39
| #2 |
| /// Helfer-Team  | GVU Trojaner Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist. Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. 1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.2. Schritt Systemscan mit OTL (bebilderte Anleitung)
__________________ |
|
15.01.2013, 22:49
| #3 |
| | GVU Trojaner Vielen Dank schonmal für die Antwort also Malware habe ich schonmal komplett drüber laufen lassen habe dann auf entfernen gedrückt und der PC wurde neugestartet. Nun sind die Objekte in der Quarantäne zu sehen. Ich poste ebend die Log Dateien dann hole ich mir OTL und wende es an.
__________________Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Datenbank Version: v2013.01.15.13 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 7.0.6002.18005 Patrick :: B...... [Administrator] 15.01.2013 21:16:07 MBAM-log-2013-01-15 (22-38-57).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|H:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 428613 Laufzeit: 1 Stunde(n), 19 Minute(n), 45 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 4 HKCR\CLSID\{2A6F082F-6AB3-4FC3-B43C-CA2836BFDD56} (Malware.Packer.as) -> Keine Aktion durchgeführt. HKCR\TypeLib\{4D69DA40-213B-44A2-AA73-3AA9E392958A} (Malware.Packer.as) -> Keine Aktion durchgeführt. HKCR\Interface\{016C72F0-4481-4D8C-9189-8F7DDDCE560D} (Malware.Packer.as) -> Keine Aktion durchgeführt. HKCR\ASkin.mySkin (Malware.Packer.as) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\WINDOWS\SYSTEM32\ASKIN.OCX (Malware.Packer.as) -> Daten: 1 -> Keine Aktion durchgeführt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\Users\Patrick\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\1ede2ede-73317a7d (Trojan.Reveton) -> Keine Aktion durchgeführt. C:\Windows\System32\ASkin.ocx (Malware.Packer.as) -> Keine Aktion durchgeführt. C:\ProgramData\dsgsdgdsgdsgw.pad (Exploit.Drop.GSA) -> Keine Aktion durchgeführt. (Ende) Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4159 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 31.05.2010 22:17:36 mbam-log-2010-05-31 (22-17-36).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|H:\|) Durchsuchte Objekte: 307140 Laufzeit: 52 Minute(n), 22 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 5 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 3 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijacker) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows update service (Backdoor.IRCBot) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Users\Patrick\AppData\Local\Temp\Qc2.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully. C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Public\winnvscr.exe (Backdoor.IRCBot) -> Delete on reboot. Nun noch die Log Files OTL und Extras:OTL Logfile: Code:
ATTFilter OTL logfile created on: 15.01.2013 22:54:02 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Patrick\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 0,96 Gb Available Physical Memory | 47,82% Memory free 4,24 Gb Paging File | 2,86 Gb Available in Paging File | 67,32% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 39,06 Gb Total Space | 0,80 Gb Free Space | 2,05% Space Free | Partition Type: NTFS Drive D: | 61,50 Gb Total Space | 39,18 Gb Free Space | 63,71% Space Free | Partition Type: NTFS Drive E: | 117,19 Gb Total Space | 79,88 Gb Free Space | 68,16% Space Free | Partition Type: NTFS Drive H: | 15,14 Gb Total Space | 4,72 Gb Free Space | 31,19% Space Free | Partition Type: NTFS Computer Name: BATMAN | User Name: Patrick | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Patrick\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Common Files\Steam\SteamService.exe (Valve Corporation) PRC - E:\Counterstrie Source\Steam.exe (Valve Corporation) PRC - C:\Programme\Garena Plus\GarenaMessenger.exe () PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe (EIZO NANAO CORPORATION) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\EIZO\ScreenSlicer\ESCSlicer.exe (EIZO NANAO CORPORATION) PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe () PRC - C:\Programme\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.) PRC - C:\Programme\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.) PRC - C:\Programme\Logitech\LWS\LU\LogitechUpdate.exe (Logitech, Inc.) PRC - C:\Programme\Logitech\LWS\LU\LULnchr.exe (Logitech, Inc.) PRC - C:\Programme\GMX\GMX MultiMessenger\MESSENGR.EXE (GMX GmbH) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Programme\Common Files\Logitech\G-series Software\LGDCore.exe (Logitech Inc.) PRC - C:\Programme\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.) ========== Modules (No Company Name) ========== MOD - C:\Programme\Mozilla Firefox\mozjs.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\f042f66c2ad8fd5b8c34fa22cd22079e\System.Management.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b5df40c22ab563a816103629e2ca99d4\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\76c7188792164691232626c0fc9ae579\System.Web.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\004bc6615f9c06df5c98859d35149fe6\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b757806657fa5db2b1ed1a89b026b463\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\0c3da9004b277959e24a9fd606d3dd05\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\78157a494dc9a7e52be8840decfcd9cc\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\cc149d08e75f8c53cd28ac926b38c370\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\2227d1559f87943255069398608d5c56\mscorlib.ni.dll () MOD - E:\Counterstrie Source\sdl.dll () MOD - E:\Counterstrie Source\bin\libcef.dll () MOD - E:\Counterstrie Source\bin\chromehtml.dll () MOD - E:\Counterstrie Source\bin\avcodec-53.dll () MOD - E:\Counterstrie Source\bin\avformat-53.dll () MOD - E:\Counterstrie Source\bin\avutil-51.dll () MOD - C:\Programme\Garena Plus\GarenaMessenger.exe () MOD - C:\Programme\Garena Plus\VersionModule.dll () MOD - C:\Programme\Garena Plus\Plugins\ggplugin.dll () MOD - C:\Programme\Garena Plus\lib\XLL.dll () MOD - C:\Programme\Garena Plus\Plugins\PluginNews.dll () MOD - C:\Programme\Garena Plus\Plugins\GarenaTalkPlugin.dll () MOD - C:\Programme\Garena Plus\ggspawn.dll () MOD - C:\Programme\Garena Plus\Plugins\StatsPlugin.dll () MOD - C:\Programme\Garena Plus\Plugins\PlatformPlugin.dll () MOD - C:\Programme\Garena Plus\lib\Http.dll () MOD - C:\Programme\Garena Plus\PluginModule.dll () MOD - C:\Programme\Garena Plus\CxImage.dll () MOD - C:\Programme\Garena Plus\lib\UILayout.dll () MOD - C:\Programme\Garena Plus\lib\XmlUIModule.dll () MOD - C:\Programme\Garena Plus\ggdownloader.dll () MOD - C:\Programme\Garena Plus\lib\delay_load\GaFileTransfer.dll () MOD - C:\Programme\Garena Plus\FileLoader.dll () MOD - C:\Programme\Garena Plus\PluginKernel.dll () MOD - C:\Programme\Garena Plus\lib\delay_load\ClientTcp.dll () MOD - C:\Programme\Garena Plus\lib\delay_load\UdtLib.dll () MOD - C:\Programme\Garena Plus\lib\fs\YYFileSystem.dll () MOD - C:\Programme\Garena Plus\DibModule.dll () MOD - C:\Programme\Garena Plus\ImageModule.dll () MOD - C:\Programme\Garena Plus\lib\delay_load\MediaEngine.dll () MOD - C:\Programme\Garena Plus\lib\delay_load\AudioMixerLib.dll () MOD - C:\Programme\Garena Plus\ServerMemAlloc.dll () MOD - C:\Programme\Garena Plus\lib\delay_load\RSALib.dll () MOD - C:\Programme\Garena Plus\lame_enc.dll () MOD - C:\Programme\Garena Plus\sqlite3.dll () MOD - C:\Programme\Garena Plus\lib\TaskManagerLib.dll () MOD - C:\Programme\Garena Plus\lib\MP3Module.dll () MOD - C:\Programme\Garena Plus\ggcode.dll () MOD - C:\Programme\Garena Plus\CommonLib.dll () MOD - C:\Programme\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll () MOD - C:\Programme\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll () MOD - C:\Programme\Logitech\LWS\Webcam Software\QTXml4.dll () MOD - C:\Programme\Logitech\LWS\Webcam Software\QTGui4.dll () MOD - C:\Programme\Logitech\LWS\Webcam Software\QTCore4.dll () MOD - C:\Programme\FileZilla FTP Client\fzshellext.dll () MOD - C:\Programme\Notepad++\NppShell_04.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Windows\System32\atitmmxx.dll () MOD - C:\Programme\WinRAR\RarExt.dll () ========== Services (SafeList) ========== SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe () SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (UMVPFSrv) -- C:\Programme\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.) SRV - (Microsoft Office Groove Audit Service) -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (USBModem) -- system32\DRIVERS\lgusbmodem.sys File not found DRV - (UsbDiag) -- system32\DRIVERS\lgusbdiag.sys File not found DRV - (usbbus) -- system32\DRIVERS\lgusbbus.sys File not found DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found DRV - (GGSAFERDriver) -- C:\Program Files\Garena Plus\Room\safedrv.sys File not found DRV - (GarenaPEngine) -- C:\Users\Patrick\AppData\Local\Temp\KPU1CBA.tmp File not found DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH) DRV - (LVUVC) -- C:\Windows\System32\drivers\lvuvc.sys (Logitech Inc.) DRV - (LVRS) -- C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Codename Longhorn DDK provider) DRV - (s816mdm) -- C:\Windows\System32\drivers\s816mdm.sys (MCCI Corporation) DRV - (s816mgmt) -- C:\Windows\System32\drivers\s816mgmt.sys (MCCI Corporation) DRV - (s816unic) -- C:\Windows\System32\drivers\s816unic.sys (MCCI) DRV - (s816obex) -- C:\Windows\System32\drivers\s816obex.sys (MCCI Corporation) DRV - (s816nd5) -- C:\Windows\System32\drivers\s816nd5.sys (MCCI Corporation) DRV - (s816mdfl) -- C:\Windows\System32\drivers\s816mdfl.sys (MCCI Corporation) DRV - (s816bus) -- C:\Windows\System32\drivers\s816bus.sys (MCCI Corporation) DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.) DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.) DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.) DRV - (ET5Drv) -- C:\Windows\System32\drivers\ET5Drv.sys () DRV - (JRAID) -- C:\Windows\System32\drivers\jraid.sys (JMicron Technology Corp.) DRV - (SysTool) -- C:\Windows\System32\drivers\SysTool.sys () DRV - (sfvfs02) -- C:\Windows\System32\drivers\sfvfs02.sys (Protection Technology (StarForce)) DRV - (sfdrv01) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce)) DRV - (sfhlp02) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce)) DRV - (JGOGO) -- C:\Windows\System32\drivers\JGOGO.sys (JMicron ) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = ICQ.com Suche IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\..\SearchScopes,DefaultScope = {6552C7DD-90A4-4387-B795-F8F96747DE19} IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SUNA_de IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://web.de/" FF - prefs.js..extensions.enabledAddons: DivXWebPlayer%40divx.com:2.0.2.039 FF - prefs.js..extensions.enabledAddons: moveplayer%40movenetworks.com:1.0.0.071303000004 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q=" FF - prefs.js..network.proxy.type: 4 FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=sm&tb_ver=1.3.3&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Patrick\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.11 12:37:42 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.01.11 12:37:11 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.11 12:37:42 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.01.11 12:37:11 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{d591241b-9967-418c-9b7d-ee128131d60d}: C:\Program Files\GMX\GMX MultiMessenger\ThunderbirdSyncProxy [2009.06.28 14:39:21 | 000,000,000 | ---D | M] [2008.09.06 18:20:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\Extensions [2013.01.07 19:11:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\7y1omo7k.default\extensions [2012.10.11 17:45:51 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\7y1omo7k.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2012.07.25 18:12:23 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\7y1omo7k.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.10.28 21:17:54 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\7y1omo7k.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} [2009.03.25 20:53:59 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\7y1omo7k.default\extensions\moveplayer@movenetworks.com [2012.08.22 17:29:20 | 000,101,863 | ---- | M] () (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\extensions\ciuvo-extension@icq.de.xpi [2012.02.09 21:43:54 | 000,550,833 | ---- | M] () (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\extensions\DivXWebPlayer@divx.com.xpi [2012.02.04 17:49:16 | 000,020,591 | ---- | M] () (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2012.11.20 18:14:44 | 000,243,496 | ---- | M] () (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2013.01.07 19:11:40 | 000,190,000 | ---- | M] () (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi [2013.01.13 18:12:27 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-1.xml [2011.10.01 18:39:43 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-10.xml [2011.10.16 19:03:57 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-11.xml [2011.11.11 18:59:00 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-12.xml [2008.02.08 20:07:07 | 000,000,949 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-2.xml [2009.03.24 19:25:32 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-3.xml [2011.05.03 17:04:57 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-4.xml [2011.06.24 23:47:35 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-5.xml [2011.07.09 19:52:02 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-6.xml [2011.08.21 12:05:07 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-7.xml [2011.09.01 17:24:13 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-8.xml [2011.09.01 17:28:42 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin-9.xml [2011.03.30 13:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\icqplugin.xml [2008.01.03 22:28:17 | 000,000,274 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\search.xml [2011.11.06 20:19:33 | 000,003,915 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\mozilla\firefox\profiles\7y1omo7k.default\searchplugins\sweetim.xml [2013.01.11 12:37:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2013.01.11 12:37:07 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2013.01.11 12:37:41 | 000,262,704 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.10.01 18:39:05 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.08.31 16:50:20 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.10.01 18:39:05 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.10.01 18:39:05 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.01 18:39:05 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.01 18:39:05 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2008.02.23 19:37:29 | 000,226,662 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.1001-search.info O1 - Hosts: 127.0.0.1 1001-search.info O1 - Hosts: 127.0.0.1 ²©²Êͨ,²©²ÊÍø,½ð±¦²©188,²©²ÊͨÆÀ¼¶,°Ù¼ÒÀÖ,°ÂÃî°Ù¼ÒÀÖ O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com - Informationen zum Thema Sex links. Diese Website steht zum Verkauf! O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 123topsearch.com O1 - Hosts: 127.0.0.1 123topsearch.com O1 - Hosts: 127.0.0.1 www.132.com O1 - Hosts: 127.0.0.1 132.com O1 - Hosts: 127.0.0.1 www.136136.net O1 - Hosts: 7953 more lines... O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Shopping Assistant Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Programme\PriceGong\2.5.1\PriceGongIE.dll (PriceGong) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll File not found O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe () O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\JM\JMInsIDE.exe () O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.) O4 - HKLM..\Run: [Launch LGDCore] C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe (Logitech Inc.) O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [ScreenManager Pro for LCD (DDCCI)] C:\Programme\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe (EIZO NANAO CORPORATION) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000..\Run: [Facebook Update] C:\Users\Patrick\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000..\Run: [GarenaPlus] C:\Program Files\Garena Plus\GarenaMessenger.exe () O4 - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000..\Run: [GMX_GMX MultiMessenger] C:\Program Files\GMX\GMX MultiMessenger\MESSENGR.EXE (GMX GmbH) O4 - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000..\Run: [Steam] E:\Counterstrie Source\steam.exe (Valve Corporation) O4 - HKU\S-1-5-21-2481620165-4217138233-3408023960-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Web-Suche - C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 10.7.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4F0B8C6C-6AD3-443B-ABCC-AB9E0FB5ECB4}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img16.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img16.jpg O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{6f748bd0-1e0e-11df-a73d-001a4d7389d7}\Shell - "" = AutoRun O33 - MountPoints2\{6f748bd0-1e0e-11df-a73d-001a4d7389d7}\Shell\AutoRun\command - "" = F:\USBAutoRun.exe O33 - MountPoints2\{c4a49500-5ad2-11df-8aad-001a4d7389d7}\Shell - "" = AutoRun O33 - MountPoints2\{c4a49500-5ad2-11df-8aad-001a4d7389d7}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.01.15 22:51:38 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Patrick\Desktop\OTL.exe [2013.01.15 21:12:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.01.15 21:12:16 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013.01.15 21:12:16 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013.01.15 21:09:35 | 010,156,344 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Patrick\mbam-setup-1.70.0.1100.exe [2013.01.12 15:22:46 | 029,671,038 | ---- | C] (Bytro Labs) -- C:\Users\Patrick\S1914JavaInstaller.exe [2013.01.11 12:37:05 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013.01.10 18:04:11 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2013.01.09 22:34:50 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\EIZO [2013.01.09 22:34:22 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Local\Downloaded Installations [2013.01.09 22:30:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EIZO [2013.01.09 22:30:58 | 000,000,000 | ---D | C] -- C:\ProgramData\EIZO [2013.01.09 22:30:58 | 000,000,000 | ---D | C] -- C:\Program Files\EIZO [2013.01.09 19:07:26 | 002,048,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2013.01.09 19:07:00 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll [2012.12.26 18:46:22 | 000,293,376 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2012.12.26 18:46:22 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2007.12.18 17:12:39 | 001,236,992 | ---- | C] (CPUID) -- C:\Program Files\cpuz.exe ========== Files - Modified Within 30 Days ========== [2013.01.15 22:51:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Patrick\Desktop\OTL.exe [2013.01.15 22:43:34 | 000,004,048 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.01.15 22:43:34 | 000,004,048 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.01.15 22:43:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.01.15 22:30:40 | 000,001,646 | ---- | M] () -- C:\Users\Patrick\Documents\T4EPlayer.conf [2013.01.15 22:10:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.01.15 22:03:25 | 000,001,146 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2481620165-4217138233-3408023960-1000UA.job [2013.01.15 21:12:18 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.01.15 21:09:50 | 010,156,344 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Patrick\mbam-setup-1.70.0.1100.exe [2013.01.15 19:51:17 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{7FCA0E7B-7529-4C72-8CAE-62BBD24A8E7F}.job [2013.01.15 19:03:01 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2481620165-4217138233-3408023960-1000Core.job [2013.01.14 12:04:46 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.01.14 12:04:46 | 000,596,036 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.01.14 12:04:46 | 000,126,292 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.01.14 12:04:46 | 000,104,110 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.01.12 15:23:12 | 029,671,038 | ---- | M] (Bytro Labs) -- C:\Users\Patrick\S1914JavaInstaller.exe [2013.01.11 11:45:13 | 000,381,608 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013.01.09 22:34:46 | 000,001,948 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\EIZO ScreenSlicer.lnk [2013.01.09 19:10:26 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013.01.09 19:10:26 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2013.01.06 13:01:42 | 008,625,029 | ---- | M] () -- C:\Users\Patrick\Desktop\PaJo und Co.mp4 [2012.12.21 23:56:16 | 000,001,356 | ---- | M] () -- C:\Users\Patrick\AppData\Local\d3d9caps.dat ========== Files Created - No Company Name ========== [2013.01.15 21:12:18 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.01.09 22:34:46 | 000,001,948 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\EIZO ScreenSlicer.lnk [2013.01.06 13:01:40 | 008,625,029 | ---- | C] () -- C:\Users\Patrick\Desktop\PaJo und Co.mp4 [2012.12.06 20:29:04 | 000,127,242 | ---- | C] () -- C:\Users\Patrick\hfo-tyrrellp34-2.jpg [2012.12.06 20:14:04 | 000,043,452 | ---- | C] () -- C:\Users\Patrick\1978-05-stewart-mc.jpg [2012.12.06 20:12:10 | 000,054,752 | ---- | C] () -- C:\Users\Patrick\patrick1977ah7.jpg [2012.12.06 20:04:29 | 000,487,625 | ---- | C] () -- C:\Users\Patrick\Tyrrell-P34_mp906_pic_59618.jpg [2012.12.01 15:40:09 | 000,738,986 | ---- | C] () -- C:\Users\Patrick\image_1354372471445482.jpg [2012.08.27 16:43:04 | 000,381,608 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2011.07.13 20:45:08 | 000,045,194 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\room_v3.dat [2011.05.26 05:05:00 | 010,879,000 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll [2011.05.26 05:05:00 | 000,333,336 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll [2011.05.26 05:05:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe [2011.05.26 04:56:28 | 000,027,872 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini [2011.03.22 22:58:22 | 000,014,168 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll [2011.03.22 17:09:29 | 000,046,658 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\room.dat [2011.03.13 18:58:38 | 000,456,704 | ---- | C] () -- C:\Program Files\NuclearReactor_1_2.exe [2010.05.26 16:37:48 | 000,000,000 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\chrtmp [2009.01.16 21:25:02 | 000,022,328 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\PnkBstrK.sys [2007.12.22 15:46:38 | 000,000,552 | ---- | C] () -- C:\Users\Patrick\AppData\Local\d3d8caps.dat [2007.12.18 18:14:07 | 000,011,610 | ---- | C] () -- C:\Program Files\manual.html [2007.12.18 17:58:50 | 000,185,856 | ---- | C] () -- C:\Program Files\Core Temp.exe [2007.12.18 17:06:36 | 000,024,576 | ---- | C] () -- C:\Program Files\memtest.exe [2007.10.11 14:48:32 | 000,052,736 | ---- | C] () -- C:\Users\Patrick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.08.28 17:49:39 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2007.08.26 13:01:54 | 000,001,356 | ---- | C] () -- C:\Users\Patrick\AppData\Local\d3d9caps.dat ========== ZeroAccess Check ========== [2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== Alternate Data Streams ========== @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:AA6DEB48 < End of report > OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 15.01.2013 22:54:02 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Patrick\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 0,96 Gb Available Physical Memory | 47,82% Memory free
4,24 Gb Paging File | 2,86 Gb Available in Paging File | 67,32% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 39,06 Gb Total Space | 0,80 Gb Free Space | 2,05% Space Free | Partition Type: NTFS
Drive D: | 61,50 Gb Total Space | 39,18 Gb Free Space | 63,71% Space Free | Partition Type: NTFS
Drive E: | 117,19 Gb Total Space | 79,88 Gb Free Space | 68,16% Space Free | Partition Type: NTFS
Drive H: | 15,14 Gb Total Space | 4,72 Gb Free Space | 31,19% Space Free | Partition Type: NTFS
Computer Name: BATMAN | User Name: Patrick | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_USERS\S-1-5-21-2481620165-4217138233-3408023960-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 1
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{270E50D1-D1E0-4AE2-B915-03A0281ABFA4}" = rport=10243 | protocol=6 | dir=out | app=system |
"{3C5FC4EC-CC1E-4D2B-8E5B-4862302E3251}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{43AFC735-DD21-4B4B-A8EE-481B807D57CC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{49D71223-E8BB-4D06-94FB-A7B6E649F564}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4F78553D-BF02-439D-9B38-D2C346BAFE8C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5336DD28-9030-48E4-94E4-E92994A3B285}" = lport=10243 | protocol=6 | dir=in | app=system |
"{82334AA9-0156-425F-8632-4FC7E1601E8C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{874BCBF4-44DA-4E61-B4F6-BFE2447A3EDB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{87CFA695-B81C-46B4-B3FB-54A3E19B2D00}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D3E324E5-E3F2-4A39-BA0A-271E48A8EA0E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EC4B26F3-9135-4787-9406-6B6E2BABC2DB}" = lport=2869 | protocol=6 | dir=in | app=system |
"{FC7D8731-62D9-4A0B-B6E0-AA223B7B9AB1}" = lport=2869 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00BF4CBA-46CE-462F-9509-57423C2533CA}" = protocol=6 | dir=in | app=e:\counterstrie source\steamapps\common\trackmania nations forever\tmforever.exe |
"{02BD9D99-8958-4265-AE1B-A07B758D8251}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{05AF7572-2AE3-4E18-BDC7-86479BAF72E5}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{070AEAF2-1960-4BF4-A079-99CAFC50DC3C}" = protocol=17 | dir=in | app=e:\cod 4\iw3mp.exe |
"{10727D0C-5C5C-420B-B0FC-E69DDDF66EF3}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{1A39F617-0276-46B5-A1CD-8498D7DF2FE9}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{21EFCD1A-2E1F-40DB-ABB3-8F641D84AA5C}" = protocol=17 | dir=in | app=e:\counterstrie source\steamapps\pocca_1\counter-strike source\hl2.exe |
"{2822F5CA-C5BF-4358-AE43-BDCBB5129C2D}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{293DA4D9-5197-42BE-AC74-0EA6E4FE8D87}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2FDF4F15-D317-49B7-8761-0120FF5877FB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{30EAD7FC-E0EA-482F-9308-A3BAE7FDF123}" = dir=in | app=c:\users\patrick\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{430D6F6D-DD98-4C3A-98E2-63D5E73FDE5A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4418EF39-C1AA-448A-ABB7-9EDD555A02D1}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{46F2DE00-377D-461C-82D9-7B3C548C5A2B}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{4D0E9EDD-1877-43F8-81BD-23D93A71B054}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{4D12269B-E8EB-4F07-9653-1F2355747121}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4DD63C63-700F-4F65-9EF7-B419971B1A2D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{51AC071E-909E-46D9-96A6-54930033B5A4}" = protocol=6 | dir=in | app=e:\counterstrie source\steamapps\pocca_1\counter-strike source\hl2.exe |
"{604BB95E-EBBA-43E6-BA88-A38FE5B8AC0E}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{60D023C7-6E84-40ED-B234-93DF8B242075}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{671D12F8-3557-48C0-A223-3C14A2E8F35B}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{67B3EF0E-F06B-4A75-ACA7-666ED3CD2B69}" = protocol=6 | dir=in | app=e:\counterstrie source\steamapps\common\trackmania nations forever\tmforeverlauncher.exe |
"{71A34B90-0D9B-44A9-8F68-42164602A928}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{71EA9AC1-DB48-42DF-8127-6A97101130CE}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{751F07FD-A952-4047-8FC9-3C08A1BFA1B8}" = protocol=17 | dir=in | app=e:\counterstrie source\steamapps\common\trackmania nations forever\tmforeverlauncher.exe |
"{7A25E0D7-A789-4A7F-A6DA-308A6AF2B28B}" = protocol=6 | dir=out | app=system |
"{8788B39D-64E6-467C-A614-1C8596CF3D58}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8ADABA73-3B24-4993-B9FA-96866700F4B5}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{93913AF9-ED88-45B0-837C-D11ACC6776C0}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{93C911BF-3BC4-4195-8282-C0ED8DF7CE40}" = protocol=6 | dir=in | app=e:\cod 4\iw3mp.exe |
"{9B34D632-B64A-4D5B-8200-F2358CA4D8AD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B911C285-6895-4C6A-8E3D-B06055234E25}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BFCABA16-1D24-43C3-A9EB-585CFAE266D7}" = protocol=17 | dir=in | app=e:\counterstrie source\steamapps\common\trackmania nations forever\tmforever.exe |
"{C463D96D-BB4C-47A6-9564-3DD19E2A08E5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{CE0CA976-31D6-4080-B97D-A7734D432A06}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{E587B880-466E-40F5-9B7F-ADA43BA8F272}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{FB01D9C1-0DC6-4DC0-91B0-7E4F3762A5AB}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{FDC5E372-8F13-468C-AA06-81846AD8D632}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"TCP Query User{01473DC5-30FC-4847-B957-2BD05DAAA1FC}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{0B2638EA-2941-43A7-ACA9-C5F5AD6B207B}C:\windows\system32\dpnsvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dpnsvr.exe |
"TCP Query User{1DD354B7-FABE-4037-B17D-205C24232FFB}E:\cod 4\iw3mp.exe" = protocol=6 | dir=in | app=e:\cod 4\iw3mp.exe |
"TCP Query User{21EBA13E-14F7-40DB-A252-F049AE8C69AC}E:\valve\hltv.exe" = protocol=6 | dir=in | app=e:\valve\hltv.exe |
"TCP Query User{2EF5569D-CBEE-41B1-9954-4136276BFA7E}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{502A847D-09C0-463E-845D-F4A0B6B667E6}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"TCP Query User{5BE534C4-FD4E-4162-BB9C-C762B9469AE4}E:\trackmania nations eswc\tmnationseswc.exe" = protocol=6 | dir=in | app=e:\trackmania nations eswc\tmnationseswc.exe |
"TCP Query User{62DD6B4B-6E89-4375-9739-1361E51E7685}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{674FFCE0-CC56-431F-B3E2-707493862078}E:\ea sports\f1_2002.exe" = protocol=6 | dir=in | app=e:\ea sports\f1_2002.exe |
"TCP Query User{8AEAB55B-06FC-44FB-8566-CC65EBDD2F45}E:\aoe2\age of empires 2\aoe 2\age of empires 2 & the conquerors\age2_x1.exe" = protocol=6 | dir=in | app=e:\aoe2\age of empires 2\aoe 2\age of empires 2 & the conquerors\age2_x1.exe |
"TCP Query User{AB8D3D94-37D1-4BB4-B419-439B6229EA03}\\dell-jonas\shareddocs\warcraft iii\war3.exe" = protocol=6 | dir=in | app=\\dell-jonas\shareddocs\warcraft iii\war3.exe |
"TCP Query User{AB97B901-D28B-4A77-A5FA-F7E1C505CA1F}E:\counterstrie source\steam.exe" = protocol=6 | dir=in | app=e:\counterstrie source\steam.exe |
"TCP Query User{C070CA64-A150-4719-8B62-6F3F4A4AC091}C:\program files\logitech\vid hd\vid.exe" = protocol=6 | dir=in | app=c:\program files\logitech\vid hd\vid.exe |
"TCP Query User{C0817D6F-9873-4E9C-83B2-BC5408BAD3B3}C:\program files\garena plus\room\garena_room.exe" = protocol=6 | dir=in | app=c:\program files\garena plus\room\garena_room.exe |
"TCP Query User{C153F5F1-4E51-4402-8B2E-DFC3FC907CFA}C:\program files\atube catcher\yct.exe" = protocol=6 | dir=in | app=c:\program files\atube catcher\yct.exe |
"TCP Query User{CFC802B7-3AF7-4987-AAAD-28AF6FD2AFFF}E:\warcraft iii\war3.exe" = protocol=6 | dir=in | app=e:\warcraft iii\war3.exe |
"TCP Query User{D0C027C1-E105-432F-81C3-53B35FA1AD89}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{FE84A943-8BBD-46E6-BE50-FB611C3D249B}C:\program files\gmx\gmx multimessenger\messengr.exe" = protocol=6 | dir=in | app=c:\program files\gmx\gmx multimessenger\messengr.exe |
"UDP Query User{1AB20EBD-D5D4-4F89-94E3-F7C914C6E8F9}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{1B210D9F-9E6A-42DD-B503-4B2E813501FC}E:\aoe2\age of empires 2\aoe 2\age of empires 2 & the conquerors\age2_x1.exe" = protocol=17 | dir=in | app=e:\aoe2\age of empires 2\aoe 2\age of empires 2 & the conquerors\age2_x1.exe |
"UDP Query User{2553D53E-A2B7-4321-A5F6-3EEF57D3F793}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"UDP Query User{2707F88A-4CB7-4A66-ACB7-4543035A75C2}E:\ea sports\f1_2002.exe" = protocol=17 | dir=in | app=e:\ea sports\f1_2002.exe |
"UDP Query User{737C6A46-16C6-45FB-8355-80248A22DF97}C:\program files\logitech\vid hd\vid.exe" = protocol=17 | dir=in | app=c:\program files\logitech\vid hd\vid.exe |
"UDP Query User{8494790C-9D0E-4D83-B2DE-BB4527DABF8D}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{9975A198-DA75-43D8-87CA-DE48052C2315}C:\program files\atube catcher\yct.exe" = protocol=17 | dir=in | app=c:\program files\atube catcher\yct.exe |
"UDP Query User{A0952335-947C-4DA4-8BE4-5455FB8D0934}E:\counterstrie source\steam.exe" = protocol=17 | dir=in | app=e:\counterstrie source\steam.exe |
"UDP Query User{A7E12347-1659-46FA-8A39-5329EAB42B11}E:\trackmania nations eswc\tmnationseswc.exe" = protocol=17 | dir=in | app=e:\trackmania nations eswc\tmnationseswc.exe |
"UDP Query User{AAE01D9E-2985-40AB-9CD1-439EE8912BAA}E:\warcraft iii\war3.exe" = protocol=17 | dir=in | app=e:\warcraft iii\war3.exe |
"UDP Query User{C1D69E60-59C3-4F57-97B8-06E33C780206}C:\program files\garena plus\room\garena_room.exe" = protocol=17 | dir=in | app=c:\program files\garena plus\room\garena_room.exe |
"UDP Query User{C5AF4F83-9C61-410A-AF73-EBBEF633F3C5}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{CEBE2EE5-1678-4045-9120-EA88ED95D915}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{D3FB1609-B758-484A-A8BB-AC4DC70DB4B8}\\dell-jonas\shareddocs\warcraft iii\war3.exe" = protocol=17 | dir=in | app=\\dell-jonas\shareddocs\warcraft iii\war3.exe |
"UDP Query User{EF4A192D-1CC1-4842-952B-A42CD4B1F3EC}E:\cod 4\iw3mp.exe" = protocol=17 | dir=in | app=e:\cod 4\iw3mp.exe |
"UDP Query User{F7907AA0-7033-4FD3-83F9-360E3E666BEE}C:\program files\gmx\gmx multimessenger\messengr.exe" = protocol=17 | dir=in | app=c:\program files\gmx\gmx multimessenger\messengr.exe |
"UDP Query User{F9BF3633-8405-4905-BF68-E94615A649FB}C:\windows\system32\dpnsvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dpnsvr.exe |
"UDP Query User{FA362C5E-E269-4632-BC63-850893A36EB1}E:\valve\hltv.exe" = protocol=17 | dir=in | app=e:\valve\hltv.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam(TM)
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP610_series" = Canon MP610 series
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83217010FF}" = Java 7 Update 10
"{292A177D-723F-4537-9985-BC8BFCD8B63D}" = EIZO ScreenSlicer
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = Gigabyte Raid Configurer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE1008C-11A1-4F4F-8DB7-27573924DE78}" = DMIView B7.0108.01
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{580D6A69-F3F7-CB21-A5F5-3451A38CA1C2}" = Catalyst Control Center InstallProxy
"{5DE1B7CF-7429-40CA-987F-6BEE09B63787}" = Prime95
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{68D1CBD5-899D-037D-FC17-191811C44EA5}" = ATI Catalyst Install Manager
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{75E607CF-7BAE-4B88-84B3-97F3DF44BA28}" = FEARCombat
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77A1C7DD-E4F6-4057-92FC-710219215987}" = Logitech G11 Keyboard Software 1.03
"{7A65E382-1843-4B46-861B-1BECB8354911}" = Falcon 4.0: Allied Force
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{AC76BA86-7AD7-1033-7646-A70000000000}" = Adobe Reader 7.0
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D3B1C799-CB73-42DE-BA0F-2344793A095C}" = Catalyst Control Center - Branding
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{DAB265AD-27B2-4651-B8D8-F4F3A8ECC705}" = ScreenManager Pro for LCD (DDC/CI)
"{E1640DA5-89B4-4F52-B15D-5DA3D14F29D4}" = LG USB Modem Drivers
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FD5705C1-E925-9D79-7C2E-2A4FDC962036}" = ATI Catalyst Control Center Ex
"{FE163F11-1919-4257-A280-FF5AF8DAEECB}" = ICQ Sparberater
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"aTube Catcher" = aTube Catcher
"Avira AntiVir Desktop" = Avira Free Antivirus
"Canon MP610 series Benutzerregistrierung" = Canon MP610 series Benutzerregistrierung
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CCleaner" = CCleaner
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FileZilla Client" = FileZilla Client 3.3.5.1
"Flight Simulator 9.0" = Microsoft Flight Simulator 2004 - Das Jahrhundert der Luftfahrt
"FolderVisualizer_is1" = FolderVisualizer
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"GMX MultiMessenger" = GMX MultiMessenger
"ICQToolbar" = ICQ Toolbar
"im" = Garena Plus
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"KaloMa_is1" = KaloMa 4.72
"Logitech Vid" = Logitech Vid HD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 18.0 (x86 de)" = Mozilla Firefox 18.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"Notepad++" = Notepad++
"PriceGong" = PriceGong 2.5.1
"SideWinder Force Feedback 2" = SideWinder Force Feedback 2
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"Steam App 10" = Counter-Strike
"Steam App 11020" = TrackMania Nations Forever
"Steam App 211" = Source SDK
"Steam App 215" = Source SDK Base
"T4EPlayer" = T4E Player
"Uninstall_is1" = Uninstall 1.0.0.1
"uTorrent" = µTorrent
"VLC media player" = VideoLAN VLC media player 0.8.6d
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2481620165-4217138233-3408023960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"171a3bd25b2ddd36" = vroute.info
"Steam App 240" = Counter-Strike: Source
"Steam App 300" = Day of Defeat: Source
"Steam App 320" = Half-Life 2: Deathmatch
"Steam App 340" = Half-Life 2: Lost Coast
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 09.01.2013 17:54:34 | Computer Name = Batman | Source = EventSystem | ID = 4621
Description =
Error - 10.01.2013 13:04:44 | Computer Name = Batman | Source = Windows Search Service | ID = 3006
Description =
Error - 10.01.2013 13:04:44 | Computer Name = Batman | Source = Windows Search Service | ID = 3007
Description =
Error - 10.01.2013 17:21:11 | Computer Name = Batman | Source = EventSystem | ID = 4621
Description =
Error - 12.01.2013 10:24:44 | Computer Name = Batman | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung MsiExec.exe, Version 4.5.6002.18005, Zeitstempel
0x49e01c42, fehlerhaftes Modul MSIFECF.tmp, Version 1.0.0.0, Zeitstempel 0x50b652fb,
Ausnahmecode 0xc0000417, Fehleroffset 0x00014682, Prozess-ID 0x1604, Anwendungsstartzeit
01cdf0d07f0c9fe4.
Error - 13.01.2013 07:10:09 | Computer Name = Batman | Source = Windows Search Service | ID = 3013
Description =
Error - 13.01.2013 07:10:09 | Computer Name = Batman | Source = Windows Search Service | ID = 3013
Description =
Error - 13.01.2013 07:11:53 | Computer Name = Batman | Source = Windows Search Service | ID = 3013
Description =
Error - 13.01.2013 07:11:53 | Computer Name = Batman | Source = Windows Search Service | ID = 3013
Description =
Error - 14.01.2013 07:37:04 | Computer Name = Batman | Source = EventSystem | ID = 4621
Description =
[ Media Center Events ]
Error - 18.04.2008 13:31:41 | Computer Name = Batman | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: Download von Paket MCESpotlight
gescheitert.
[ OSession Events ]
Error - 09.02.2008 10:20:33 | Computer Name = Batman | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2086
seconds with 60 seconds of active time. This session ended with a crash.
Error - 16.04.2008 16:06:11 | Computer Name = Batman | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1511
seconds with 300 seconds of active time. This session ended with a crash.
Error - 20.05.2008 16:18:01 | Computer Name = Batman | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 10195
seconds with 60 seconds of active time. This session ended with a crash.
Error - 14.05.2009 15:30:28 | Computer Name = Batman | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 9412
seconds with 2040 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 13.01.2013 08:43:01 | Computer Name = Batman | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error - 14.01.2013 05:54:22 | Computer Name = Batman | Source = Service Control Manager | ID = 7026
Description =
Error - 14.01.2013 13:02:24 | Computer Name = Batman | Source = Service Control Manager | ID = 7026
Description =
Error - 15.01.2013 06:45:38 | Computer Name = Batman | Source = Service Control Manager | ID = 7026
Description =
Error - 15.01.2013 17:03:12 | Computer Name = Batman | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error - 15.01.2013 17:03:14 | Computer Name = Batman | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error - 15.01.2013 17:03:17 | Computer Name = Batman | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error - 15.01.2013 17:03:19 | Computer Name = Batman | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error - 15.01.2013 17:03:21 | Computer Name = Batman | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error - 15.01.2013 17:44:13 | Computer Name = Batman | Source = Service Control Manager | ID = 7026
Description =
< End of report >
Geändert von Pocca (15.01.2013 um 22:55 Uhr) |
|
16.01.2013, 00:52
| #4 |
| /// Helfer-Team | GVU Trojaner Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers danach: Downloade Dir bitte  AdwCleaner auf deinen Desktop.
|
|
16.01.2013, 15:21
| #5 |
| | GVU Trojaner Ok hier die LOG Files Malwarebytes Anti-Rootkit BETA 1.01.0.1016 www.malwarebytes.org Database version: v2013.01.16.03 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 7.0.6002.18005 Patrick :: BATMAN [administrator] 16.01.2013 14:49:14 mbar-log-2013-01-16 (14-49-14).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 28595 Time elapsed: 13 minute(s), 32 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Windows\system32\drivers\ET5Drv.sys (Unknown Rootkit Driver Infection) -> Delete on reboot. (end) Malwarebytes Anti-Rootkit BETA 1.01.0.1016 www.malwarebytes.org Database version: v2013.01.16.03 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 7.0.6002.18005 Patrick :: BATMAN [administrator] 16.01.2013 15:13:02 mbar-log-2013-01-16 (15-13-02).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 28523 Time elapsed: 13 minute(s), 28 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Und AdwCleaner: # AdwCleaner v2.105 - Datei am 16/01/2013 um 15:15:38 erstellt # Aktualisiert am 08/01/2013 von Xplode # Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits) # Benutzer : Patrick - BATMAN # Bootmodus : Normal # Ausgeführt unter : C:\Users\Patrick\Desktop\adwcleaner.exe # Option [Löschen] **** [Dienste] **** Gestoppt & Gelöscht : ICQ Service ***** [Dateien / Ordner] ***** Datei Gelöscht : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi Datei Gelöscht : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\searchplugins\icqplugin.xml Datei Gelöscht : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\searchplugins\icqplugin-1.xml Datei Gelöscht : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\searchplugins\icqplugin-2.xml Datei Gelöscht : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\searchplugins\icqplugin-3.xml Datei Gelöscht : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\searchplugins\search.xml Datei Gelöscht : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\searchplugins\SweetIm.xml Ordner Gelöscht : C:\Program Files\ICQ6Toolbar Ordner Gelöscht : C:\Program Files\PriceGong Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong Ordner Gelöscht : C:\Users\Patrick\AppData\LocalLow\PriceGong Ordner Gelöscht : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} Ordner Gelöscht : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} Ordner Gelöscht : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\SweetIMToolbarData ***** [Registrierungsdatenbank] ***** Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong Schlüssel Gelöscht : HKCU\Software\Conduit Schlüssel Gelöscht : HKCU\Software\ICQToolbar Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Web-Suche Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ICQToolbar Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\PriceGong Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4e15-963D-DC8493744B1D} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1631550F-191D-4826-B069-D9439253D926} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKCU\Software\SweetIM Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{835315FC-1BF6-4CA9-80CD-F6C158D40692} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{A7DDCBDE-5C86-415c-8A37-763AE183E7E4} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\PriceGongIE.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WMHelper.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1631550F-191D-4826-B069-D9439253D926} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D2A2595C-4FE4-4315-AA9B-19DBD6271B71} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceFactorIE.PriceGongBHO Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceFactorIE.PriceGongBHO.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceGongIE.PriceGongCtrl Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceGongIE.PriceGongCtrl.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{8B3372D0-09F0-41A5-8D9B-134E148672FB} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{92E5039E-FF1E-4AFB-8F24-87592D20C383} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B} Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IM Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PriceGong Schlüssel Gelöscht : HKLM\Software\SweetIM Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{855F3B16-6D32-4FE6-8A56-BBB695989046}] Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}] Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}] ***** [Internet Browser] ***** -\\ Internet Explorer v7.0.6002.18005 Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.icq.com/sm --> hxxp://www.google.com Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com -\\ Mozilla Firefox v18.0 (de) Datei : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\prefs.js C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\user.js ... Gelöscht ! Gelöscht : user_pref("extensions.enabledAddons", "DivXWebPlayer%40divx.com:2.0.2.039,moveplayer%40movenetworks.[...] Gelöscht : user_pref("keyword.URL", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q="); Gelöscht : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0"); Gelöscht : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7"); Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log"); Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000"); Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7"); Gelöscht : user_pref("sweetim.toolbar.mode.debug", "false"); Gelöscht : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.icq.com/search/afe_results.php?ch_i[...] Gelöscht : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...] Gelöscht : user_pref("sweetim.toolbar.search.history.capacity", "10"); Gelöscht : user_pref("sweetim.toolbar.searchguard.enable", "true"); Gelöscht : user_pref("sweetim.toolbar.simapp_id", "{3E33EBDC-08AC-11E1-92AF-001A4D7389D7}"); ************************* AdwCleaner[S1].txt - [8175 octets] - [16/01/2013 15:15:38] ########## EOF - C:\AdwCleaner[S1].txt - [8235 octets] ########## |
|
16.01.2013, 15:48
| #6 |
| /// Helfer-Team | GVU Trojaner Malware mit Combofix beseitigen Lade Combofix von einem der folgenden Download-Spiegel herunter: BleepingComputer.com - ForoSpyware.com und speichere das Programm auf den Desktop, nicht woanders hin, das ist wichtig! Beachte die ausführliche Original-Anleitung. Zurzeit ist Combofix auf folgenden Windows-Versionen lauffähig:
Vorbereitung und wichtige Hinweise
Combofix nicht auf eigene Faust einsetzen. Wenn keine entsprechende Infektion vorliegt, kann das den Rechner lahmlegen und/oder nachhaltig schädigen!
__________________ --> GVU Trojaner |
|
16.01.2013, 18:39
| #7 |
| | GVU Trojaner Ist es normal, dass ich nach dem Scan in Partition C nicht mehr auf Programme und Dokumente und Einstellungen zugreifen kann ? Combofix Logfile: Code:
ATTFilter ComboFix 13-01-16.01 - Patrick 16.01.2013 18:19:27.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.2046.1012 [GMT 1:00]
ausgeführt von:: c:\users\Patrick\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Adobe\Jw.wmv
c:\users\Patrick\mbam-setup-1.70.0.1100.exe
c:\users\Patrick\S1914JavaInstaller.exe
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-12-16 bis 2013-01-16 ))))))))))))))))))))))))))))))
.
.
2013-01-16 17:27 . 2013-01-16 17:27 -------- d-----w- c:\users\Patrick\AppData\Local\temp
2013-01-16 17:27 . 2013-01-16 17:27 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-01-15 20:12 . 2013-01-15 20:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-01-15 20:12 . 2012-12-14 15:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-01-15 10:57 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D9ECE38E-004A-4FC2-8C2B-E1C437EF583E}\mpengine.dll
2013-01-09 21:34 . 2013-01-09 21:34 -------- d-----w- c:\users\Patrick\AppData\Roaming\EIZO
2013-01-09 21:34 . 2013-01-09 21:34 -------- d-----w- c:\users\Patrick\AppData\Local\Downloaded Installations
2013-01-09 21:30 . 2013-01-09 21:34 -------- d-----w- c:\program files\EIZO
2013-01-09 21:30 . 2013-01-09 21:30 -------- d-----w- c:\programdata\EIZO
2013-01-09 18:07 . 2012-11-23 01:35 2048000 ----a-w- c:\windows\system32\win32k.sys
2013-01-09 18:07 . 2012-11-02 10:19 1400832 ----a-w- c:\windows\system32\msxml6.dll
2013-01-09 18:07 . 2012-11-20 04:22 204288 ----a-w- c:\windows\system32\ncrypt.dll
2012-12-26 17:46 . 2012-12-16 13:12 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-26 17:46 . 2012-12-16 10:50 293376 ----a-w- c:\windows\system32\atmfd.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-09 18:10 . 2012-03-29 16:01 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-09 18:10 . 2011-07-10 12:56 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-13 01:29 . 2012-12-12 20:22 2048 ----a-w- c:\windows\system32\tzres.dll
2012-11-10 01:48 . 2012-12-12 20:22 1383424 ----a-w- c:\windows\system32\mshtml.tlb
2012-11-02 10:18 . 2012-12-12 20:22 376320 ----a-w- c:\windows\system32\dpnet.dll
2012-11-02 08:26 . 2012-12-12 20:22 23040 ----a-w- c:\windows\system32\dpnsvr.exe
2012-10-27 03:52 . 2012-12-12 20:22 834048 ----a-w- c:\windows\system32\wininet.dll
2012-10-27 02:14 . 2012-12-12 20:22 389632 ----a-w- c:\windows\system32\html.iec
2011-03-13 17:58 . 2011-03-13 17:58 456704 ----a-w- c:\program files\NuclearReactor_1_2.exe
2007-11-23 11:03 . 2007-12-18 16:12 1236992 ----a-w- c:\program files\cpuz.exe
2007-10-27 13:19 . 2007-12-18 16:06 24576 ----a-w- c:\program files\memtest.exe
2007-08-21 12:50 . 2007-12-18 16:58 185856 ----a-w- c:\program files\Core Temp.exe
2013-01-11 11:37 . 2013-01-11 11:37 262704 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="e:\counterstrie source\steam.exe" [2012-12-03 1354736]
"GMX_GMX MultiMessenger"="c:\program files\GMX\GMX MultiMessenger\MESSENGR.EXE" [2009-04-17 5031336]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 221184]
"Facebook Update"="c:\users\Patrick\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096]
"GarenaPlus"="c:\program files\Garena Plus\GarenaMessenger.exe" [2012-11-02 8776056]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\programme\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 90112]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]
"Launch LGDCore"="c:\program files\Common Files\Logitech\G-series Software\LGDCore.exe" [2006-07-23 1126400]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-12 4186112]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-31 36864]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-03-01 190808]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-08-09 348664]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"ScreenManager Pro for LCD (DDCCI)"="c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe" [2012-05-27 4875672]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
EIZO ScreenSlicer.lnk - c:\windows\Installer\{292A177D-723F-4537-9985-BC8BFCD8B63D}\NewShortcut1_ECE901F38F8D425291BF1815F96683B4.exe [2013-1-9 61440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Vid]
2011-01-13 02:01 6129496 ----a-w- c:\program files\Logitech\Vid HD\Vid.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44 3883840 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiSpywareOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2013-01-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 18:10]
.
2013-01-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2481620165-4217138233-3408023960-1000Core.job
- c:\users\Patrick\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-12 16:58]
.
2013-01-16 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2481620165-4217138233-3408023960-1000UA.job
- c:\users\Patrick\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-12 16:58]
.
2013-01-15 c:\windows\Tasks\User_Feed_Synchronization-{7FCA0E7B-7529-4C72-8CAE-62BBD24A8E7F}.job
- c:\windows\system32\msfeedssync.exe [2008-05-17 07:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\7y1omo7k.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://web.de/
FF - prefs.js: network.proxy.type - 4
FF - ExtSQL: !HIDDEN! 2009-07-22 19:39; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-01-16 18:27
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\users\Patrick\AppData\Local\Temp\KPU1CBA.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-01-16 18:30:53
ComboFix-quarantined-files.txt 2013-01-16 17:30
.
Vor Suchlauf: 631.128.064 Bytes frei
Nach Suchlauf: 1.526.521.856 Bytes frei
.
- - End Of File - - 9EC5DE8C37FA0AE875343003580EE50B
Update for Microsoft Office 2007 (KB2508958) Adobe Flash Player 11 Plugin Adobe Reader 7.0 ATI Catalyst Control Center Ex ATI Catalyst Install Manager µTorrent aTube Catcher Avira Free Antivirus Call of Duty(R) 4 - Modern Warfare(TM) Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch CameraHelperMsi Canon MP Navigator EX 1.0 Canon MP610 series Canon MP610 series Benutzerregistrierung Canon My Printer Canon Utilities Solution Menu Catalyst Control Center - Branding Catalyst Control Center InstallProxy CCleaner CD-LabelPrint Counter-Strike Counter-Strike: Source Day of Defeat: Source DMIView B7.0108.01 EIZO ScreenSlicer erLT Facebook Video Calling 1.2.0.287 Falcon 4.0: Allied Force FEARCombat FileZilla Client 3.3.5.1 FolderVisualizer Free PDF to Word Doc Converter v1.1 Gigabyte Raid Configurer GMX MultiMessenger GTA2 Half-Life 2: Deathmatch Half-Life 2: Lost Coast Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) ICQ Sparberater ICQ7.6 Java 7 Update 10 Java Auto Updater Java(TM) 6 Update 3 KaloMa 4.72 LG USB Modem Drivers Logitech G11 Keyboard Software 1.03 Logitech Vid HD Logitech Webcam Software LWS Facebook LWS Gallery LWS Help_main LWS Launcher LWS Motion Detection LWS Pictures And Video LWS Twitter LWS Video Mask Maker LWS VideoEffects LWS Webcam Software LWS WLM Plugin LWS YouTube Plugin Malwarebytes Anti-Malware Version 1.70.0.1100 Marvell Miniport Driver Microsoft .NET Framework 3.5 Language Pack SP1 - deu Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Application Error Reporting Microsoft Choice Guard Microsoft Flight Simulator 2004 - Das Jahrhundert der Luftfahrt Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (German) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (German) 2007 Microsoft Office File Validation Add-In Microsoft Office Groove MUI (German) 2007 Microsoft Office InfoPath MUI (German) 2007 Microsoft Office OneNote MUI (German) 2007 Microsoft Office Outlook MUI (German) 2007 Microsoft Office PowerPoint MUI (German) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (German) 2007 Microsoft Office Proof (Italian) 2007 Microsoft Office Proofing (German) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (German) 2007 Microsoft Office Shared MUI (German) 2007 Microsoft Office Word MUI (German) 2007 Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Mozilla Firefox 18.0 (x86 de) Mozilla Maintenance Service MSVCRT MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB941833) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Notepad++ Prime95 Realtek High Definition Audio Driver ScreenManager Pro for LCD (DDC/CI) Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition SideWinder Force Feedback 2 Source SDK Source SDK Base Spybot - Search & Destroy 1.5.2.20 Steam(TM) T4E Player TrackMania Nations Forever Uninstall 1.0.0.1 Update für Microsoft Office Excel 2007 Help (KB963678) Update für Microsoft Office Outlook 2007 Help (KB963677) Update für Microsoft Office Powerpoint 2007 Help (KB963669) Update für Microsoft Office Word 2007 Help (KB963665) Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2760586) 32-Bit Edition VideoLAN VLC media player 0.8.6d vroute.info Windows Live-Uploadtool Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Messenger Windows Media Player Firefox Plugin WinRAR ALso der PC lief vorher deutlich besser merke ich jetzt in vielen Situationen.. :O Geändert von Pocca (16.01.2013 um 19:14 Uhr) |
|
17.01.2013, 12:08
| #8 |
| /// Helfer-Team | GVU Trojaner Sehr gut!  ESET Online Scanner Vorbereitung
|
|
17.01.2013, 13:28
| #9 |
| | GVU Trojaner Ok mache ich, aber ist es normal, dass ich nicht mehr auf Dokumente und Einstellungen zugreifen kann ? Mir ist aufgefallen das Verknüpfungen angelegt wurden für Programme und für DOkumente und EInstellungen nur der Originalordner Dokumente und Einstellungen ist weg. Es wurden irgendwie auch einige leere Ordner angelegt. Geändert von Pocca (17.01.2013 um 13:37 Uhr) |
|
18.01.2013, 13:20
| #10 |
| /// Helfer-Team | GVU Trojaner Bitte nochmal neustarten. |
|
18.01.2013, 14:11
| #11 |
| | GVU Trojaner Also den PC habe ich neugestartet, ist aber immer noch das selbe Problem. Soll ich Combofix nochmal laufen lassen ? Oder werden die Ordner entfernt wenn ich Combofix rutnerschmeiße. Lasse jetzt grad ESET laufen. ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6889 # api_version=3.0.2 # EOSSerial=20ae82ef4ca49b4d9b2c01f2bdb8111b # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-01-18 01:48:30 # local_time=2013-01-18 02:48:30 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=1799 16775165 100 100 12342 223940200 70828 0 # compatibility_mode=5892 16776574 100 100 273070 196049638 0 0 # scanned=250470 # found=6 # cleaned=6 # scan_time=7380 C:\Users\Patrick\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\336e6d0b-4b18bef5 a variant of Java/Exploit.CVE-2012-1723.AJ trojan (deleted - quarantined) CDAADDBF672777328D09D276531439225661937B C C:\Users\Patrick\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\421ac544-18f83d35 a variant of Java/Exploit.CVE-2011-3544.BR trojan (deleted - quarantined) B6415C0F87EFB9D3060746B38D229B8A579709D2 C C:\Users\Patrick\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\7836af29-20e2e660 Java/Agent.FH trojan (cleaned by deleting - quarantined) 5D83DCF74FABC5A777F39B3BAA61C355FF28F6D8 C C:\Users\Patrick\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\1e807eb2-1e911c1b multiple threats (deleted - quarantined) B03CFBEB677ACA6A880B22E4057CF38B4873B5A3 C E:\AoE2\Age of Empires 2\AOE 2\Age Of Empires 2 & The Conquerors\Data\config.exe a variant of Win32/Delf.QZL trojan (cleaned by deleting - quarantined) B62EF2E24D57A50DAE8942925B87A6FA6BE83CAF C E:\Neuer Ordner\AoE2\Age of Empires 2\AOE 2\Age Of Empires 2 & The Conquerors\Data\config.exe a variant of Win32/Delf.QZL trojan (cleaned by deleting - quarantined) B62EF2E24D57A50DAE8942925B87A6FA6BE83CAF C |
|
18.01.2013, 18:13
| #12 |
| /// Helfer-Team | GVU Trojaner Du kannst die leeren Ordner auch selbst entfernen. Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck Java deaktivieren Aufgrund derezeitigen Sicherheitsluecke: http://www.trojaner-board.de/122961-...ktivieren.html Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck |
|
18.01.2013, 19:33
| #13 |
| | GVU Trojaner Konnte das Java TM6 Update 3 vom 24.11.2007 nicht deinstallieren, es erscheint die Fehlermeldung "auf den Windows Installer-Dienst konnte nicht zugegriffen werden". Bei den Plug Ins erscheint folgendes: PluginCheck Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen. Überprüft wird: Browser, Flash, Java und Adobe Reader Version. Firefox 18.0 ist aktuell Flash (11,5,502,146) ist aktuell. Java ist Installiert aber nicht aktiviert. Adobe Reader 10,1,4,38 ist veraltet! Aktualisieren Sie bitte auf die neueste Version: 11.0 Adobe habe ich gerade erst geupdatet und Java auch. Das komische ist das Java die ganze Zeit aktiviert ist aber trotzdem als nicht aktiviert angezeigt wird, trotzdem habe ich es nach euren Vorgaben deaktiviert. |
|
19.01.2013, 15:03
| #14 | |
| /// Helfer-Team | GVU TrojanerZitat:
Sehr gut! damit bist Du sauber und entlassen!  adwCleaner entfernen
Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Zurücksetzen der Sicherheitszonen Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen. Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html Systemwiederherstellungen leeren Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein: Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7 Danach wieder aktivieren. Aufräumen mit CCleaner Lasse mit CCleaner (Download) (Anleitung) Fehler in der
Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html http://www.trojaner-board.de/109844-...ren-seite.html PC wird immer langsamer - was tun? |
|
19.01.2013, 22:07
| #15 |
| | GVU Trojaner Sehr gut, hat alles wunderbar geklappt  Vielen Dank für die Hilfe! Malwarebyte kann man ja noch drauf lassen um sich vor Malware zu schützen oder ? |
|
Linear-Darstellung
