| |
| |||||||
Log-Analyse und Auswertung: Verlinkung einzelner Wörter zu Pop-up Fenstern!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
15.03.2013, 21:49
| #1 |
| |  Verlinkung einzelner Wörter zu Pop-up Fenstern! Hi, habe das gleiche Problem wie Katti (http://www.trojaner-board.de/131554-...pare-info.html). Hab bereits die Logfiles vom ADW Cleaner und beide von OTL. Wie gehts jetzt weiter? Gruß und Danke Denni |
|
15.03.2013, 23:14
| #2 | |
| /// TB-Ausbilder   | Verlinkung einzelner Wörter zu Pop-up Fenstern! Hi,
__________________Zitat:
(Die Logfiles bitte nicht anhängen, sondern deren Inhalt direkt innerhalb von Codetags einfügen: [code]Inhalt Logfile[/code].)
__________________ |
|
16.03.2013, 11:41
| #3 |
| | Verlinkung einzelner Wörter zu Pop-up Fenstern! AdwCleaner Logfile:
__________________Code:
ATTFilter # AdwCleaner v2.114 - Datei am 16/03/2013 um 08:54:49 erstellt
# Aktualisiert am 05/03/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzer : User - USER-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\User\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Ordner Gelöscht : C:\ProgramData\AVG Security Toolbar
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Tarma Installer
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\5e08c8fe26fbe44
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\BabylonToolbar
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\PIP
Schlüssel Gelöscht : HKLM\SOFTWARE\5e08c8fe26fbe44
Schlüssel Gelöscht : HKLM\Software\AVG Secure Search
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\Software\Tarma Installer
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16470
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.delta-search.com/?affID=119776&tt=100313_9111gen&babsrc=HP_ss&mntrId=56BF582C80139263 --> hxxp://www.google.com
-\\ Mozilla Firefox v19.0.2 (de)
-\\ Google Chrome v25.0.1364.172
*************************
AdwCleaner[S1].txt - [2821 octets] - [16/03/2013 08:54:49]
########## EOF - C:\AdwCleaner[S1].txt - [2881 octets] ##########
OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 16.03.2013 09:07:12 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\User\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,99 Gb Total Physical Memory | 0,94 Gb Available Physical Memory | 47,27% Memory free
3,98 Gb Paging File | 2,67 Gb Available in Paging File | 67,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100,00 Gb Total Space | 25,52 Gb Free Space | 25,52% Space Free | Partition Type: NTFS
Drive D: | 197,99 Gb Total Space | 193,25 Gb Free Space | 97,61% Space Free | Partition Type: NTFS
Computer Name: USER-PC | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A15C0B7-1FE6-4D5D-971F-955B1961F565}" = rport=445 | protocol=6 | dir=out | app=system |
"{163660D1-96E0-4FC8-9F12-AE43B99CB674}" = lport=2869 | protocol=6 | dir=in | app=system |
"{1E41994B-955B-4DDF-9CA4-7A0593EA150D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2481C4DE-1886-43E9-AFD1-AEA379BF9487}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2D3E6957-73B8-4DE3-A177-C2938A15DB21}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3034E20E-29F5-4157-B826-3FF8BE0C78B3}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3AB47F9A-4B59-492F-8393-EB9C5C19EABD}" = lport=138 | protocol=17 | dir=in | app=system |
"{47F48D3A-6FB2-4437-A2E6-F875C9F6135A}" = rport=139 | protocol=6 | dir=out | app=system |
"{4F3C6BAA-C048-42FD-81EF-AFD97F0B0D6C}" = lport=139 | protocol=6 | dir=in | app=system |
"{5BD703FC-FE41-4401-ACD5-F9DCEF385E69}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{81FB25D0-6BF3-4D0C-B026-9610275238E3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{824854FA-19F8-4841-9BC3-F104B5617373}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8683C404-2C8C-4673-8D61-F774ECE342DE}" = rport=137 | protocol=17 | dir=out | app=system |
"{A53A83CD-4CF0-4C42-9B38-678C031D3F7F}" = lport=137 | protocol=17 | dir=in | app=system |
"{AD287081-6B82-4795-B124-A6573DB81300}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B0EDD7DB-85B1-4EB0-B7AD-837CD30243CE}" = rport=138 | protocol=17 | dir=out | app=system |
"{B3AFCD7A-8DF8-4260-9A72-B231E13F1479}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C61D59BF-6888-483D-9A84-11FE3AF24750}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{DBD5B727-5829-4914-88CB-99F391E1FEFD}" = rport=10243 | protocol=6 | dir=out | app=system |
"{E02D7487-0B5E-4405-973F-E802AE32A5C4}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{EFC3F659-FCA6-4FD0-B7EC-0BEE92263ECC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F0903772-BC30-4FA1-BFE2-5B4B605993E2}" = lport=445 | protocol=6 | dir=in | app=system |
"{F62C6355-E5F2-4FBC-A472-718114793C9F}" = lport=10243 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{042BA4EA-FCD3-4E80-A2D2-2E0BB36DF25F}" = protocol=6 | dir=out | app=system |
"{268273C8-0E4A-48B1-B841-BBA7DA4DDD7A}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{2ADEF0E1-1761-48EB-9EAC-4D0A9E359DE7}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{2E21B187-8075-4DE6-A4AD-2313E403ED3D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{34C5F8F8-01C0-40FD-A8F5-DCE3582B9EB4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{369EF188-CFE3-4DE3-91F4-4E876DED10B3}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3B6DD58F-8972-494F-BB84-25FF02EEE91E}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{4AFC0E25-FA88-4B44-8227-21EB41040662}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{4FB2180A-DFC4-4585-ADC0-F42654F21B9D}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{590EB4F9-3492-4BA5-AD4F-4C46BB5114F4}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{5CA505AB-8C56-428E-A70A-24B793AD6054}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6E1FF2CB-E8F2-4677-9FAF-A99562E2ED34}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{70A264C1-F53F-4F12-872E-A3BF581C94F9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{786CB91E-D354-4892-B826-B8FE9AF55EA9}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{864873D2-753B-4C95-8CCC-4EB7A49F8348}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8CA06D70-A649-40A3-AE1A-6D536883B163}" = protocol=6 | dir=in | app=c:\users\user\appdata\roaming\dropbox\bin\dropbox.exe |
"{92C9925E-DC91-4328-9D54-21C5DCDA0146}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{94BBCD23-D3FA-48BB-8517-664FDB682BC1}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{978900FB-8580-4961-9460-DBB48092EC3D}" = protocol=17 | dir=in | app=c:\users\user\appdata\roaming\dropbox\bin\dropbox.exe |
"{9CAA9CEE-3E72-4E4C-AE01-C687881DED4F}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{A35ADE65-B3DB-41B1-858A-A1C448099921}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A46F87B4-A685-4494-BAC6-10FC9569DC14}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A6BFB45A-485F-471F-866F-87B3CB669A3A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A8250815-6BD8-44F8-802D-F9A34B46F324}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{AB029BC1-CCCD-4A68-B547-A1F38D2D7FCF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{B088A66E-1304-4AD1-BD43-86D465B763E5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BB988B4B-0424-441F-AFF7-4DF9CC40D668}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{D2613FA1-A0D4-4618-A998-6CD0C14212C2}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{D5414286-6A4E-4B42-A56E-DD845D0E8924}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{D5BD8E36-3658-41FC-A59E-2820E766465F}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{E536D889-4301-4774-B9B7-81035CAB515C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{ED021805-6692-413F-9B5C-625C6925347F}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{FB2B2F9D-2575-4B15-A5BC-888A2A6643F7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FE1AD2AC-4C00-4953-9EEE-81276D99E4D6}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"TCP Query User{D6B7276E-C72B-4398-A205-94B07787503F}C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\user\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{1EE870CB-B35B-4BB2-B72E-9F45BAACB330}C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\user\appdata\roaming\dropbox\bin\dropbox.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{241DBC8D-14E3-4240-8EE5-3AC35086B638}" = AVG 2013
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Qualcomm Atheros Client Installation Program
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{459699C3-9430-4381-964B-4248D87B49F9}" = Apple Mobile Device Support
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}" = Vodafone Mobile Broadband
"{6F8CBBFB-7986-4140-91EC-D8C7F1EC8DF3}" = AVG 2013
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AVG" = AVG 2013
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"Google Chrome" = Google Chrome
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Mobile Broadband HL Service" = Mobile Broadband HL Service
"Mozilla Firefox 19.0.2 (x86 de)" = Mozilla Firefox 19.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Picasa 3" = Picasa 3
"VLC media player" = VLC media player 2.0.1
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 08.02.2013 16:17:39 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 09.02.2013 08:41:14 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 09.02.2013 15:55:58 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 10.02.2013 07:54:38 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 10.02.2013 23:54:48 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 12.02.2013 00:58:15 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 13.02.2013 01:17:39 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 14.02.2013 17:27:06 | Computer Name = User-PC | Source = System Restore | ID = 8193
Description =
Error - 15.02.2013 17:22:37 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 16.02.2013 00:03:07 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
[ Media Center Events ]
Error - 13.12.2012 20:26:51 | Computer Name = User-PC | Source = MCUpdate | ID = 0
Description = 13:26:44 - Fehler beim Herstellen der Internetverbindung. 13:26:44
- Serververbindung konnte nicht hergestellt werden..
Error - 19.12.2012 15:08:15 | Computer Name = User-PC | Source = MCUpdate | ID = 0
Description = 08:08:08 - Fehler beim Herstellen der Internetverbindung. 08:08:08
- Serververbindung konnte nicht hergestellt werden..
Error - 30.12.2012 05:38:19 | Computer Name = User-PC | Source = MCUpdate | ID = 0
Description = 22:38:19 - Fehler beim Herstellen der Internetverbindung. 22:38:19
- Serververbindung konnte nicht hergestellt werden..
Error - 30.12.2012 05:38:33 | Computer Name = User-PC | Source = MCUpdate | ID = 0
Description = 22:38:24 - Fehler beim Herstellen der Internetverbindung. 22:38:24
- Serververbindung konnte nicht hergestellt werden..
Error - 30.12.2012 06:38:41 | Computer Name = User-PC | Source = MCUpdate | ID = 0
Description = 23:38:41 - Fehler beim Herstellen der Internetverbindung. 23:38:41
- Serververbindung konnte nicht hergestellt werden..
Error - 30.12.2012 06:38:55 | Computer Name = User-PC | Source = MCUpdate | ID = 0
Description = 23:38:46 - Fehler beim Herstellen der Internetverbindung. 23:38:46
- Serververbindung konnte nicht hergestellt werden..
Error - 30.12.2012 07:39:04 | Computer Name = User-PC | Source = MCUpdate | ID = 0
Description = 00:39:04 - Fehler beim Herstellen der Internetverbindung. 00:39:04
- Serververbindung konnte nicht hergestellt werden..
Error - 30.12.2012 07:39:17 | Computer Name = User-PC | Source = MCUpdate | ID = 0
Description = 00:39:09 - Fehler beim Herstellen der Internetverbindung. 00:39:09
- Serververbindung konnte nicht hergestellt werden..
Error - 16.01.2013 03:18:22 | Computer Name = User-PC | Source = MCUpdate | ID = 0
Description = 20:18:22 - Fehler beim Herstellen der Internetverbindung. 20:18:22
- Serververbindung konnte nicht hergestellt werden..
Error - 16.01.2013 03:18:38 | Computer Name = User-PC | Source = MCUpdate | ID = 0
Description = 20:18:29 - Fehler beim Herstellen der Internetverbindung. 20:18:29
- Serververbindung konnte nicht hergestellt werden..
[ System Events ]
Error - 03.03.2013 22:03:39 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "USER-PC :0" konnte nicht auf der Schnittstelle mit
IP-Adresse 10.100.238.64 registriert werden. Der Computer mit IP-Adresse 10.100.131.57
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 03.03.2013 22:03:39 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "USER-PC :20" konnte nicht auf der Schnittstelle mit
IP-Adresse 10.100.238.64 registriert werden. Der Computer mit IP-Adresse 10.100.131.57
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 03.03.2013 22:36:26 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit
IP-Adresse 10.100.238.64 registriert werden. Der Computer mit IP-Adresse 10.100.131.57
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 03.03.2013 22:38:46 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit
IP-Adresse 10.100.238.64 registriert werden. Der Computer mit IP-Adresse 10.100.211.250
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 03.03.2013 22:40:04 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit
IP-Adresse 10.100.238.64 registriert werden. Der Computer mit IP-Adresse 10.100.211.250
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 04.03.2013 00:43:48 | Computer Name = User-PC | Source = bowser | ID = 8003
Description =
Error - 04.03.2013 05:34:15 | Computer Name = User-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst ShellHWDetection erreicht.
Error - 04.03.2013 07:36:56 | Computer Name = User-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst Netman erreicht.
Error - 04.03.2013 19:33:57 | Computer Name = User-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst WwanSvc erreicht.
Error - 04.03.2013 22:11:57 | Computer Name = User-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst ShellHWDetection erreicht.
< End of report >
OTL Logfile: Code:
ATTFilter OTL logfile created on: 16.03.2013 09:07:12 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\User\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 0,94 Gb Available Physical Memory | 47,27% Memory free 3,98 Gb Paging File | 2,67 Gb Available in Paging File | 67,16% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 100,00 Gb Total Space | 25,52 Gb Free Space | 25,52% Space Free | Partition Type: NTFS Drive D: | 197,99 Gb Total Space | 193,25 Gb Free Space | 97,61% Space Free | Partition Type: NTFS Computer Name: USER-PC | User Name: User | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.03.16 09:02:05 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe PRC - [2013.03.13 21:41:26 | 001,822,424 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe PRC - [2013.03.09 02:08:59 | 000,917,400 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2012.12.19 03:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.12.14 16:49:28 | 000,512,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.12.11 03:52:44 | 003,147,384 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgui.exe PRC - [2012.11.23 15:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2012.11.15 23:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgidsagent.exe PRC - [2012.10.30 04:59:56 | 000,726,648 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgrsx.exe PRC - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe PRC - [2012.10.22 13:04:32 | 001,116,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgnsx.exe PRC - [2012.10.22 13:03:52 | 000,796,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgemcx.exe PRC - [2012.10.22 13:03:46 | 000,440,440 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgcsrvx.exe PRC - [2012.09.04 21:27:53 | 000,233,864 | ---- | M] () -- C:\ProgramData\MobileBrServ\mbbService.exe PRC - [2012.08.13 11:08:08 | 010,376,704 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe PRC - [2012.08.13 11:08:08 | 010,368,512 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin PRC - [2012.03.20 13:08:30 | 000,008,704 | ---- | M] (Vodafone) -- C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe PRC - [2011.02.25 18:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.08.18 14:36:36 | 000,348,160 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe PRC - [2009.08.18 14:36:08 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe ========== Modules (No Company Name) ========== MOD - [2013.03.13 21:41:25 | 014,717,144 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_6_602_180.dll MOD - [2013.03.09 02:08:57 | 003,069,848 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll MOD - [2012.08.10 16:51:32 | 000,985,088 | ---- | M] () -- C:\Program Files\OpenOffice.org 3\program\libxml2.dll ========== Services (SafeList) ========== SRV - [2013.03.13 21:41:30 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.03.09 02:08:58 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.12.19 03:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.11.24 10:45:53 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2012.11.15 23:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent) SRV - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe -- (avgwd) SRV - [2012.09.04 21:27:53 | 000,233,864 | ---- | M] () [Auto | Running] -- C:\ProgramData\MobileBrServ\mbbService.exe -- (Mobile Broadband HL Service) SRV - [2012.03.20 13:08:30 | 000,008,704 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService) SRV - [2009.08.18 14:36:08 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2009.07.14 14:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 14:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard) DRV - [2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.11.15 23:33:26 | 000,094,048 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86) DRV - [2012.10.22 13:02:46 | 000,179,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver) DRV - [2012.10.15 03:48:52 | 000,055,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX) DRV - [2012.10.02 03:30:38 | 000,159,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86) DRV - [2012.09.21 03:46:06 | 000,164,832 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix) DRV - [2012.09.21 03:46:00 | 000,177,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avglogx.sys -- (Avglogx) DRV - [2012.09.21 03:45:54 | 000,019,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim) DRV - [2012.09.18 12:29:02 | 003,015,168 | ---- | M] (Qualcomm Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2012.09.14 03:05:20 | 000,035,552 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86) DRV - [2012.08.24 03:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2012.08.24 03:41:34 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD) DRV - [2012.08.24 03:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2012.08.04 05:55:34 | 000,254,608 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtsPStor.sys -- (RSPCIESTOR) DRV - [2012.03.16 14:55:26 | 000,193,536 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_juwwanecm.sys -- (huawei_wwanecm) DRV - [2012.03.16 14:55:26 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV - [2012.03.16 14:55:26 | 000,089,856 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_jucdcacm.sys -- (huawei_cdcacm) DRV - [2012.03.16 14:55:26 | 000,073,984 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV - [2012.03.16 14:55:26 | 000,026,624 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_juextctrl.sys -- (huawei_ext_ctrl) DRV - [2012.03.16 14:55:24 | 000,011,136 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter) DRV - [2010.11.30 14:59:03 | 000,238,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1c6232.sys -- (e1cexpress) DRV - [2010.10.20 10:33:40 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\HECI.sys -- (MEI) DRV - [2009.09.21 01:43:50 | 000,123,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdm.sys -- (ss_mdm) DRV - [2009.09.21 01:43:48 | 000,098,560 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bus.sys -- (ss_bus) DRV - [2009.09.21 01:43:48 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdfl.sys -- (ss_mdfl) DRV - [2009.08.18 15:48:06 | 004,994,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2009.07.18 00:36:30 | 000,013,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.spiegel.de/" FF - prefs.js..extensions.enabledAddons: %7Bbee6eb20-01e0-ebd1-da83-080329fb9a3a%7D:1.29 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll () FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.03.09 02:08:59 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.03.09 02:08:59 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.15 07:16:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Extensions [2013.03.12 18:57:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\psxry45f.default\extensions [2013.03.09 07:24:44 | 000,000,000 | ---D | M] (Flash and Video Download) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\psxry45f.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2012.12.14 09:29:00 | 000,199,445 | ---- | M] () (No name found) -- C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\psxry45f.default\extensions\movie2kdownloader@movie2kdownloader.com.xpi [2013.02.15 10:52:09 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\psxry45f.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.03.12 18:52:10 | 000,001,294 | ---- | M] () -- C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\psxry45f.default\searchplugins\delta.xml [2013.03.09 02:08:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2013.03.09 02:08:59 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.09.06 15:07:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.06 15:07:37 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.09.06 15:07:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.09.06 15:07:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.09.06 15:07:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.09.06 15:07:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter} CHR - homepage: hxxp://www.delta-search.com/?affID=119776&tt=100313_9111gen&babsrc=HP_ss&mntrId=56BF582C80139263 CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.172\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.172\pdf.dll CHR - plugin: Norton Identity Safe (Enabled) = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nppllibpnmahfaklnpggkibhkapjkeob\2013.2.0.18_0\npcoplgn.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll CHR - Extension: Google Drive = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: Adblock Plus = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4_0\ CHR - Extension: Google-Suche = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Google Mail = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2009.06.11 10:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [Driver Genius] File not found O4 - HKLM..\Run: [MobileBroadband] C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone) O4 - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2013.01.15 21:38:20 | 000,000,000 | -H-D | M] O4 - Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2E0AEBB3-791B-4B6B-A48C-10EA215D9E6A}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{351B9E66-50D3-4311-9E61-BF79C2174615}: NameServer = 203.118.191.1 203.109.191.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{44B6BC2B-6EC2-4536-9351-A3F82E2DBC3D}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7B1FCD5D-0DA7-4808-BA2D-96D861F5A77A}: DhcpNameServer = 192.168.107.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7E371C82-AF4E-4877-B49F-F96232363DCE}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{89F616B9-142B-4E3D-9BB3-CB2423FBDFFB}: NameServer = 203.118.191.1 203.109.191.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A9694B53-66C1-4EE9-B9A5-0CD86A78C065}: NameServer = 203.118.191.1 203.109.191.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.11 10:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{224d79fc-40d3-11e2-b7f2-047d7b21b9e1}\Shell - "" = AutoRun O33 - MountPoints2\{224d79fc-40d3-11e2-b7f2-047d7b21b9e1}\Shell\AutoRun\command - "" = F:\setup_vmb_lite.exe /checkApplicationPresence O33 - MountPoints2\{3b0b4236-63ff-11e2-be91-047d7b21b9e1}\Shell - "" = AutoRun O33 - MountPoints2\{3b0b4236-63ff-11e2-be91-047d7b21b9e1}\Shell\AutoRun\command - "" = E:\setup_vmb_lite.exe /checkApplicationPresence O33 - MountPoints2\{3b6f80c3-3815-11e2-811e-74de2beeefbe}\Shell - "" = AutoRun O33 - MountPoints2\{3b6f80c3-3815-11e2-811e-74de2beeefbe}\Shell\AutoRun\command - "" = E:\setup_vmb_lite.exe /checkApplicationPresence O33 - MountPoints2\{3b6f819a-3815-11e2-811e-047d7b21b9e1}\Shell - "" = AutoRun O33 - MountPoints2\{3b6f819a-3815-11e2-811e-047d7b21b9e1}\Shell\AutoRun\command - "" = F:\setup_vmb_lite.exe /checkApplicationPresence O33 - MountPoints2\{98880c41-7b24-11e2-a831-047d7b21b9e1}\Shell - "" = AutoRun O33 - MountPoints2\{98880c41-7b24-11e2-a831-047d7b21b9e1}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{a93fc3d8-339b-11e2-8915-047d7b21b9e1}\Shell - "" = AutoRun O33 - MountPoints2\{a93fc3d8-339b-11e2-8915-047d7b21b9e1}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{a93fc3f1-339b-11e2-8915-047d7b21b9e1}\Shell - "" = AutoRun O33 - MountPoints2\{a93fc3f1-339b-11e2-8915-047d7b21b9e1}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup_vmb_lite.exe /checkApplicationPresence O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.03.16 09:02:03 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe [2013.03.16 08:24:30 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Malwarebytes [2013.03.16 08:24:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.03.16 08:24:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.03.16 08:24:08 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013.03.16 08:24:08 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013.03.16 08:23:55 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\Programs [2013.03.15 03:02:43 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2013.03.15 03:02:38 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2013.03.15 03:02:37 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2013.03.15 03:02:36 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2013.03.15 03:02:36 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2013.03.15 03:02:31 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2013.03.15 03:02:30 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2013.03.15 03:02:25 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2013.03.14 22:50:44 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usb8023.sys [2013.03.14 19:57:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3 [2013.03.12 18:51:18 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Babylon [2013.03.12 18:50:44 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\PutLockerDownloader [2013.03.12 12:39:20 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\waldi [2013.03.11 16:40:26 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\Neuer Ordner [2013.03.09 02:08:47 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013.03.08 10:43:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG [2013.03.04 00:10:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carom3D [2013.03.04 00:10:00 | 000,139,264 | ---- | C] (Neoact) -- C:\Windows\NeoUninstall.exe [2013.03.04 00:09:55 | 000,000,000 | ---D | C] -- C:\Program Files\Neoact [2013.02.28 03:01:25 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAnimation.dll [2013.02.28 03:01:14 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMPhoto.dll [2013.02.28 03:01:10 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll [2013.02.28 03:01:10 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll [2013.02.28 03:01:10 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll [2013.02.28 03:01:09 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll [2013.02.28 03:01:08 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll [2013.02.28 03:01:08 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll [2013.02.28 03:01:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll [2013.02.28 03:01:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll [2013.02.28 03:01:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll [2013.02.28 03:01:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll [2013.02.28 03:01:07 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msmpeg2vdec.dll [2013.02.28 03:01:07 | 001,988,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2013.02.28 03:01:06 | 000,604,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll [2013.02.28 03:01:06 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll [2013.02.28 03:01:06 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2013.02.28 03:01:06 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll [2013.02.28 03:01:05 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d11.dll [2013.02.28 03:01:05 | 001,080,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll [2013.02.28 03:01:05 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2013.02.28 03:01:04 | 001,247,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2013.02.28 03:01:04 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll [2013.02.28 03:01:03 | 000,207,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll [2013.02.28 03:01:02 | 003,419,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2013.02.22 21:58:35 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Apple Computer [2013.02.22 21:56:08 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2013.02.22 21:55:13 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2013.02.22 21:52:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple [2013.02.22 21:52:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple [2013.02.22 21:16:58 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\WindSolutions [2013.02.22 21:16:33 | 000,000,000 | ---D | C] -- C:\ProgramData\WindSolutions [2013.02.22 21:16:09 | 008,246,704 | ---- | C] (WindSolutions) -- C:\Users\User\Desktop\CopyTransManager.exe [2013.02.22 20:54:00 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\SharePod [2013.02.22 20:40:27 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\vivi [2013.02.21 16:28:47 | 000,000,000 | ---D | C] -- C:\ProgramData\MobileBrServ [2013.02.20 13:09:13 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\REZEPTE [2013.02.14 10:53:46 | 002,347,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2013.02.14 10:53:29 | 003,967,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2013.02.14 10:53:28 | 003,913,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2013.02.14 10:53:21 | 000,187,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS [2013.02.14 10:53:17 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll ========== Files - Modified Within 30 Days ========== [2013.03.16 09:12:01 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.03.16 09:06:06 | 000,021,472 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.03.16 09:06:06 | 000,021,472 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.03.16 09:02:05 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe [2013.03.16 08:58:35 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.03.16 08:57:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.03.16 08:57:35 | 1601,069,056 | -HS- | M] () -- C:\hiberfil.sys [2013.03.16 08:52:33 | 000,597,667 | ---- | M] () -- C:\Users\User\Desktop\adwcleaner.exe [2013.03.16 08:40:05 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.03.16 08:24:16 | 000,001,031 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.03.15 21:38:42 | 000,696,870 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.03.15 21:38:42 | 000,652,148 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.03.15 21:38:42 | 000,148,134 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.03.15 21:38:42 | 000,121,080 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.03.14 23:16:24 | 000,003,584 | ---- | M] () -- C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.03.14 19:58:26 | 000,001,028 | ---- | M] () -- C:\Users\Public\Desktop\Picasa 3.lnk [2013.03.13 21:41:26 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013.03.13 21:41:26 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2013.03.12 23:23:36 | 000,010,886 | ---- | M] () -- C:\Users\User\Desktop\WG Text.odt [2013.03.04 14:18:55 | 000,081,252 | ---- | M] () -- C:\Users\User\Desktop\P1070177(1).JPG [2013.03.04 00:10:00 | 000,000,026 | ---- | M] () -- C:\Windows\NeoSetup.INI [2013.02.26 11:42:20 | 000,003,308 | ---- | M] () -- C:\Users\User\Desktop\Email-Adressen.rtf [2013.02.24 11:35:06 | 000,007,598 | ---- | M] () -- C:\Users\User\AppData\Local\Resmon.ResmonCfg [2013.02.21 11:01:34 | 008,246,704 | ---- | M] (WindSolutions) -- C:\Users\User\Desktop\CopyTransManager.exe [2013.02.19 22:31:49 | 000,032,220 | ---- | M] () -- C:\Users\User\AppData\Roaming\UserTile.png [2013.02.17 10:10:50 | 000,297,408 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2013.03.16 08:52:30 | 000,597,667 | ---- | C] () -- C:\Users\User\Desktop\adwcleaner.exe [2013.03.16 08:24:16 | 000,001,031 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.03.14 23:16:24 | 000,003,584 | ---- | C] () -- C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.03.14 19:58:26 | 000,001,028 | ---- | C] () -- C:\Users\Public\Desktop\Picasa 3.lnk [2013.03.11 13:16:38 | 000,010,886 | ---- | C] () -- C:\Users\User\Desktop\WG Text.odt [2013.03.07 21:41:32 | 006,435,468 | ---- | C] () -- C:\Users\User\Desktop\CLIP2147.AVI [2013.03.04 14:18:53 | 000,081,252 | ---- | C] () -- C:\Users\User\Desktop\P1070177(1).JPG [2013.03.04 00:10:00 | 000,000,026 | ---- | C] () -- C:\Windows\NeoSetup.INI [2013.02.24 11:35:06 | 000,007,598 | ---- | C] () -- C:\Users\User\AppData\Local\Resmon.ResmonCfg [2013.02.19 22:31:49 | 000,032,220 | ---- | C] () -- C:\Users\User\AppData\Roaming\UserTile.png [2013.02.14 21:39:55 | 001,249,334 | ---- | C] () -- C:\Users\User\Desktop\P1010457.JPG [2013.02.14 21:39:06 | 001,275,276 | ---- | C] () -- C:\Users\User\Desktop\P1010446.JPG [2013.02.14 21:38:20 | 001,230,665 | ---- | C] () -- C:\Users\User\Desktop\P1010411.JPG [2012.11.16 06:09:12 | 000,123,780 | ---- | C] () -- C:\Windows\System32\drivers\RtConvEQ.DAT [2012.11.16 06:09:12 | 000,001,496 | ---- | C] () -- C:\Windows\System32\drivers\RtkAcerM.dat [2012.11.16 06:09:12 | 000,000,728 | ---- | C] () -- C:\Windows\System32\drivers\RtHdatEx.dat [2012.11.16 06:09:12 | 000,000,712 | ---- | C] () -- C:\Windows\System32\drivers\SamSfPa.dat [2012.11.16 06:09:12 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX2.dat [2012.11.16 06:09:12 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX1.dat [2012.11.16 06:09:12 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat [2012.11.16 06:09:12 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat [2012.03.24 03:43:08 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2012.03.24 03:43:04 | 000,033,180 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2012.03.24 03:05:32 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.03.16 14:55:44 | 000,286,678 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4 [2011.04.12 14:30:05 | 000,696,870 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2011.04.12 14:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2011.04.12 14:30:05 | 000,148,134 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2011.04.12 14:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat ========== ZeroAccess Check ========== [2009.07.14 17:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 17:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 10:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 14:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both < End of report > |
|
16.03.2013, 15:00
| #4 |
| /// TB-Ausbilder | Verlinkung einzelner Wörter zu Pop-up Fenstern! Hi, besteht das Problem weiterhin oder ist es weg?
__________________ cheers, Leo |
|
17.03.2013, 05:35
| #5 |
| | Verlinkung einzelner Wörter zu Pop-up Fenstern! Hi Leo, leider besteht das Problem noch immer. Also alles beim alten, leider. :-( |
|
17.03.2013, 12:22
| #6 | |
| /// TB-Ausbilder | Verlinkung einzelner Wörter zu Pop-up Fenstern! Hallo, und findest du diese unerwünschte Verlinkung in allen Browsern (Internet Explorer, Firefox, Chrome) oder nur in einem davon? Teste das bitte mal. Schritt 1 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 2 Warnung für Mitleser: Combofix sollte nur dann ausgeführt werden, wenn dies explizit von einem Teammitglied angewiesen wurde! Downloade dir bitte Combofix.
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
Schritt 3 Starte bitte die OTL.exe.
Bitte poste in deiner nächsten Antwort:
__________________ --> Verlinkung einzelner Wörter zu Pop-up Fenstern! |
|
17.03.2013, 12:48
| #7 |
| | Verlinkung einzelner Wörter zu Pop-up Fenstern! Hi, also bei Chrome konnte ich bisher keine blau markierten links entdecken. Ist bisher nur bei Firefox aufgetaucht! |
|
17.03.2013, 13:55
| #8 |
| /// TB-Ausbilder | Verlinkung einzelner Wörter zu Pop-up Fenstern! Ok, mach noch oben angegebene Schritte und dann schauen wir weiter.
__________________ cheers, Leo |
|
17.03.2013, 14:15
| #9 |
| | Verlinkung einzelner Wörter zu Pop-up Fenstern! Dank dir erstmal. Ich geb die Daten morgen durch. Ist schon spät hier. |
|
17.03.2013, 14:23
| #10 |
| /// TB-Ausbilder | Verlinkung einzelner Wörter zu Pop-up Fenstern! In Ordnung, danke für die Mitteilung.
__________________ cheers, Leo |
|
17.03.2013, 15:54
| #11 |
| | Verlinkung einzelner Wörter zu Pop-up Fenstern! Ok....habe die Scans doch noch durchgeführt. Hier die Logs: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.7.2 (03.15.2013:1) OS: Windows 7 Home Premium x86 Ran by User on 18.03.2013 at 2:40:45,07 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\windows\currentversion\run\\driver genius ~~~ Registry Keys Successfully deleted: [Registry Key] hkey_current_user\software\1clickdownload Successfully deleted: [Registry Key] hkey_current_user\software\sweetim Successfully deleted: [Registry Key] hkey_local_machine\software\sweetim ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Users\User\AppData\Roaming\babylon" Successfully deleted: [Folder] "C:\Program Files\driver-soft" ~~~ FireFox Successfully deleted: [File] C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\psxry45f.default\user.js Successfully deleted: [File] C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\psxry45f.default\searchplugins\delta.xml Successfully deleted the following from C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\psxry45f.default\prefs.js user_pref("extensions.delta.admin", false); user_pref("extensions.delta.aflt", "babsst"); user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}"); user_pref("extensions.delta.autoRvrt", "false"); user_pref("extensions.delta.dfltLng", "en"); user_pref("extensions.delta.excTlbr", false); user_pref("extensions.delta.id", "56bffcb5000000000000582c80139263"); user_pref("extensions.delta.instlDay", "15776"); user_pref("extensions.delta.instlRef", "sst"); user_pref("extensions.delta.newTab", false); user_pref("extensions.delta.prdct", "delta"); user_pref("extensions.delta.prtnrId", "delta"); user_pref("extensions.delta.rvrt", "false"); user_pref("extensions.delta.smplGrp", "none"); user_pref("extensions.delta.tlbrId", "base"); user_pref("extensions.delta.tlbrSrchUrl", ""); user_pref("extensions.delta.vrsn", "1.8.10.0"); user_pref("extensions.delta.vrsnTs", "1.8.10.018:52:04"); user_pref("extensions.delta.vrsni", "1.8.10.0"); user_pref("extensions.ffxtlbr@delta.com.install-event-fired", true); Emptied folder: C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\psxry45f.default\minidumps [170 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 18.03.2013 at 2:58:39,75 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Combofix Logfile: Code:
ATTFilter ComboFix 13-03-17.01 - User 18.03.2013 3:16.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.2036.938 [GMT 13:00]
ausgeführt von:: c:\users\User\Desktop\ComboFix.exe
AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-02-17 bis 2013-03-17 ))))))))))))))))))))))))))))))
.
.
2013-03-17 14:32 . 2013-03-17 14:32 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-03-17 13:40 . 2013-03-17 13:40 -------- d-----w- c:\windows\ERUNT
2013-03-17 13:40 . 2013-03-17 13:40 -------- d-----w- C:\JRT
2013-03-15 19:24 . 2013-03-15 19:24 -------- d-----w- c:\users\User\AppData\Roaming\Malwarebytes
2013-03-15 19:24 . 2013-03-15 19:24 -------- d-----w- c:\programdata\Malwarebytes
2013-03-15 19:24 . 2013-03-15 19:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-03-15 19:24 . 2012-12-14 03:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-15 19:23 . 2013-03-15 19:23 -------- d-----w- c:\users\User\AppData\Local\Programs
2013-03-14 09:50 . 2013-02-12 03:32 15872 ----a-w- c:\windows\system32\drivers\usb8023x.sys
2013-03-14 09:50 . 2013-02-12 03:32 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-03-12 05:50 . 2013-03-12 05:50 -------- d-----w- c:\users\User\AppData\Local\PutLockerDownloader
2013-03-03 11:10 . 2009-07-16 03:32 139264 ----a-w- c:\windows\NeoUninstall.exe
2013-03-03 11:09 . 2013-03-03 11:09 -------- d-----w- c:\program files\Neoact
2013-02-22 08:58 . 2013-02-23 22:12 -------- d-----w- c:\users\User\AppData\Roaming\Apple Computer
2013-02-22 08:56 . 2013-02-22 08:56 -------- d-----w- c:\program files\iTunes
2013-02-22 08:52 . 2013-02-22 08:56 -------- d-----w- c:\program files\Common Files\Apple
2013-02-22 08:52 . 2013-02-22 08:54 -------- d-----w- c:\programdata\Apple
2013-02-22 08:16 . 2013-02-22 08:56 -------- d-----w- c:\users\User\AppData\Roaming\WindSolutions
2013-02-22 08:16 . 2013-02-22 08:44 -------- d-----w- c:\programdata\WindSolutions
2013-02-22 07:54 . 2013-02-22 07:54 -------- d-----w- c:\users\User\AppData\Roaming\SharePod
2013-02-21 03:28 . 2013-02-21 03:28 -------- d-----w- c:\programdata\MobileBrServ
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-13 08:41 . 2012-09-07 14:26 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-13 08:41 . 2012-09-07 14:26 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-12 04:48 . 2013-03-13 22:32 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-13 22:32 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-01-16 08:23 . 2012-11-24 05:07 893552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-01-16 08:21 . 2012-11-24 05:06 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-01-16 08:21 . 2012-11-17 15:51 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2013-01-05 05:00 . 2013-02-13 21:53 3967848 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-05 05:00 . 2013-02-13 21:53 3913064 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-01-04 04:50 . 2013-02-13 21:53 169984 ----a-w- c:\windows\system32\winsrv.dll
2013-01-04 03:00 . 2013-02-13 21:53 2347008 ----a-w- c:\windows\system32\win32k.sys
2013-01-03 05:05 . 2013-02-13 21:53 1293672 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-01-03 05:04 . 2013-02-13 21:53 187752 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2013-01-02 05:36 . 2012-11-17 15:51 893552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2013-01-02 05:36 . 2012-11-17 15:51 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2013-03-08 13:08 . 2013-03-08 13:08 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-01-07 18705664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-10-25 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-10-25 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-10-25 150552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2012-11-15 7600672]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2012-11-15 1833504]
"MobileBroadband"="c:\program files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe" [2012-03-20 69632]
"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-12-10 3147384]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
.
c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled
Dropbox.lnk - c:\users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-1-21 28539272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [x]
R2 Mobile Broadband HL Service;Mobile Broadband HL Service;c:\programdata\MobileBrServ\mbbservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x]
R3 MEI;Intel(R) Management Engine Interface ;c:\windows\system32\drivers\HECI.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 VmbService;Vodafone-Mobile-Broadband-Dienst;c:\program files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvc
GPSvcGroup REG_MULTI_SZ GPSvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-03-13 04:14 1629648 ----a-w- c:\program files\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-03-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-07 08:41]
.
2013-03-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-11-16 17:02]
.
2013-03-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-11-16 17:02]
.
2013-01-21 c:\windows\Tasks\ROC_REG_JAN_DELETE.job
- c:\programdata\AVG January 2013 Campaign\ROC.exe [2013-01-20 21:16]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: Interfaces\{351B9E66-50D3-4311-9E61-BF79C2174615}: NameServer = 203.118.191.1 203.109.191.1
TCP: Interfaces\{89F616B9-142B-4E3D-9BB3-CB2423FBDFFB}: NameServer = 203.118.191.1 203.109.191.1
TCP: Interfaces\{A9694B53-66C1-4EE9-B9A5-0CD86A78C065}: NameServer = 203.109.191.1 203.118.191.1
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\psxry45f.default\
FF - prefs.js: browser.search.selectedEngine - LEO Eng-Deu
FF - prefs.js: browser.startup.homepage - hxxp://www.spiegel.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Driver Genius Professional Edition_is1 - c:\program files\Driver-Soft\DriverGenius\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(5556)
c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
Zeit der Fertigstellung: 2013-03-18 03:37:12
ComboFix-quarantined-files.txt 2013-03-17 14:37
.
Vor Suchlauf: 7 Verzeichnis(se), 29.179.731.968 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 28.949.651.456 Bytes frei
.
- - End Of File - - D456D7DA7DF597898DBB2F4D0BD73C07
|
|
17.03.2013, 16:07
| #12 |
| /// TB-Ausbilder | Verlinkung einzelner Wörter zu Pop-up Fenstern! Ok, fehlt nur noch das firsche OTL-Log. Die Verlinkungen sind im Firefox weiterhin vorhanden?
__________________ cheers, Leo |
|
17.03.2013, 16:26
| #13 |
| | Verlinkung einzelner Wörter zu Pop-up Fenstern! Also.....Problem gelöst. Verantwortlich für die nervigen Verlinkungen war ein unseriöses Ad-on bei Firefox. Dort sollte man als erstes nachschauen,bevor man gleich das schlimmste befürchtet! Danke dennoch für den Support! |
|
17.03.2013, 16:34
| #14 | |
| /// TB-Ausbilder | Verlinkung einzelner Wörter zu Pop-up Fenstern!Zitat:
Möchtest du den Malware-Check trotzdem noch zu Ende bringen?
__________________ cheers, Leo |
|
18.03.2013, 00:05
| #15 |
| | Verlinkung einzelner Wörter zu Pop-up Fenstern! Schuld daran war ein Ad-on von "movie2kdownloader". Sobald es entfernt ist, verschwinden die lästigen Verlinkungen. Und hier noch die 2 Logfiles vom OTL:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 18.03.2013 11:45:11 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\User\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,99 Gb Total Physical Memory | 1,20 Gb Available Physical Memory | 60,13% Memory free
3,98 Gb Paging File | 2,80 Gb Available in Paging File | 70,43% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100,00 Gb Total Space | 26,89 Gb Free Space | 26,89% Space Free | Partition Type: NTFS
Drive D: | 197,99 Gb Total Space | 193,25 Gb Free Space | 97,61% Space Free | Partition Type: NTFS
Drive E: | 47,90 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: USER-PC | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A15C0B7-1FE6-4D5D-971F-955B1961F565}" = rport=445 | protocol=6 | dir=out | app=system |
"{163660D1-96E0-4FC8-9F12-AE43B99CB674}" = lport=2869 | protocol=6 | dir=in | app=system |
"{1E41994B-955B-4DDF-9CA4-7A0593EA150D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2481C4DE-1886-43E9-AFD1-AEA379BF9487}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2D3E6957-73B8-4DE3-A177-C2938A15DB21}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3034E20E-29F5-4157-B826-3FF8BE0C78B3}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3AB47F9A-4B59-492F-8393-EB9C5C19EABD}" = lport=138 | protocol=17 | dir=in | app=system |
"{47F48D3A-6FB2-4437-A2E6-F875C9F6135A}" = rport=139 | protocol=6 | dir=out | app=system |
"{4F3C6BAA-C048-42FD-81EF-AFD97F0B0D6C}" = lport=139 | protocol=6 | dir=in | app=system |
"{5BD703FC-FE41-4401-ACD5-F9DCEF385E69}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{81FB25D0-6BF3-4D0C-B026-9610275238E3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{824854FA-19F8-4841-9BC3-F104B5617373}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8683C404-2C8C-4673-8D61-F774ECE342DE}" = rport=137 | protocol=17 | dir=out | app=system |
"{A53A83CD-4CF0-4C42-9B38-678C031D3F7F}" = lport=137 | protocol=17 | dir=in | app=system |
"{AD287081-6B82-4795-B124-A6573DB81300}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B0EDD7DB-85B1-4EB0-B7AD-837CD30243CE}" = rport=138 | protocol=17 | dir=out | app=system |
"{B3AFCD7A-8DF8-4260-9A72-B231E13F1479}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C61D59BF-6888-483D-9A84-11FE3AF24750}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{DBD5B727-5829-4914-88CB-99F391E1FEFD}" = rport=10243 | protocol=6 | dir=out | app=system |
"{E02D7487-0B5E-4405-973F-E802AE32A5C4}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{EFC3F659-FCA6-4FD0-B7EC-0BEE92263ECC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F0903772-BC30-4FA1-BFE2-5B4B605993E2}" = lport=445 | protocol=6 | dir=in | app=system |
"{F62C6355-E5F2-4FBC-A472-718114793C9F}" = lport=10243 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{042BA4EA-FCD3-4E80-A2D2-2E0BB36DF25F}" = protocol=6 | dir=out | app=system |
"{268273C8-0E4A-48B1-B841-BBA7DA4DDD7A}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{2ADEF0E1-1761-48EB-9EAC-4D0A9E359DE7}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{2E21B187-8075-4DE6-A4AD-2313E403ED3D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{34C5F8F8-01C0-40FD-A8F5-DCE3582B9EB4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{369EF188-CFE3-4DE3-91F4-4E876DED10B3}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3B6DD58F-8972-494F-BB84-25FF02EEE91E}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{4AFC0E25-FA88-4B44-8227-21EB41040662}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{4FB2180A-DFC4-4585-ADC0-F42654F21B9D}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{590EB4F9-3492-4BA5-AD4F-4C46BB5114F4}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{5CA505AB-8C56-428E-A70A-24B793AD6054}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6E1FF2CB-E8F2-4677-9FAF-A99562E2ED34}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{70A264C1-F53F-4F12-872E-A3BF581C94F9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{786CB91E-D354-4892-B826-B8FE9AF55EA9}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{864873D2-753B-4C95-8CCC-4EB7A49F8348}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8CA06D70-A649-40A3-AE1A-6D536883B163}" = protocol=6 | dir=in | app=c:\users\user\appdata\roaming\dropbox\bin\dropbox.exe |
"{92C9925E-DC91-4328-9D54-21C5DCDA0146}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{94BBCD23-D3FA-48BB-8517-664FDB682BC1}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{978900FB-8580-4961-9460-DBB48092EC3D}" = protocol=17 | dir=in | app=c:\users\user\appdata\roaming\dropbox\bin\dropbox.exe |
"{9CAA9CEE-3E72-4E4C-AE01-C687881DED4F}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{A35ADE65-B3DB-41B1-858A-A1C448099921}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A46F87B4-A685-4494-BAC6-10FC9569DC14}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A6BFB45A-485F-471F-866F-87B3CB669A3A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A8250815-6BD8-44F8-802D-F9A34B46F324}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{AB029BC1-CCCD-4A68-B547-A1F38D2D7FCF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{B088A66E-1304-4AD1-BD43-86D465B763E5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BB988B4B-0424-441F-AFF7-4DF9CC40D668}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{D2613FA1-A0D4-4618-A998-6CD0C14212C2}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{D5414286-6A4E-4B42-A56E-DD845D0E8924}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{D5BD8E36-3658-41FC-A59E-2820E766465F}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{E536D889-4301-4774-B9B7-81035CAB515C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{ED021805-6692-413F-9B5C-625C6925347F}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{FB2B2F9D-2575-4B15-A5BC-888A2A6643F7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FE1AD2AC-4C00-4953-9EEE-81276D99E4D6}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"TCP Query User{D6B7276E-C72B-4398-A205-94B07787503F}C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\user\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{1EE870CB-B35B-4BB2-B72E-9F45BAACB330}C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\user\appdata\roaming\dropbox\bin\dropbox.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{241DBC8D-14E3-4240-8EE5-3AC35086B638}" = AVG 2013
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Qualcomm Atheros Client Installation Program
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{459699C3-9430-4381-964B-4248D87B49F9}" = Apple Mobile Device Support
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}" = Vodafone Mobile Broadband
"{6F8CBBFB-7986-4140-91EC-D8C7F1EC8DF3}" = AVG 2013
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AVG" = AVG 2013
"Google Chrome" = Google Chrome
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Mobile Broadband HL Service" = Mobile Broadband HL Service
"Mozilla Firefox 19.0.2 (x86 de)" = Mozilla Firefox 19.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Picasa 3" = Picasa 3
"VLC media player" = VLC media player 2.0.1
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 17.03.2013 10:49:55 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 17.03.2013 11:37:40 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 17.03.2013 10:16:09 | Computer Name = User-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 17.03.2013 10:24:15 | Computer Name = User-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 17.03.2013 10:32:57 | Computer Name = User-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 17.03.2013 10:47:23 | Computer Name = User-PC | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 17.03.2013 10:48:36 | Computer Name = User-PC | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 17.03.2013 11:35:12 | Computer Name = User-PC | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 17.03.2013 11:35:17 | Computer Name = User-PC | Source = DCOM | ID = 10010
Description =
Error - 17.03.2013 11:36:26 | Computer Name = User-PC | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 17.03.2013 11:36:47 | Computer Name = User-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 17.03.2013 11:39:22 | Computer Name = User-PC | Source = WMPNetworkSvc | ID = 866300
Description =
< End of report >
OTL Logfile: Code:
ATTFilter OTL logfile created on: 18.03.2013 11:45:11 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\User\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 1,20 Gb Available Physical Memory | 60,13% Memory free 3,98 Gb Paging File | 2,80 Gb Available in Paging File | 70,43% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 100,00 Gb Total Space | 26,89 Gb Free Space | 26,89% Space Free | Partition Type: NTFS Drive D: | 197,99 Gb Total Space | 193,25 Gb Free Space | 97,61% Space Free | Partition Type: NTFS Drive E: | 47,90 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: USER-PC | User Name: User | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.03.18 04:10:07 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe PRC - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.12.14 16:49:28 | 000,512,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.12.11 03:52:44 | 003,147,384 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgui.exe PRC - [2012.11.23 15:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2012.11.15 23:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgidsagent.exe PRC - [2012.10.30 04:59:56 | 000,726,648 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgrsx.exe PRC - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe PRC - [2012.10.22 13:04:32 | 001,116,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgnsx.exe PRC - [2012.10.22 13:03:52 | 000,796,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgemcx.exe PRC - [2012.10.22 13:03:46 | 000,440,440 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgcsrvx.exe PRC - [2012.09.04 21:27:53 | 000,233,864 | ---- | M] () -- C:\ProgramData\MobileBrServ\mbbService.exe PRC - [2012.08.13 11:08:08 | 010,376,704 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe PRC - [2012.08.13 11:08:08 | 010,368,512 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin PRC - [2012.03.20 13:08:50 | 000,069,632 | ---- | M] (Vodafone) -- C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe PRC - [2012.03.20 13:08:30 | 000,008,704 | ---- | M] (Vodafone) -- C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe PRC - [2011.02.25 18:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.08.18 14:36:36 | 000,348,160 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe PRC - [2009.08.18 14:36:08 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe ========== Modules (No Company Name) ========== MOD - [2013.02.18 18:04:47 | 000,542,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Secon#\5bf19d52baa083b72c3238b7f0622fe5\Vodafone.View.SecondaryWindows.ni.dll MOD - [2013.02.18 18:04:41 | 000,138,240 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\79bbc8feaa0e224980e0f019c642e53b\Vodafone.DeviceAccess.Factory.ni.dll MOD - [2013.02.18 18:04:39 | 000,041,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\005e79e3a07c2be8d5ec5b6434d86229\Vodafone.Contracts.Adapter.ni.dll MOD - [2013.02.18 18:04:37 | 000,025,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Manag#\8affa779c99360666e2ff34dd6200af6\Vodafone.View.ManagedToolTip.ni.dll MOD - [2013.02.18 18:04:36 | 000,035,840 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\320b44967a9659206b4c119dcd92426f\Vodafone.Contracts.Presenter.ni.dll MOD - [2013.02.18 18:04:23 | 001,304,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\f4ca72c3d9638d73b47c35ca730b0381\Infragistics2.Win.UltraWinEditors.v9.2.ni.dll MOD - [2013.02.18 18:04:16 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.M#\75298ac9b1442d682eb275e0af55c54a\Infragistics2.Win.Misc.v9.2.ni.dll MOD - [2013.02.18 18:03:53 | 011,055,616 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.v#\b100ea9c0606c9e1f265c1f610c3ca88\Infragistics2.Win.v9.2.ni.dll MOD - [2013.02.18 18:03:07 | 000,871,424 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Share#\1ebe24369c92a181b263b1426fce18f2\Infragistics2.Shared.v9.2.ni.dll MOD - [2013.02.18 18:03:01 | 007,140,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\1bd47dc0e94ca0b2e7834b697cef6d59\Infragistics2.Win.UltraWinToolbars.v9.2.ni.dll MOD - [2013.02.18 18:02:32 | 000,125,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Contr#\40d9b4fd9aa5185380728e8e25fead3d\Vodafone.Core.Contracts.ni.dll MOD - [2013.02.18 18:02:31 | 000,133,632 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\37f784df34babce5ddcdc7936b093a9f\Vodafone.Contracts.Model.ni.dll MOD - [2013.02.18 18:02:29 | 000,091,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\97620001ca244e1a1883348509a0f979\Vodafone.DeviceAccess.Contracts.ni.dll MOD - [2013.02.18 18:02:28 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\4f06cf3bc06b386432fb3d22811c5c85\Vodafone.Contracts.Common.ni.dll MOD - [2013.02.18 18:02:27 | 000,104,960 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\ac9cc773167d821f9b2ad35d5f78f506\Vodafone.Contracts.View.ni.dll MOD - [2013.02.18 18:02:23 | 000,966,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Shared\8c1e9acd7d06f03da6020674841333b7\Vodafone.View.Shared.ni.dll MOD - [2013.02.18 18:02:14 | 000,387,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.CommonDial#\bc2ad8ef497a2b19eef107eab12486e9\Vodafone.CommonDialogs.ni.dll MOD - [2013.02.18 18:02:09 | 000,964,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Applicatio#\836a3d76eadf5732c9e360ac3ee6bc95\Vodafone.ApplicationHost.Impl.ni.dll MOD - [2013.02.18 18:02:00 | 000,363,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DataAccess#\0c70025aa442a7fc103d6ff8b16f5f60\Vodafone.DataAccessor.ni.dll MOD - [2013.02.18 18:01:56 | 000,184,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Contr#\556853b3c47beaf7c0bba81fffeb9d97\Vodafone.Base.Contracts.ni.dll MOD - [2013.02.18 18:01:53 | 000,644,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Data\a796581f1b004a2ee6e6f55573e1018e\Vodafone.Data.ni.dll MOD - [2013.02.18 18:01:47 | 001,418,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Platform\c5618f40d80c1529f9f79c2005435a0e\Vodafone.Platform.ni.dll MOD - [2013.02.18 18:01:37 | 000,060,928 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\MobileBroadband\2ce0722b9dc10fed9e767c58c98c2af1\MobileBroadband.ni.exe MOD - [2013.02.17 10:18:45 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\7ff638de44686eab4afaa8b3c8a9cfca\System.ServiceProcess.ni.dll MOD - [2013.02.17 10:17:39 | 001,840,640 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\64cf6c356be66bb17c4667d6d8aa467b\System.Web.Services.ni.dll MOD - [2013.02.17 10:15:03 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll MOD - [2013.01.14 13:25:23 | 002,297,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\77dfcfed5fd5f67d0d3edc545935bb21\System.Core.ni.dll MOD - [2013.01.13 22:13:05 | 000,218,624 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.FNCClient11#\3b21f0b55f7c0dc1fe2295613c3cb921\Interop.FNCClient11Lib.ni.dll MOD - [2013.01.13 22:13:04 | 000,050,176 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.UpdateMana#\ceafd0efdd035a69d91e5293a9050334\Vodafone.UpdateManager.ni.dll MOD - [2013.01.13 22:13:02 | 000,198,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Conn#\498f810fb1b2f2bc8dcd283d3a5b237c\Vodafone.Model.Connection.ni.dll MOD - [2013.01.13 22:12:55 | 000,081,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Remot#\4842322586980e2aa662b7b1e88c7e11\Vodafone.Core.Remoting.ni.dll MOD - [2013.01.13 22:12:53 | 000,544,256 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Inter#\badb7308337bf7e4916b97fc5fab14e4\Vodafone.Base.Internals.ni.dll MOD - [2013.01.13 22:12:49 | 000,044,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Facto#\ef5c16d705265f3e1efda0e658d4fae6\Vodafone.Base.Factory.ni.dll MOD - [2013.01.13 22:12:47 | 000,302,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\78fd63281a3894fad4b847d5b37ec2ac\Vodafone.DeviceAccess.Internals.ni.dll MOD - [2013.01.13 22:12:46 | 000,029,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\c35bd15dc0b6e6d6fa60b925a4542c1a\Vodafone.DeviceAccess.Interfaces.ni.dll MOD - [2013.01.13 22:12:43 | 000,022,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.INSTALLERCO#\f52d12a80cd22baf114cbe6c178ea653\Interop.INSTALLERCONTROLLib.ni.dll MOD - [2013.01.13 22:12:42 | 000,070,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.VpnApiLib\db3ad96a4eabdaf8c6d3621dfbef2379\Interop.VpnApiLib.ni.dll MOD - [2013.01.13 22:12:42 | 000,031,744 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.FCCOMINTDLL#\d22f87b0c2a72cb67b2171f9ae12c46c\Interop.FCCOMINTDLLLib.ni.dll MOD - [2013.01.13 22:12:40 | 000,125,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Vpn\6653c516cf79030823afb794d6dde501\Vodafone.Vpn.ni.dll MOD - [2013.01.13 22:12:38 | 000,113,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LanWlanMan#\060c0ac8d4a84bc5233a7773f45064b4\Vodafone.LanWlanManager.ni.dll MOD - [2013.01.13 22:12:35 | 001,125,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.BusinessLo#\dd237c12e95b0181e4babc764b00fa87\Vodafone.BusinessLogic.ni.dll MOD - [2013.01.13 22:12:30 | 000,046,592 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.CoreI#\4764415b160349e224381abcf909ff8b\Vodafone.Core.CoreInstanceProvider.ni.dll MOD - [2013.01.13 22:12:28 | 000,037,888 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Inter#\cf1b7fc71fb53371ec391991c805dde9\Vodafone.Core.Interfaces.ni.dll MOD - [2013.01.13 22:12:27 | 000,030,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.OutlookCon#\85393d8e6f700dd1f061b2040dba5bbc\Vodafone.OutlookConnector.ni.dll MOD - [2013.01.13 22:12:25 | 000,353,280 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.ReportingM#\263e08b0b299c349d06cb0638e921045\Vodafone.ReportingManager.ni.dll MOD - [2013.01.13 22:12:22 | 000,193,024 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsContact#\20c2dcf386a08f64041005525342a067\Vodafone.SmsContactManager.ni.dll MOD - [2013.01.13 22:12:20 | 000,047,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Common.Logging\0c5008375abad2d7074f91953acd7158\Common.Logging.ni.dll MOD - [2013.01.13 22:12:18 | 002,104,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Spring.Core\4a69d3bfa1111bcd9328e15165ee78ad\Spring.Core.ni.dll MOD - [2013.01.13 22:12:11 | 000,042,496 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.InstancePr#\f803724c450d42cb1d36346bd3d0ef8e\Vodafone.InstanceProvider.Impl.ni.dll MOD - [2013.01.13 22:10:24 | 000,080,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsProfile#\36e387b90a491ecb46ada06a083095b8\Vodafone.SmsProfileManager.ni.dll MOD - [2013.01.13 22:10:22 | 000,059,392 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SettingsMa#\ac758964260e310e9daccc00378d2cc3\Vodafone.SettingsManager.ni.dll MOD - [2013.01.13 22:10:21 | 000,119,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\d65e3892ff3bfd90b6b37f7ef0c8761c\Interop.Shell32.ni.dll MOD - [2013.01.13 22:10:17 | 002,035,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\MobileBroadbandReso#\09bac272a8e4df4cf5d05f068727c29e\MobileBroadbandResources.ni.dll MOD - [2013.01.13 22:10:14 | 000,022,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Mondrian\b22412ccf92415424f7ed3f0b863e173\Vodafone.Mondrian.ni.dll MOD - [2013.01.13 22:10:12 | 000,357,888 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Win32\60002c018d20905664e6960de36ba224\Vodafone.Base.Win32.ni.dll MOD - [2013.01.13 22:10:10 | 000,177,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Common\c1080f61a353bcc4835c88842890d4eb\Vodafone.Common.ni.dll MOD - [2013.01.13 22:10:09 | 000,019,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MobileBroa#\f2a56f70c738d6761b0227e626687aea\Vodafone.MobileBroadband.CallbackHandler.ni.dll MOD - [2013.01.13 22:09:59 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\302207b4fa3083899fd8ab4db98cecc5\System.Management.ni.dll MOD - [2013.01.13 22:09:43 | 000,101,888 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LogEngine\afd43e26657df3ed79a0a9523dc24808\Vodafone.LogEngine.ni.dll MOD - [2013.01.11 13:35:43 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll MOD - [2013.01.11 13:35:35 | 000,627,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\536d704e93ffec9b54e4a0312fb5b996\System.Transactions.ni.dll MOD - [2013.01.11 13:35:31 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\dd20416f723ee13ffb4173ec1afc4ec4\System.Data.ni.dll MOD - [2013.01.11 13:31:44 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll MOD - [2013.01.11 13:31:07 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d908c91e24616e6b8d38c9da61038b25\Accessibility.ni.dll MOD - [2013.01.11 13:31:04 | 012,237,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\19b3d17c3ce0e264c4fb62028161adf7\PresentationCore.ni.dll MOD - [2013.01.11 13:28:29 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll MOD - [2013.01.11 13:28:10 | 000,684,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\3abd733e8fa28fafbfc99458fdf691da\System.Security.ni.dll MOD - [2013.01.11 13:27:53 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll MOD - [2013.01.11 13:27:24 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll MOD - [2013.01.11 13:27:16 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll MOD - [2013.01.11 13:25:57 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll MOD - [2012.08.10 16:51:32 | 000,985,088 | ---- | M] () -- C:\Program Files\OpenOffice.org 3\program\libxml2.dll MOD - [2012.03.24 03:50:30 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2012.03.20 13:08:46 | 000,396,800 | ---- | M] () -- C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\Vodafone.View.Taskbar.dll MOD - [2011.04.12 14:29:36 | 000,167,936 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Xml.resources\2.0.0.0_de_b77a5c561934e089\System.Xml.resources.dll MOD - [2011.04.12 14:29:33 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll MOD - [2010.11.21 10:29:11 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll MOD - [2009.07.14 14:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\System32\msjetoledb40.dll MOD - [2009.06.11 10:23:19 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ========== Services (SafeList) ========== SRV - [2013.03.13 21:41:30 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.03.09 02:08:58 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.11.24 10:45:53 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2012.11.15 23:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent) SRV - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe -- (avgwd) SRV - [2012.09.04 21:27:53 | 000,233,864 | ---- | M] () [Auto | Running] -- C:\ProgramData\MobileBrServ\mbbService.exe -- (Mobile Broadband HL Service) SRV - [2012.03.20 13:08:30 | 000,008,704 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService) SRV - [2009.08.18 14:36:08 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2009.07.14 14:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 14:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\User\AppData\Local\Temp\catchme.sys -- (catchme) DRV - [2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.11.15 23:33:26 | 000,094,048 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86) DRV - [2012.10.22 13:02:46 | 000,179,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver) DRV - [2012.10.15 03:48:52 | 000,055,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX) DRV - [2012.10.02 03:30:38 | 000,159,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86) DRV - [2012.09.21 03:46:06 | 000,164,832 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix) DRV - [2012.09.21 03:46:00 | 000,177,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avglogx.sys -- (Avglogx) DRV - [2012.09.21 03:45:54 | 000,019,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim) DRV - [2012.09.18 12:29:02 | 003,015,168 | ---- | M] (Qualcomm Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2012.09.14 03:05:20 | 000,035,552 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86) DRV - [2012.08.24 03:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2012.08.24 03:41:34 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD) DRV - [2012.08.24 03:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2012.08.04 05:55:34 | 000,254,608 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtsPStor.sys -- (RSPCIESTOR) DRV - [2012.03.16 14:55:26 | 000,193,536 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_juwwanecm.sys -- (huawei_wwanecm) DRV - [2012.03.16 14:55:26 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV - [2012.03.16 14:55:26 | 000,089,856 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jucdcacm.sys -- (huawei_cdcacm) DRV - [2012.03.16 14:55:26 | 000,073,984 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV - [2012.03.16 14:55:26 | 000,026,624 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_juextctrl.sys -- (huawei_ext_ctrl) DRV - [2012.03.16 14:55:24 | 000,011,136 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter) DRV - [2010.11.30 14:59:03 | 000,238,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1c6232.sys -- (e1cexpress) DRV - [2010.10.20 10:33:40 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\HECI.sys -- (MEI) DRV - [2009.09.21 01:43:50 | 000,123,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdm.sys -- (ss_mdm) DRV - [2009.09.21 01:43:48 | 000,098,560 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bus.sys -- (ss_bus) DRV - [2009.09.21 01:43:48 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdfl.sys -- (ss_mdfl) DRV - [2009.08.18 15:48:06 | 004,994,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2009.07.18 00:36:30 | 000,013,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\..\SearchScopes,DefaultScope = {954265D0-12FE-45D2-A31C-D929A5DB4B47} IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\..\SearchScopes\{954265D0-12FE-45D2-A31C-D929A5DB4B47}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 IE - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.spiegel.de/" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll () FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.03.09 02:08:59 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.03.09 02:08:59 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.15 07:16:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Extensions [2013.03.18 04:42:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\psxry45f.default\extensions [2013.03.18 04:42:39 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\psxry45f.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.03.09 02:08:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2013.03.09 02:08:59 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.09.06 15:07:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.06 15:07:37 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.09.06 15:07:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.09.06 15:07:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.09.06 15:07:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.09.06 15:07:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter} CHR - homepage: hxxp://www.delta-search.com/?affID=119776&tt=100313_9111gen&babsrc=HP_ss&mntrId=56BF582C80139263 CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.172\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.172\pdf.dll CHR - plugin: Norton Identity Safe (Enabled) = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nppllibpnmahfaklnpggkibhkapjkeob\2013.2.0.18_0\npcoplgn.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll CHR - Extension: Google Drive = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: Adblock Plus = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4_0\ CHR - Extension: Google-Suche = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Google Mail = C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2009.06.11 10:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [MobileBroadband] C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone) O4 - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.) O4 - Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2013.01.15 21:38:20 | 000,000,000 | -H-D | M] O4 - Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1579903211-1426122323-2047937735-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2E0AEBB3-791B-4B6B-A48C-10EA215D9E6A}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{351B9E66-50D3-4311-9E61-BF79C2174615}: NameServer = 203.118.191.1 203.109.191.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{44B6BC2B-6EC2-4536-9351-A3F82E2DBC3D}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7B1FCD5D-0DA7-4808-BA2D-96D861F5A77A}: DhcpNameServer = 192.168.107.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7E371C82-AF4E-4877-B49F-F96232363DCE}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{89F616B9-142B-4E3D-9BB3-CB2423FBDFFB}: NameServer = 203.118.191.1 203.109.191.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A9694B53-66C1-4EE9-B9A5-0CD86A78C065}: NameServer = 203.109.191.1 203.118.191.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.11 10:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2012.03.21 03:55:09 | 000,000,122 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.03.18 04:10:05 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe [2013.03.18 03:37:17 | 000,000,000 | ---D | C] -- C:\Windows\temp [2013.03.18 03:35:53 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013.03.18 03:08:52 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2013.03.18 03:08:52 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2013.03.18 03:08:52 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2013.03.18 03:08:21 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.03.18 03:07:46 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2013.03.18 03:06:21 | 005,041,875 | R--- | C] (Swearware) -- C:\Users\User\Desktop\ComboFix.exe [2013.03.18 02:40:36 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT [2013.03.18 02:40:25 | 000,000,000 | ---D | C] -- C:\JRT [2013.03.18 02:39:22 | 000,549,920 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\User\Desktop\JRT.exe [2013.03.16 08:24:30 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Malwarebytes [2013.03.16 08:24:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.03.16 08:24:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.03.16 08:24:08 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013.03.16 08:24:08 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013.03.16 08:23:55 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\Programs [2013.03.15 03:02:43 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2013.03.15 03:02:38 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2013.03.15 03:02:37 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2013.03.15 03:02:36 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2013.03.15 03:02:36 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2013.03.15 03:02:31 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2013.03.15 03:02:30 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2013.03.15 03:02:25 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2013.03.14 22:50:44 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usb8023.sys [2013.03.14 19:57:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3 [2013.03.12 18:50:44 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\PutLockerDownloader [2013.03.09 02:08:47 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013.03.08 10:43:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG [2013.03.04 00:10:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carom3D [2013.03.04 00:10:00 | 000,139,264 | ---- | C] (Neoact) -- C:\Windows\NeoUninstall.exe [2013.03.04 00:09:55 | 000,000,000 | ---D | C] -- C:\Program Files\Neoact [2013.02.28 03:01:25 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAnimation.dll [2013.02.28 03:01:14 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMPhoto.dll [2013.02.28 03:01:10 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll [2013.02.28 03:01:10 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll [2013.02.28 03:01:10 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll [2013.02.28 03:01:09 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll [2013.02.28 03:01:08 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll [2013.02.28 03:01:08 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll [2013.02.28 03:01:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll [2013.02.28 03:01:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll [2013.02.28 03:01:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll [2013.02.28 03:01:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll [2013.02.28 03:01:07 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msmpeg2vdec.dll [2013.02.28 03:01:07 | 001,988,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2013.02.28 03:01:06 | 000,604,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll [2013.02.28 03:01:06 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll [2013.02.28 03:01:06 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2013.02.28 03:01:06 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll [2013.02.28 03:01:05 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d11.dll [2013.02.28 03:01:05 | 001,080,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll [2013.02.28 03:01:05 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2013.02.28 03:01:04 | 001,247,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2013.02.28 03:01:04 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll [2013.02.28 03:01:03 | 000,207,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll [2013.02.28 03:01:02 | 003,419,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2013.02.22 21:58:35 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Apple Computer [2013.02.22 21:56:08 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2013.02.22 21:55:13 | 000,000,000 | ---D | C] -- C:\Config.Msi [2013.02.22 21:52:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple [2013.02.22 21:52:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple [2013.02.22 21:16:58 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\WindSolutions [2013.02.22 21:16:33 | 000,000,000 | ---D | C] -- C:\ProgramData\WindSolutions [2013.02.22 20:54:00 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\SharePod [2013.02.22 20:40:27 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\vivi [2013.02.21 16:28:47 | 000,000,000 | ---D | C] -- C:\ProgramData\MobileBrServ [2013.02.20 13:09:13 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\REZEPTE ========== Files - Modified Within 30 Days ========== [2013.03.18 11:44:40 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.03.18 11:44:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.03.18 11:44:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.03.18 10:52:46 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.03.18 04:44:04 | 000,021,472 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.03.18 04:44:04 | 000,021,472 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.03.18 04:36:05 | 1601,069,056 | -HS- | M] () -- C:\hiberfil.sys [2013.03.18 04:10:07 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe [2013.03.18 03:06:45 | 005,041,875 | R--- | M] (Swearware) -- C:\Users\User\Desktop\ComboFix.exe [2013.03.18 02:39:23 | 000,549,920 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\User\Desktop\JRT.exe [2013.03.18 00:36:14 | 001,649,182 | ---- | M] () -- C:\Users\User\Desktop\P1040573.JPG [2013.03.18 00:32:44 | 001,729,149 | ---- | M] () -- C:\Users\User\Desktop\BILD2190.JPG [2013.03.17 23:56:12 | 000,004,608 | ---- | M] () -- C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.03.17 21:43:32 | 000,696,870 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.03.17 21:43:32 | 000,652,148 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.03.17 21:43:32 | 000,148,134 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.03.17 21:43:32 | 000,121,080 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.03.16 09:55:39 | 000,000,000 | ---- | M] () -- C:\Users\User\defogger_reenable [2013.03.13 21:41:26 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013.03.13 21:41:26 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2013.03.12 23:23:36 | 000,010,886 | ---- | M] () -- C:\Users\User\Desktop\WG Text.odt [2013.03.04 00:10:00 | 000,000,026 | ---- | M] () -- C:\Windows\NeoSetup.INI [2013.02.26 11:42:20 | 000,003,308 | ---- | M] () -- C:\Users\User\Desktop\Email-Adressen.rtf [2013.02.24 11:35:06 | 000,007,598 | ---- | M] () -- C:\Users\User\AppData\Local\Resmon.ResmonCfg [2013.02.19 22:31:49 | 000,032,220 | ---- | M] () -- C:\Users\User\AppData\Roaming\UserTile.png [2013.02.17 10:10:50 | 000,297,408 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2013.03.18 03:08:52 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013.03.18 03:08:52 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013.03.18 03:08:52 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013.03.18 03:08:52 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013.03.18 03:08:52 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2013.03.18 00:36:13 | 001,649,182 | ---- | C] () -- C:\Users\User\Desktop\P1040573.JPG [2013.03.18 00:32:44 | 001,729,149 | ---- | C] () -- C:\Users\User\Desktop\BILD2190.JPG [2013.03.16 09:55:39 | 000,000,000 | ---- | C] () -- C:\Users\User\defogger_reenable [2013.03.14 23:16:24 | 000,004,608 | ---- | C] () -- C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.03.11 13:16:38 | 000,010,886 | ---- | C] () -- C:\Users\User\Desktop\WG Text.odt [2013.03.04 00:10:00 | 000,000,026 | ---- | C] () -- C:\Windows\NeoSetup.INI [2013.02.24 11:35:06 | 000,007,598 | ---- | C] () -- C:\Users\User\AppData\Local\Resmon.ResmonCfg [2013.02.19 22:31:49 | 000,032,220 | ---- | C] () -- C:\Users\User\AppData\Roaming\UserTile.png [2012.11.16 06:09:12 | 000,123,780 | ---- | C] () -- C:\Windows\System32\drivers\RtConvEQ.DAT [2012.11.16 06:09:12 | 000,001,496 | ---- | C] () -- C:\Windows\System32\drivers\RtkAcerM.dat [2012.11.16 06:09:12 | 000,000,728 | ---- | C] () -- C:\Windows\System32\drivers\RtHdatEx.dat [2012.11.16 06:09:12 | 000,000,712 | ---- | C] () -- C:\Windows\System32\drivers\SamSfPa.dat [2012.11.16 06:09:12 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX2.dat [2012.11.16 06:09:12 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX1.dat [2012.11.16 06:09:12 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat [2012.11.16 06:09:12 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat [2012.03.24 03:43:08 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2012.03.24 03:43:04 | 000,033,180 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2012.03.24 03:05:32 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.03.16 14:55:44 | 000,286,678 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4 [2011.04.12 14:30:05 | 000,696,870 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2011.04.12 14:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2011.04.12 14:30:05 | 000,148,134 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2011.04.12 14:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat ========== ZeroAccess Check ========== [2009.07.14 17:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 17:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 10:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 14:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both < End of report > |
|
| Themen zu Verlinkung einzelner Wörter zu Pop-up Fenstern! |
| adw cleaner, bereits, cleaner, einzelner, fenster, fenstern, logfiles, pop-up, pop-up fenster, problem, stern, texte, verlinkung, wörter |
Linear-Darstellung
