| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.BWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
18.03.2013, 22:21
| #1 |
| |  Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.B Hallo, habe folgendes Problem, dass ich hier einmal schildern möchte und hoffe das man mir irgendwie noch helfen kann. Möchte dazu sagen, ich bin eine Frau und habe nicht viel Ahnung vom PCs. Alles was ich am PC mache, erlese ich mir aus dem Netz, wie den nächsten Abschnitt. Habe eine Festplatte im PC Namens Hitachi, 1000 GB. Als ich vor ca 1.5 Jahren meinen PC platt machte, habe ich mir meine Festplatte in Partitionen unterteilt. (C) lokale Festplatte, (D), (E), (F) und (G). Auf C habe ich mein Windows 7 und auf die anderen Partitionen habe ich meine Spiele, Fotos, Musik, Dokumente u.s.w. abgelegt. Meine Mutter kam letztens vorbei und war der Meinung gewesen mir mal was zeigen zu müssen, was Sie für ne komische Email bekommen hat. Sie öffnet die Zip Date im Anhang und schon sprang auch schon mein Virusprogramm, Microsoft Security Essentials, an. Ich schaute mir gleich an was für ein Virus das ist. -Trojan:Win32/Matsnu- Ich hab mir nichts weiter dabei gedacht da ich noch nie Probleme mit Viren hatte. Bis ich gesehen hab , noch am gleichen Abend, das zwei Partitionen weg sind  Die eine Partition ist mir nicht so wichtig aber auf der anderen waren meine ganzen Fotos, Videos, Filme und meine Musik drauf. Ich kann auf alles verzichten aber nicht auf meine Fotos. Ich hab noch ne Externe Festplatte wo ich noch nen großen Teil drauf hab als backup, aber ich muss leider gestehen das ich in der letzten Zeit mit den backups nen bißchen nachlässig war. Liegt vielleicht auch daran das mein Kabel für die Festplatte nach dem letzten Umzug unauffindbar ist, aber ne Ausrede ist ja immer parat. Jedenfalls fing ich an im Netz  zu suchen wie ich meine Dateien wieder bekomme und bin auf folgende Seite gestoßen. hxxp://www.cgsecurity.org/wiki/TestDisk_Step_By_StepIch habe nach Anweisung gehandelt und konnte auch schon einige Bilder, Videos und Musik wieder sehen. Aber, die Dateien wurden mir in 339 Ordner gelegt, Gesamt 133 GB. Alles unsortiert, nur durchnummeriert und doppelt und dreifach. Alles habe ich noch nicht durchgeguckt. Mit vielen Dateien kann ich gar nichts anfangen da ich sie nicht öffnen kann. Dateien wie: .dll oder .acc Einen Report habe ich auch bekommen aber den kann ich nicht öffnen da der explorer nicht mitspielt. Auch habe ich festgestellt das mir ein Video in Bildern abgespeichert wurde. Mühseelig das wieder zusammen zu puzzeln und nen ton gibts eigentlich auch noch dazu. Aber darum gehts jetzt nicht. Auch habe ich gesehen das einige GB kaputt sind, laut dem System Testdisk. Heute habe ich dann mal nach dem Virus im Netz geschaut und bin auf dieser Seite gelandet. Und da habe ich Angst bekommen. Nur weil der Virus erkannt wurde ist er ja noch lange nicht weg. Also habe ich Malwarebytes Anti-Malware von dieser Seite ausprobiert und auch den Scan durchlaufen lassen wie angegeben. Dabei sprang mein Virusprogramm wieder an und zeigte mir einen weiteren Virus: TrojanDownloader:Win32/Kuluoz.B Hier noch der Report vom Malwarebytes Anti-Malware Malwarebytes Anti-Malware (Test) 1.70.0.1100 Malwarebytes : Free Anti-Malware download Datenbank Version: v2013.03.18.11 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 *** :: ***-PC [Administrator] Schutz: Aktiviert 18.03.2013 17:55:54 mbam-log-2013-03-18 (17-55-54).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 208345 Laufzeit: 4 Minute(n), 33 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 3 HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111181125} (PUP.CrossRider.BCA) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111181125} (PUP.CrossRider.BCA) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 4 C:\$Recycle.Bin\S-1-5-21-2793220-80344676-3747676903-1000\$RYATA9Y.exe (PUP.BundleInstaller.VIO) -> Keine Aktion durchgeführt. C:\ProgramData\GBox\GBox.exe (Trojan.Dropper) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\OptimizerPro1\OptimizerPro1.exe (Trojan.Dropper) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\***\AppData\Local\Temp\Vid-Saver-rs.exe (Adware.GamePlayLabs) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Ich möchte den Virus, bzw beide Viren, weg haben, und das die Festplatte wieder funktionstüchtig ist. Habe auch kein Problem meinen PC wieder Platt zu machen, aber nur einfach platt machen, damit ist es ja auch nicht getan. Ich freue mich auf Feedback und Danke schon jetzt für die Hilfe Geändert von Möwe (18.03.2013 um 22:36 Uhr) |
|
18.03.2013, 23:21
| #2 |
| | OTL.txt/ EXTRAS.txt/ Gmer.txt OTL logfile created on: 18.03.2013 22:57:39 - Run 2
__________________OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\***\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 1,43 Gb Available Physical Memory | 35,82% Memory free 8,04 Gb Paging File | 1,95 Gb Available in Paging File | 24,21% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 126,00 Gb Total Space | 60,18 Gb Free Space | 47,76% Space Free | Partition Type: NTFS Drive E: | 350,98 Gb Total Space | 320,75 Gb Free Space | 91,39% Space Free | Partition Type: NTFS Drive F: | 150,54 Gb Total Space | 145,36 Gb Free Space | 96,55% Space Free | Partition Type: NTFS Drive G: | 303,98 Gb Total Space | 136,37 Gb Free Space | 44,86% Space Free | Partition Type: NTFS Computer Name: ***-PC | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.03.18 22:57:19 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL (1).exe PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.12.14 16:49:28 | 000,512,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.10.19 14:51:08 | 000,395,200 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe PRC - [2012.10.15 11:58:22 | 000,779,200 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe PRC - [2012.06.20 17:13:12 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Winamp\winampa.exe PRC - [2009.02.26 15:24:50 | 000,097,680 | ---- | M] (Microsoft Corporation) -- F:\Office12\ONENOTEM.EXE ========== Modules (No Company Name) ========== MOD - [2013.03.11 01:22:06 | 000,459,728 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll MOD - [2013.03.11 01:22:05 | 012,662,224 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\Application\25.0.1364.172\PepperFlash\pepflashplayer.dll MOD - [2013.03.11 01:22:04 | 004,050,896 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\Application\25.0.1364.172\pdf.dll MOD - [2013.03.11 01:21:18 | 000,596,944 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\Application\25.0.1364.172\libglesv2.dll MOD - [2013.03.11 01:21:18 | 000,124,368 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\Application\25.0.1364.172\libegl.dll MOD - [2013.03.11 01:21:16 | 001,552,848 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\Application\25.0.1364.172\ffmpegsumo.dll MOD - [2013.02.16 14:49:59 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll MOD - [2013.01.17 11:04:57 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll MOD - [2013.01.17 11:04:51 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d908c91e24616e6b8d38c9da61038b25\Accessibility.ni.dll MOD - [2013.01.17 11:04:29 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll MOD - [2013.01.17 11:04:25 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll MOD - [2013.01.17 11:04:24 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll MOD - [2013.01.17 11:04:17 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll MOD - [2010.11.13 01:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ========== Services (SafeList) ========== SRV:64bit: - [2009.08.18 02:36:20 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV - [2013.03.14 10:21:14 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.01.27 11:34:32 | 000,379,360 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV - [2013.01.27 11:34:32 | 000,022,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.10.19 14:51:08 | 000,395,200 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe -- (Kodak AiO Network Discovery Service) SRV - [2012.10.15 11:58:22 | 000,779,200 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe -- (Kodak AiO Status Monitor Service) SRV - [2011.09.23 18:37:42 | 000,641,832 | ---- | M] (Nero AG) [Auto | Stopped] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.02.26 18:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- F:\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.01.20 15:59:04 | 000,130,008 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2012.12.14 16:49:28 | 000,024,176 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012.03.08 17:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.01.18 15:56:08 | 000,019,936 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdrvio.sys -- (pwdrvio) DRV:64bit: - [2012.01.18 15:56:06 | 000,013,280 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio) DRV:64bit: - [2011.06.10 05:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.08.18 03:48:48 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 01:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2007.08.31 13:15:34 | 000,079,872 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emAudio64.sys -- (emAudio) DRV:64bit: - [2007.06.21 16:51:46 | 000,215,808 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emDevice64.sys -- (DCamUSBEMPIA) DRV:64bit: - [2007.06.21 16:51:32 | 000,006,400 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emFilter64.sys -- (FiltUSBEMPIA) DRV:64bit: - [2007.06.21 16:51:30 | 000,006,144 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emScan64.sys -- (ScanUSBEMPIA) DRV:64bit: - [2007.03.05 19:49:38 | 000,047,888 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btcusb.sys -- (Btcsrusb) DRV:64bit: - [2005.09.23 22:18:34 | 000,261,120 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MarvinBus64.sys -- (MarvinBus) DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.gboxapp.com/?affid=gb2 IE - HKLM\..\SearchScopes,DefaultScope = {154d339e-ccaa-49a5-9b38-6878ad4220bc} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{154d339e-ccaa-49a5-9b38-6878ad4220bc}: "URL" = hxxp://www.searchamong.com/searchview.php?query={searchTerms}&cat=webs&bar=true IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = hxxp://search.gboxapp.com/?affid=gb2&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.searchamong.com/searchview.php?query={searchTerms}&cat=webs&bar=true IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.searchamong.com/searchview.php?query={searchTerms}&cat=webs&bar=true IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2625848 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 11 FB 2F 41 45 E4 CC 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.searchamong.com/searchview.php?query={searchTerms}&cat=webs&bar=true IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.searchamong.com/searchview.php?query={searchTerms}&cat=webs&bar=true IE - HKCU\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {25A18BA2-9060-44DD-88C5-C57DDFCC3070} IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110823&tt=300912_IKAN_4012_4&babsrc=SP_ss&mntrId=9b3e178000000000000000248ca70b83 IE - HKCU\..\SearchScopes\{154d339e-ccaa-49a5-9b38-6878ad4220bc}: "URL" = hxxp://www.searchamong.com/searchview.php?query={searchTerms}&cat=webs&bar=true IE - HKCU\..\SearchScopes\{25A18BA2-9060-44DD-88C5-C57DDFCC3070}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&r= IE - HKCU\..\SearchScopes\{62535543-A010-4A29-BD83-43138F489C3D}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={2DC71E7F-0BEE-421D-8E5B-0C73E6F87BD8}&mid=d297a938c88d47d09b8ad1409b8006ec-5b6d988173a9bb167462792ebf9c26ed2ad72e33&lang=de&ds=od011&pr=sa&d=2012-07-25 18:52:30&v=12.1.0.21&sap=dsp&q={searchTerms} IE - HKCU\..\SearchScopes\{A6DD741A-93A0-4A95-ADB0-63E61D802C26}: "URL" = hxxp://search.softonic.com/MON00016/tb_v1?q={searchTerms}&SearchSource=4&cc= IE - HKCU\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = hxxp://search.gboxapp.com/?affid=gb2&q={searchTerms} IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb178/?search={searchTerms}&loc=IB_DS&a=6PQGes2iAn&i=26 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.15.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\***\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\***\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) [2012.02.29 21:32:51 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google  riginalQueryForSuggestion}{google:assistedQueryStats}{google:se archFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParam eter} CHR - homepage: hxxp://search.conduit.com/?ctid=CT2625848&SearchSource=48 CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\Application\25.0.1364.172\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\Application\25.0.1364.172\gcswf32.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll CHR - plugin: Windows Live\\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Google Update (Enabled) = C:\Users\***\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - Extension: Google-Suche = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\ CHR - Extension: DVDVideoSoft Browser Extension = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0\ CHR - Extension: Google Mail = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - F:\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found. O4:64bit: - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\SysNative\spool\drivers\x64\3\EKIJ5000MUI.exe (Eastman Kodak Company) O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.) O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe File not found O4 - HKLM..\Run: [EKStatusMonitor] C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe (Eastman Kodak Company) O4 - HKLM..\Run: [GrooveMonitor] F:\Office12\GrooveMonitor.exe (Microsoft Corporation) O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) O4 - HKCU..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found O4 - HKCU..\Run: [EADM] "H:\Origin\Origin.exe" -AutoStart File not found O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = F:\Office12\ONENOTEM.EXE (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0E79E56F-9080-479B-8858-146CAA704853}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{40E00815-1950-4169-98D5-FE071EFCA350}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\gopher - No CLSID value found O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - F:\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - F:\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{1f541887-7dd0-11e1-8c11-00248ca70b83}\Shell - "" = AutoRun O33 - MountPoints2\{1f541887-7dd0-11e1-8c11-00248ca70b83}\Shell\AutoRun\command - "" = I:\AutoRun.exe O33 - MountPoints2\{1f5418b1-7dd0-11e1-8c11-00248ca70b83}\Shell - "" = AutoRun O33 - MountPoints2\{1f5418b1-7dd0-11e1-8c11-00248ca70b83}\Shell\AutoRun\command - "" = I:\AutoRun.exe O33 - MountPoints2\{46d220ba-8981-11e1-9844-00248ca70b83}\Shell - "" = AutoRun O33 - MountPoints2\{46d220ba-8981-11e1-9844-00248ca70b83}\Shell\AutoRun\command - "" = I:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (MACHINE BootExecut) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.03.18 19:01:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\WinZip Courier [2013.03.18 19:01:27 | 000,000,000 | ---D | C] -- C:\ProgramData\WinZipEC [2013.03.18 19:01:25 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\assembly [2013.03.18 17:54:14 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Roaming\Malwarebytes [2013.03.18 17:53:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.03.18 17:53:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.03.18 17:53:52 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2013.03.18 17:53:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2013.03.18 17:30:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{7EA038B8-65F6-4A95-9380-C708E4F89042} [2013.03.17 21:14:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{AAF8A8A7-22C8-47C5-9AEF-5F53A88645CC} [2013.03.15 23:13:06 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{7FF6A6C5-5740-42DC-8344-0980C3CCA899} [2013.03.15 23:00:12 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Roaming\Systweak [2013.03.15 23:00:09 | 000,019,896 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\Windows\SysNative\roboot64.exe [2013.03.15 03:02:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2013.03.14 22:55:27 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{6C1CB863-73A9-4369-B3C8-D8AB3F0FC3C7} [2013.03.14 09:27:02 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\testdisk-6.14-WIP.win [2013.03.13 21:51:13 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Origin [2013.03.13 17:48:06 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{46E16531-D5AC-495E-9B10-5FFA409919BB} [2013.03.13 07:25:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2013.03.12 20:23:44 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{47B5780E-6254-4615-ACA6-9C29035C6786} [2013.03.12 08:21:48 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{C71D4AF4-28EC-4438-842C-140D06EA4A32} [2013.03.10 22:45:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{C23F1070-D37A-4F6C-8FFA-CCA4CF82E489} [2013.03.10 18:01:31 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\b-s31476 [2013.03.10 17:55:46 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\flt-s3se [2013.03.10 17:51:40 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Sims3SP08 (1) [2013.03.10 17:35:34 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\flt-s3se (1) [2013.03.10 17:33:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\WinZip [2013.03.10 17:32:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip [2013.03.10 17:31:50 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Add-in Express [2013.03.10 17:31:42 | 000,000,000 | ---D | C] -- C:\ProgramData\WinZip [2013.03.10 17:31:40 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip [2013.03.09 11:29:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{B209E902-3893-4FBC-A24D-A350203D5285} [2013.03.07 19:07:37 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\cache [2013.03.07 18:31:11 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{408240A8-1B81-4831-9CFA-1CA4B12F8718} [2013.03.07 17:53:20 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Local\FullTiltPoker.eu [2013.03.07 17:51:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Full Tilt Poker.Eu [2013.03.05 23:00:04 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Local\{F690B3D2-7DD6-4388-9948-D86E880D61D4} [2013.03.03 11:00:08 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{7628B95F-B2B0-4FE4-B4EA-FFD31124B674} [2013.02.28 10:46:01 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{DC787A27-FEC3-49FF-859E-11300879E755} [2013.02.27 22:17:38 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{1226597B-688F-4D4B-8145-F51DA808A09C} [2013.02.25 09:59:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2013.02.25 09:58:41 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{295AC6CC-3C16-4715-AEA7-28F5A2AFA086} [2013.02.24 12:42:54 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{5BEAEB3C-8518-41E8-8934-5E147C620F68} [2013.02.22 13:48:28 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{5E032FED-FDB0-472D-B0A2-4E37587D5BE1} [2013.02.21 13:28:28 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{ACA7E138-9DF6-4B55-BDC6-AC95D8AAAE36} [2013.02.20 12:09:30 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{56EF37B8-DDD4-4A6E-811C-B640B67FB281} [2013.02.19 11:24:54 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{6EB29554-76BA-4ABF-9716-7F3D05260CE2} [2013.02.19 11:16:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{37AE3F26-01D4-4059-AAA9-7C5F69751B30} [2013.02.18 12:13:10 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{861F9CF8-4F8F-4815-A5F7-61027FC43401} [2012.08.21 13:21:36 | 000,442,560 | ---- | C] (Shlemoon Media Inc) -- C:\Users\***\AppData\Roaming\fdmer.exe [2012.08.21 13:21:35 | 000,525,312 | ---- | C] (BrowserSetter) -- C:\Users\***\AppData\Roaming\bsetter-own.exe [2012.08.21 13:21:33 | 000,457,789 | ---- | C] (Freedom Download Manager ) -- C:\Users\***\AppData\Roaming\fdm-setup.exe [2012.08.21 13:21:32 | 000,419,554 | ---- | C] (SearchAmong ) -- C:\Users\***\AppData\Roaming\satoolbar.exe ========== Files - Modified Within 30 Days ========== [2013.03.18 22:58:00 | 000,000,316 | ---- | M] () -- C:\Windows\tasks\PrintProjects Communicator.job [2013.03.18 22:44:01 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2793220-80344676-3747676903-1000UA.job [2013.03.18 22:20:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.03.18 19:06:18 | 000,014,832 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.03.18 19:06:18 | 000,014,832 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.03.18 18:14:22 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.03.18 18:14:22 | 000,696,620 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.03.18 18:14:22 | 000,651,938 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.03.18 18:14:22 | 000,147,916 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.03.18 18:14:22 | 000,120,870 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.03.18 18:09:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.03.18 18:09:42 | 3220,529,152 | -HS- | M] () -- C:\hiberfil.sys [2013.03.18 18:07:39 | 000,000,112 | ---- | M] () -- C:\Users\***\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten- - Trojaner-Board.url [2013.03.18 17:53:58 | 000,001,101 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.03.17 15:44:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2793220-80344676-3747676903-1000Core.job [2013.03.17 11:21:52 | 000,000,569 | ---- | M] () -- C:\Users\***\Desktop\FullTiltPokerEU - Verknüpfung.lnk [2013.03.17 10:59:14 | 000,001,636 | ---- | M] () -- C:\Windows\SysNative\ASOROSet.bin [2013.03.15 20:26:24 | 066,507,832 | ---- | M] () -- C:\Users\***\Desktop\f430785092.avi [2013.03.05 23:01:32 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif ========== Files Created - No Company Name ========== [2013.03.18 18:07:39 | 000,000,112 | ---- | C] () -- C:\Users\***\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten- - Trojaner-Board.url [2013.03.18 17:53:58 | 000,001,101 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.03.17 11:21:52 | 000,000,569 | ---- | C] () -- C:\Users\***\Desktop\FullTiltPokerEU - Verknüpfung.lnk [2013.03.15 23:49:54 | 000,001,636 | ---- | C] () -- C:\Windows\SysNative\ASOROSet.bin [2013.03.15 20:26:23 | 066,507,832 | ---- | C] () -- C:\Users\***\Desktop\f430785092.avi [2012.08.03 00:40:46 | 000,005,120 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.07.17 23:24:00 | 000,000,000 | ---- | C] () -- C:\Users\***\AppData\Roaming\FileOut.cns [2012.07.17 23:24:00 | 000,000,000 | ---- | C] () -- C:\Users\***\AppData\Roaming\FileIn.cns [2012.05.23 17:49:32 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2012.05.23 17:49:32 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2012.05.23 17:49:32 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2012.05.23 17:49:32 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2012.02.12 19:29:51 | 000,004,096 | -H-- | C] () -- C:\Users\***\AppData\Local\keyfile3.drm [2012.02.08 22:12:29 | 000,007,605 | ---- | C] () -- C:\Users\***\AppData\Local\Resmon.ResmonCfg [2012.02.07 20:07:40 | 000,000,028 | ---- | C] () -- C:\Windows\ODBC.INI [2012.02.05 20:48:35 | 001,589,442 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.02.05 14:45:07 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.10.19 14:28:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\aliasworlds [2012.12.29 11:54:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\APP_NAME_NON_STRING [2012.08.20 15:55:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Babylon [2012.10.19 13:31:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Boolat Games [2012.12.23 23:23:16 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft [2012.12.23 23:23:27 | 000,000,000 | ---D | M] -- C:\Users\Judy\AppData\Roaming\DVDVideoSoftIEHelpers [2012.10.18 20:27:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Farm Mania 2.1 [2012.10.22 15:28:46 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\freshgames [2012.10.22 14:07:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Friday's games [2012.10.21 19:15:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Happy Chef [2012.10.21 12:51:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Jumb-O-Fun Games [2012.12.23 23:23:16 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenCandy [2012.11.30 14:56:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Origin [2012.12.29 11:56:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PDF Architect [2012.10.19 13:31:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Peace Craft [2012.10.19 09:53:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ph03nixNewMedia [2012.10.21 18:49:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PlayFirst [2012.06.07 14:35:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Samsung [2012.10.19 16:06:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SulusGames [2013.03.15 23:50:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Systweak [2012.02.11 19:44:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Temp [2012.12.23 23:24:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software [2012.10.01 20:17:57 | 000,000,000 | ---D | M] -- C:\Users\Judy\AppData\Roaming\UDC Profiles [2012.10.18 22:03:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ViquaSoft [2012.02.11 20:47:16 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Visan [2012.02.14 11:20:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Windows Live Writer [2012.10.22 15:48:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\YoudaGames ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 255 bytes -> C:\ProgramData\TEMP:FD786DCA @Alternate Data Stream - 253 bytes -> C:\ProgramData\TEMP:04ADB7A6 @Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP:3C0887BF @Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:7920E530 @Alternate Data Stream - 213 bytes -> C:\ProgramData\TEMP:4F96D8E6 @Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:3A4C8FE7 @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:A5264343 @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:76466F4C @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:517B507A @Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:C43C957E @Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:66871744 @Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP  2397415@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:E6537A16 @Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:014BC3B4 @Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:7D288858 @Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:4B244549 @Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:A2B3764A @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:B722BCE5 @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:56C66609 @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:059167AF @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:3B07E6F4 @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:EE7AAC75 @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:69FE2EE4 @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:C35B4B19 @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:217A2A36 @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A1023D41 @Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:EA7D76BE @Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:961B4D58 @Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:1A4BF204 < End of report > OTL Extras logfile created on: 18.03.2013 22:30:36 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\***\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 19,64% Memory free 8,04 Gb Paging File | 1,59 Gb Available in Paging File | 19,74% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 126,00 Gb Total Space | 60,19 Gb Free Space | 47,77% Space Free | Partition Type: NTFS Drive E: | 350,98 Gb Total Space | 320,75 Gb Free Space | 91,39% Space Free | Partition Type: NTFS Drive F: | 150,54 Gb Total Space | 145,36 Gb Free Space | 96,55% Space Free | Partition Type: NTFS Drive G: | 303,98 Gb Total Space | 136,37 Gb Free Space | 44,86% Space Free | Partition Type: NTFS Computer Name: ***-PC | User Name: ***| Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "F:\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "F:\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- F:\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "F:\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "F:\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- F:\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{3162CD9E-FE27-4AE7-BF3A-94FA61EE7F50}" = rport=445 | protocol=6 | dir=out | app=system | "{344CFFBF-13F2-4CE9-A3DB-F4A785BFA0F2}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery | "{3C671F1D-C86B-4D2E-AD18-BE74CDAEDFFC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{3D02873B-435C-41E7-B64C-4A03AD597A44}" = lport=2869 | protocol=6 | dir=in | app=system | "{4105E107-1553-4B2D-B7AD-DB529EDC4201}" = lport=10243 | protocol=6 | dir=in | app=system | "{43883C0F-7B95-47A5-835F-5F1A1EDC2B81}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{43CA2624-6BAD-4AEE-B6F9-ADE4A01D57DF}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{45080EBC-BCA8-43F3-9410-A934B4B252F9}" = lport=2869 | protocol=6 | dir=in | app=system | "{46DADF12-9052-46FD-BA19-85DA9DFB08B0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{4B26C49A-7A3E-426C-80C4-B43DD2837076}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{54AAC723-D889-4E17-9DB7-3C4EF0F92096}" = rport=10243 | protocol=6 | dir=out | app=system | "{59AEF200-B739-4DED-A9C1-7CAF8D3FA3A8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{63356B0D-4A52-4C2B-BF56-71BBAD8239A5}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{6A6D884E-693E-4704-A323-1E90FD521625}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{6AAE36AA-A6E4-481A-A65C-307FA9024073}" = lport=445 | protocol=6 | dir=in | app=system | "{78793315-C7A6-45A9-80A3-8CE36C55EFDE}" = lport=138 | protocol=17 | dir=in | app=system | "{791288A3-1771-4D51-8FD0-05A47A61184D}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{94562CCC-C0EF-455B-84F5-58740917BD05}" = rport=139 | protocol=6 | dir=out | app=system | "{951BA374-B11C-42B1-973E-F3194B142CD8}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | "{997AFB6A-DDA8-4041-B5AC-B0D2A113D35B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{9D4E4146-D778-41CD-9307-C31450C6D8FE}" = lport=6004 | protocol=17 | dir=in | app=f:\office12\outlook.exe | "{9FA31E84-F9A3-4C54-ACC7-FF16FB845AB3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{ADEA0663-3E02-4247-AACA-15B15B0A9119}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | "{B5850EFC-E95B-49FC-BFC7-451FFB4EB234}" = rport=138 | protocol=17 | dir=out | app=system | "{B711A8F9-6A6A-45D1-9DA2-4BF579C6682F}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 | "{B9831461-9AC3-4C25-AB61-CD9C38607665}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | "{D98BD7A3-2244-4B1A-A18F-417F94AC365B}" = lport=139 | protocol=6 | dir=in | app=system | "{DC466A21-A8B5-486D-AEC7-DE4B5A0F3F4B}" = lport=137 | protocol=17 | dir=in | app=system | "{DCEECD20-E495-4E7B-BA8E-7D1C090D4B9A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{E297A276-16AD-45C1-B54C-B7FCEF69F7FB}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery | "{F55F286D-EA0E-419B-A38F-046ED061F0D5}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 | "{F6441BE3-5228-4A38-9507-9F1B103D5F96}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{F9D363BC-7E1E-4A34-8F2A-3F930D920C9B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{FA11DE6F-A02E-42EA-89B2-67F3CD9FF7CD}" = rport=137 | protocol=17 | dir=out | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{072AAE29-3358-4302-A45B-15471B543534}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{0A7F5EFE-A28A-458B-8A58-0970324BBC9D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{0CC1BE34-933C-4C50-BEDE-D4A670510773}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe | "{104F5090-BC32-44A7-8CEB-54EBB1016171}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe | "{10B8732D-218F-43C8-8583-69A02A0C7802}" = protocol=6 | dir=in | app=f:\office12\groove.exe | "{124DA7BD-5B8D-4A65-979C-821E71BC332C}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{1C865930-F75E-469E-BC73-DEE756F2388C}" = protocol=17 | dir=in | app=h:\bluetooth\bluesoleil.exe | "{1F6E896D-EA2F-4CEF-BC8F-4FC685A0DC69}" = protocol=6 | dir=in | app=h:\pinnacle\studio\programs\umi.exe | "{2576AF2D-5DDF-4DF4-B937-388B3EE3F996}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{264E1470-EE37-485A-A77A-C50840705B1E}" = protocol=6 | dir=out | app=%systemroot%\system32\wudfhost.exe | "{2B1DF667-B091-4704-9D27-743FB73DA079}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{34609FA1-5903-41E9-8530-C3B500A454BB}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{3CA1F1DA-AF01-433E-A6E8-030DAB74E9A3}" = protocol=17 | dir=in | app=f:\office12\groove.exe | "{3DF127AF-7E2E-406D-85FF-8B3A68755802}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{458CC456-D32F-4400-AF11-A3A2961268FA}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | "{54E86AA7-86C0-4FA0-AE76-DFFFD2E6F152}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{5FE7CCA9-FD15-462C-85D2-4F014BB8E9DA}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | "{6038B275-6F94-4ED9-840B-D62EAF5A2697}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe | "{61CBEE58-AD21-404B-8A6A-BBDD406D26FA}" = protocol=6 | dir=in | app=c:\programdata\kodak\installer\setup.exe | "{66A4B02B-46BC-4C46-B54F-C1A321CEA9E0}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe | "{66BCD392-DB6A-474F-9A70-D981E3B02202}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | "{69B4700D-CFCB-4222-968E-CC9C869C99B2}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | "{6E7DE01E-4BC0-48FC-9A1D-E79FA2BF59A7}" = dir=in | app=h:\samsung\all share\allshare\allsharedms\allsharedms.exe | "{703CE2C8-F6DA-4528-B441-D80F6AF06FB1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{7D45517D-610D-435C-AD02-85AFE180C6DC}" = protocol=6 | dir=in | app=h:\bluetooth\bluesoleil.exe | "{87280654-208A-4DE7-A263-9B74A5002896}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{88CACD6A-4FB4-48D8-B70E-705B64D27C55}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe | "{89B4206E-0069-4E73-9CE4-875FA0E6A848}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{8BEC423F-30DF-49DE-B373-3892E1DDB005}" = dir=in | app=h:\samsung\all share\allshare\allshare.exe | "{8C9DC701-3D1E-417E-BFB7-4E8B9485CB98}" = protocol=6 | dir=in | app=h:\pinnacle\studio\programs\studio.exe | "{8FD1AAFC-E1E5-4A88-AD52-B0E735EB4043}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | "{8FDA1BB6-4D86-44C2-8B90-666E319A956B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{944BFF15-F120-4FE9-B8DD-97A0F44F9F6A}" = protocol=17 | dir=in | app=h:\pinnacle\studio\programs\rm.exe | "{949A1B8A-8CF9-4F41-B13E-BF054A0E7248}" = dir=in | app=h:\samsung\all share\allshare\allshareagent.exe | "{9C98D56B-CBAA-452A-BCA3-0834F0D38BA4}" = protocol=58 | dir=in | app=system | "{A6A1EAC9-E8BB-4792-9FC1-3B7A1133DB6B}" = protocol=6 | dir=in | app=h:\pinnacle\studio\programs\rm.exe | "{A88C9919-D708-4DE7-BE39-8EA9E838497D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{A9DE113C-AE0F-4C4D-827C-6F19E229F394}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{AAF23AB9-4E50-4EA7-B21E-76D99470D13A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{AB063BA1-4E15-4D33-A976-6DE5292A1CE3}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | "{AB33683D-85F4-4850-9C22-294543B094DE}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe | "{B3B0CE31-EE76-44CB-940C-BD63FC1E9199}" = protocol=6 | dir=in | app=c:\users\judy\downloads\sweetimsetup.exe | "{B72A2CA6-543A-4185-8622-E064DD8C21D9}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{C6C90B7E-8306-4B57-A464-E5AE8D1F25B6}" = protocol=6 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{CA8AF7B3-88A7-4FAA-8207-02879A03EE8E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{CFBBB219-B4C9-47B5-9A81-112FEB0A7FE4}" = protocol=17 | dir=in | app=h:\pinnacle\studio\programs\studio.exe | "{D5AF5A8A-EEFD-4A9F-884A-A65AF2134984}" = protocol=17 | dir=in | app=h:\pinnacle\studio\programs\umi.exe | "{DCC1DB9C-A3D4-4199-9930-3D1E322E2879}" = protocol=17 | dir=in | app=c:\programdata\kodak\installer\setup.exe | "{DCCF28F5-58C8-4A48-BE6A-F3DA326DA1D0}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{DD212687-F582-4346-A7B9-96E2F2D99FA7}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{DD903694-8321-40AF-B195-6342B1821F63}" = protocol=6 | dir=out | app=system | "{DE4F6C2B-ABC1-43A6-817E-E3787271FAE6}" = protocol=6 | dir=in | app=f:\office12\onenote.exe | "{F43208C0-D625-4176-A695-61A46502EBCD}" = protocol=17 | dir=in | app=c:\users\judy\downloads\sweetimsetup.exe | "{F44D7258-FC05-428A-8FB8-146B5DD5ED31}" = protocol=17 | dir=in | app=f:\office12\onenote.exe | "{F71F9A12-9531-458A-BA7C-87F2DC9F1BF6}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe | "{F920BBEA-D0D0-4DBC-BFD5-4678D21CE8F9}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe | "TCP Query User{842F6710-2578-4040-BFBB-3AE06C252C2F}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe | "UDP Query User{3FACB87A-43F9-49B0-8096-30CD2F4601FF}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector "{0D87AE67-14EB-4C10-88A5-DA6C3181EB18}" = Windows Live Family Safety "{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack "{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant "{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 "{2128559D-BBCD-4744-87F0-7C0CD5CFB464}" = Windows Live Family Safety "{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer "{6DE721A5-5E89-4D74-994C-652BB3C0672E}" = Pinnacle Video Treiber "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007 "{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007 "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64) "{CD95F661-A5C4-44F5-A6AA-ECDD91C240D9}" = WinZip 17.0 "{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources "{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources "{D954C6C2-544B-4091-A47F-11E77162883E}" = Microsoft Security Client "{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter "{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack "{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client "{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended "Microsoft Security Client" = Microsoft Security Essentials [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{01E9B2FF-DAF4-4529-9CC9-2101625517C7}" = nero.prerequisites.msi "{034DCAF9-96E7-4936-9A07-712F80B5181E}" = Nero RescueAgent 11 "{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion "{08A25478-C5DD-4EA7-B168-3D687CA987FF}" = Die Sims™ 3 Traumsuite-Accessoires "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer "{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0 "{117B6BF6-82C3-420C-B284-9247C8568E53}" = Die Sims™ 3 Design-Garten-Accessoires "{11D3EF85-63E1-4AE4-A7C1-9241BDB16B51}" = Nero ControlCenter 11 "{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}" = Full Tilt Poker.Eu "{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger "{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions "{26A24AE4-039D-4CA4-87B4-2F83217015FF}" = Java 7 Update 15 "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery "{376348C2-E372-48BC-A138-E896757BD86A}" = aioscnnr "{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack "{3BBFD444-5FAB-49F6-98B1-A1954E831399}" = Die Sims™ 3 Showtime "{3DE92282-CB49-434F-81BF-94E5B380E889}" = Die Sims™ 3 Jahreszeiten "{45057FCE-5784-48BE-8176-D9D00AF56C3C}" = Die Sims™ 3 Late Night "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{53F7746A-96AA-49A5-86B8-59989680DAC5}" = Nero Burning ROM 11 Help (CHM) "{56BA241F-580C-43D2-8403-947241AAE633}" = center "{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{71828142-5A24-4BD0-97E7-976DA08CE6CF}" = Die Sims™ 3 Luxus-Accessoires "{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core "{7B11296A-F894-449C-8DF6-6AAAA7D4D118}" = Die Sims™ 3 Stadt-Accessoires "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{83BEEFB4-8C28-4F4F-8A9D-E0D1ADCE335B}" = Die Sims Mittelalter "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform "{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer "{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007 "{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = Die Sims™ 3 Traumkarrieren "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker "{95140000-007A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9B2506E3-9A3F-45B5-96BF-509CAD584650}" = Die Sims™ 3 Katy Perry Süße Welt "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail "{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common "{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer "{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.6) - Deutsch "{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh "{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie "{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail "{B1846721-A8E6-46C7-83B6-0DCF7ADB4267}" = Nero Burning ROM 11 "{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}" = Die Sims™ 3 Reiseabenteuer "{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials "{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components 11 "{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr "{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3 "{C12631C6-804D-4B32-B0DD-8A496462F106}" = Die Sims™ 3 Einfach tierisch "{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common "{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform "{D01CE99A-8802-483C-A79F-298B691EB432}" = Nero RescueAgent 11 Help (CHM) "{D041EB9E-890A-4098-8F94-51DA194AC72A}" = Pinnacle Studio 12 "{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64 "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform "{D4D66270-9147-4BDF-9946-FCA2B303AA8F}" = Nero ControlCenter 11 Help (CHM) "{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq "{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10 "{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK All-in-One Software "{E1868CAE-E3B9-4099-8C18-AA8944D336FD}" = Die Sims™ 3 70er, 80er & 90er Accessoires "{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime "{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker "{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger "{E656D89A-8CBB-497F-918F-8361A4071C26}" = Nero Burning ROM 11 "{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}" = Die Sims™ 3 Lebensfreude "{ED436EA8-4145-4703-AE5D-4D09DD24AF5A}" = Die Sims™ 3 Gib Gas-Accessoires "{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5 "{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials "Adobe Acrobat 4.0" = Adobe Acrobat 4.0 "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "BFGC" = Big Fish Games: Game Manager "BFG-Das gelobte Land" = Das gelobte Land "BFG-Mein Landleben" = Mein Landleben "BFG-Mein Landleben 2" = Mein Landleben 2 "BFG-Ranch Rush" = Ranch Rush "BFG-Youda Marina" = Youda Marina "ENTERPRISE" = Microsoft Office Enterprise 2007 "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.37.1212 "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100 "Origin" = Origin "PrintProjects" = PrintProjects "Verkehrsplaner - Die Simulation" = Verkehrsplaner - Die Simulation "Winamp" = Winamp "WinLiveSuite" = Windows Live Essentials "Zylom Games Player Plugin" = Zylom Games Player Plugin ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Google Chrome" = Google Chrome "Winamp Detect" = Winamp Erkennungs-Plug-in ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 18.03.2013 02:12:54 | Computer Name = ***-PC | Source = MsiInstaller | ID = 11921 Description = Error - 18.03.2013 12:35:23 | Computer Name = ***-PC | Source = MsiInstaller | ID = 11921 Description = Error - 18.03.2013 13:16:10 | Computer Name = ***-PC | Source = MsiInstaller | ID = 11921 Description = Error - 18.03.2013 13:24:18 | Computer Name = ***-PC | Source = MsiInstaller | ID = 11921 Description = Error - 18.03.2013 13:53:41 | Computer Name = ***-PC | Source = SideBySide | ID = 16842761 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\WinZip\adxloader.dll.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files\WinZip\adxloader.dll.Manifest" in Zeile 2. Das Stammelement der Manifestdatei muss assembliert sein. Error - 18.03.2013 14:41:13 | Computer Name = ***-PC | Source = SideBySide | ID = 16842761 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\WinZip\adxloader.dll.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files\WinZip\adxloader.dll.Manifest" in Zeile 2. Das Stammelement der Manifestdatei muss assembliert sein. Error - 18.03.2013 16:38:54 | Computer Name = ***-PC | Source = MsiInstaller | ID = 11327 Description = Error - 18.03.2013 16:40:50 | Computer Name = ***-PC | Source = Application Hang | ID = 1002 Description = Programm iexplore.exe, Version 9.0.8112.16470 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1128 Startzeit: 01ce2418b9e86970 Endzeit: 19 Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID: 1b5d3ceb-900c-11e2-b521-00248ca70b83 Error - 18.03.2013 16:41:58 | Computer Name = ***-PC | Source = Application Hang | ID = 1002 Description = Programm NOTEPAD.EXE, Version 6.1.7600.16385 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: b4 Startzeit: 01ce2418f6caa168 Endzeit: 1 Anwendungspfad: C:\Windows\system32\NOTEPAD.EXE Berichts-ID: 3bf9cc89-900c-11e2-b521-00248ca70b83 Error - 18.03.2013 16:42:44 | Computer Name = ***-PC | Source = Application Hang | ID = 1002 Description = Programm iexplore.exe, Version 9.0.8112.16470 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1094 Startzeit: 01ce2418e1c0bb9b Endzeit: 0 Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID: 59f7b2a5-900c-11e2-b521-00248ca70b83 Error - 18.03.2013 16:45:06 | Computer Name = ***-PC | Source = Application Hang | ID = 1002 Description = Programm iexplore.exe, Version 9.0.8112.16470 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1100 Startzeit: 01ce241923f8d803 Endzeit: 2680 Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID: [ System Events ] Error - 11.09.2012 19:04:03 | Computer Name = ***-PC | Source = atikmdag | ID = 43029 Description = Display is not active Error - 11.09.2012 19:04:18 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: BTHidMgr Error - 12.09.2012 02:35:27 | Computer Name = ***-PC | Source = atikmdag | ID = 52236 Description = CPLIB :: General - Invalid Parameter Error - 12.09.2012 02:35:27 | Computer Name = ***-PC | Source = atikmdag | ID = 43029 Description = Display is not active Error - 12.09.2012 02:35:46 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: BTHidMgr Error - 12.09.2012 02:36:35 | Computer Name = ***-PC | Source = atikmdag | ID = 52236 Description = CPLIB :: General - Invalid Parameter Error - 12.09.2012 02:36:35 | Computer Name = ***-PC | Source = atikmdag | ID = 43029 Description = Display is not active Error - 12.09.2012 02:36:51 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: BTHidMgr Error - 13.09.2012 05:11:16 | Computer Name = ***-PC | Source = atikmdag | ID = 52236 Description = CPLIB :: General - Invalid Parameter Error - 13.09.2012 05:11:16 | Computer Name = ***-PC | Source = atikmdag | ID = 43029 Description = Display is not active < End of report > GMER 2.1.19155 - hxxp://www.gmer.net Rootkit scan 2013-03-18 22:41:20 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-4 Hitachi_HDT721010SLA360 rev.ST6OA31B 931,51GB Running: gmer_2.1.19155.exe; Driver: C:\Users\Judy\AppData\Local\Temp\kxldypob.sys ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\svchost.exe [112:3808] 000007fef2c33efc Thread C:\Windows\System32\svchost.exe [112:2896] 000007fef2c78a4c Thread C:\Windows\system32\svchost.exe [324:1580] 000007fef2e0d3c8 Thread C:\Windows\system32\svchost.exe [324:2784] 000007fef2e0d3c8 Thread C:\Windows\system32\svchost.exe [324:4360] 000007fef2e0d3c8 Thread C:\Windows\system32\svchost.exe [324:1156] 000007fef2e0d3c8 Thread C:\Windows\system32\svchost.exe [384:2928] 000007fef39484d8 Thread C:\Windows\system32\svchost.exe [384:2472] 000007fef37823a8 Thread C:\Windows\system32\svchost.exe [384:2364] 000007fef3720d00 Thread C:\Windows\system32\svchost.exe [384:2872] 000007fef3669498 Thread C:\Windows\system32\svchost.exe [384:3088] 000007fef8be5124 Thread C:\Windows\system32\svchost.exe [384:2428] 000007fef219506c Thread C:\Windows\system32\svchost.exe [384:1776] 000007fef77a1c20 Thread C:\Windows\system32\svchost.exe [384:680] 000007fef77a1c20 Thread C:\Windows\system32\svchost.exe [384:2340] 000007fefb754164 Thread C:\Windows\system32\svchost.exe [384:1468] 000007fef7411ab0 Thread C:\Windows\system32\svchost.exe [580:1220] 000007fefa4e8274 Thread C:\Windows\system32\svchost.exe [580:1548] 000007fefa4e8274 Thread C:\Windows\System32\spoolsv.exe [1300:2040] 000007fef88b10c8 Thread C:\Windows\System32\spoolsv.exe [1300:1484] 000007fef7ae6144 Thread C:\Windows\System32\spoolsv.exe [1300:2064] 000007fef78d5fd0 Thread C:\Windows\System32\spoolsv.exe [1300:2072] 000007fef78a3438 Thread C:\Windows\System32\spoolsv.exe [1300:2076] 000007fef78d63ec Thread C:\Windows\System32\spoolsv.exe [1300:2100] 000007fef97e5e5c Thread C:\Windows\System32\spoolsv.exe [1300:2720] 0000000180040190 Thread C:\Windows\System32\spoolsv.exe [1300:3024] 0000000180040190 Thread C:\Windows\system32\svchost.exe [1332:1700] 000007fef9bd35c0 Thread C:\Windows\system32\svchost.exe [1332:2320] 000007fef9bd5600 Thread C:\Windows\system32\svchost.exe [1332:2724] 000007fef7242888 Thread C:\Windows\system32\svchost.exe [1332:2732] 000007fef7232940 Thread C:\Windows\system32\svchost.exe [1332:1648] 000007fef7242a40 Thread C:\Windows\system32\taskhost.exe [1536:1736] 000007fef97d1f38 Thread C:\Windows\system32\taskhost.exe [1536:1740] 000007fef9a32740 Thread C:\Windows\system32\taskhost.exe [1536:1808] 000007fef9061010 Thread C:\Program Files\Microsoft Security Client\msseces.exe [2188:2660] 000007fefbbf2a7c Thread C:\Windows\System32\svchost.exe [3620:2612] 000007fef8be9874 Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [4836:4252] 000000005b5b0268 Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [4836:2344] 000000005b5b0268 Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [4836:4460] 000000005b5b0268 Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [4836:2848] 000000005b5b0268 Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [4836:1500] 000000005b5b0268 Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [4836:5020] 000000005b5b0268 Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [4836:3836] 000000005b5b0268 Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [4836:4620] 000000005b5b0268 Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [4836:1636] 000000005b5b0268 Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [4836:664] 000000005b5b0268 Thread C:\Windows\system32\taskhost.exe [4868:4412] 000007fef778ef24 Thread C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe [3740:3656] 00000000773e2e25 Thread C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe [3740:3756] 0000000063218f48 Thread C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe [3740:3732] 00000000773e3e45 Thread C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe [3740:1900] 00000000773e3e45 Thread C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe [3740:2500] 00000000773e3e45 ---- EOF - GMER 2.1 ---- wenn was fehlt bitte bescheid geben, mache sowas zum ersten mal. Vielen Dank |
|
19.03.2013, 12:56
| #3 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.B Hallo und
__________________ Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!  Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
19.03.2013, 17:37
| #4 |
| | Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.B Hallo Cosinus, ich habe im Malwarebytes die gewünschten Logfiles gefunden. Gesamt 3 Stück. Habe noch Microsoft Security Essentials aber da werden mir keine Logdateien angezeigt nur folgendes: Microsoft Security Essentials Code:
ATTFilter Kategorie: Downloadtrojaner
Beschreibung: Dieses Programm ist gefährlich. Es lädt andere Programme herunter.
Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.
Elemente:
file:C:\Users\Judy\AppData\Local\Temp\Temp1_Postetikett_Deutsche_Post_AG_DE429-24-64.zip\Postetikett_Deutsche_Post_AG_DE429-24-64.exe
Online weitere Informationen zu diesem Element abrufen
Malwarebytes Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.70.0.1100 www.malwarebytes.org Datenbank Version: v2013.03.18.11 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Judy :: JUDY-PC [Administrator] Schutz: Aktiviert 18.03.2013 17:55:54 mbam-log-2013-03-18 (17-55-54).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 208345 Laufzeit: 4 Minute(n), 33 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 3 HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111181125} (PUP.CrossRider.BCA) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111181125} (PUP.CrossRider.BCA) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 4 C:\$Recycle.Bin\S-1-5-21-2793220-80344676-3747676903-1000\$RYATA9Y.exe (PUP.BundleInstaller.VIO) -> Keine Aktion durchgeführt. C:\ProgramData\GBox\GBox.exe (Trojan.Dropper) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\OptimizerPro1\OptimizerPro1.exe (Trojan.Dropper) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Judy\AppData\Local\Temp\Vid-Saver-rs.exe (Adware.GamePlayLabs) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter 2013/03/18 17:54:19 +0100 JUDY-PC Judy MESSAGE Executing scheduled update: Daily
2013/03/18 17:54:22 +0100 JUDY-PC Judy MESSAGE Starting protection
2013/03/18 17:54:22 +0100 JUDY-PC Judy MESSAGE Protection started successfully
2013/03/18 17:54:22 +0100 JUDY-PC Judy MESSAGE Starting IP protection
2013/03/18 17:54:23 +0100 JUDY-PC Judy MESSAGE IP Protection started successfully
2013/03/18 17:54:35 +0100 JUDY-PC Judy MESSAGE Starting database refresh
2013/03/18 17:54:35 +0100 JUDY-PC Judy MESSAGE Stopping IP protection
2013/03/18 17:54:35 +0100 JUDY-PC Judy MESSAGE IP Protection stopped successfully
2013/03/18 17:54:37 +0100 JUDY-PC Judy MESSAGE Scheduled update executed successfully: database updated from version v2012.12.14.11 to version v2013.03.18.11
2013/03/18 17:54:37 +0100 JUDY-PC Judy MESSAGE Database refreshed successfully
2013/03/18 17:54:38 +0100 JUDY-PC Judy MESSAGE Starting IP protection
2013/03/18 17:54:45 +0100 JUDY-PC Judy MESSAGE IP Protection started successfully
2013/03/18 18:09:56 +0100 JUDY-PC Judy MESSAGE Starting protection
2013/03/18 18:09:56 +0100 JUDY-PC Judy MESSAGE Protection started successfully
2013/03/18 18:09:56 +0100 JUDY-PC Judy MESSAGE Starting IP protection
2013/03/18 18:10:05 +0100 JUDY-PC Judy MESSAGE IP Protection started successfully
Code:
ATTFilter 2013/03/19 07:20:26 +0100 JUDY-PC Judy MESSAGE Starting protection
2013/03/19 07:20:26 +0100 JUDY-PC Judy MESSAGE Protection started successfully
2013/03/19 07:20:26 +0100 JUDY-PC Judy MESSAGE Starting IP protection
2013/03/19 07:20:35 +0100 JUDY-PC Judy MESSAGE IP Protection started successfully
2013/03/19 16:30:50 +0100 JUDY-PC Judy MESSAGE Starting protection
2013/03/19 16:30:50 +0100 JUDY-PC Judy MESSAGE Protection started successfully
2013/03/19 16:30:50 +0100 JUDY-PC Judy MESSAGE Starting IP protection
2013/03/19 16:30:58 +0100 JUDY-PC Judy MESSAGE IP Protection started successfully
2013/03/19 16:32:09 +0100 JUDY-PC Judy MESSAGE Executing scheduled update: Daily
2013/03/19 16:32:18 +0100 JUDY-PC Judy MESSAGE Scheduled update executed successfully: database updated from version v2013.03.18.11 to version v2013.03.19.04
2013/03/19 16:32:18 +0100 JUDY-PC Judy MESSAGE Starting database refresh
2013/03/19 16:32:19 +0100 JUDY-PC Judy MESSAGE Stopping IP protection
2013/03/19 16:32:20 +0100 JUDY-PC Judy MESSAGE IP Protection stopped successfully
2013/03/19 16:32:22 +0100 JUDY-PC Judy MESSAGE Database refreshed successfully
2013/03/19 16:32:22 +0100 JUDY-PC Judy MESSAGE Starting IP protection
2013/03/19 16:32:29 +0100 JUDY-PC Judy MESSAGE IP Protection started successfully
2013/03/19 17:00:47 +0100 JUDY-PC Judy MESSAGE Starting protection
2013/03/19 17:00:47 +0100 JUDY-PC Judy MESSAGE Protection started successfully
2013/03/19 17:00:47 +0100 JUDY-PC Judy MESSAGE Starting IP protection
2013/03/19 17:00:56 +0100 JUDY-PC Judy MESSAGE IP Protection started successfully
|
|
20.03.2013, 00:35
| #5 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.BZitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
20.03.2013, 07:08
| #6 |
| | Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.B ich hab ne Office CD bekommen, da ich keins hatte und da war das mit drauf. nicht gut? |
|
20.03.2013, 13:30
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.B Von wem bitte hast du was für eine CD bekommen? Dir ist schon klar, das MS-Office ziemlich viel Geld kostet?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
20.03.2013, 13:44
| #8 |
| | Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.B Mir ist schon klar was das Programm kostet und deshalb habe ich auch Glück gehabt das ich es mir nicht kaufen musste sondern jemanden hatte der das hatte. |
|
20.03.2013, 14:13
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.B Mit anderen Worten: jmd hat dir eine illegale/gecrackte Version gegeben  Warum nimmst du denn kein freies Office wie zB LibreOffice wenn du kein Geld ausgeben kannst oder willst? Sry aber bei illegaler Software gibt es hier nur noch Hilfe zur Datensicherung + Neuinstallation von Windows Siehe auch => http://www.trojaner-board.de/95393-c...-software.html Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support ohne jegliche Diskussion beenden. Cracks/Keygens sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!! Dass illegale Cracks und Keygens im Wesentlichen dazu dienen, Malware zu verbreiten ist kein Geheimnis und muss jedem klar sein! In Zukunft Finger weg von: Softonic, Registry-Bereinigern und illegalem Zeugs Cracks/Keygens/Serials
__________________ Logfiles bitte immer in CODE-Tags posten |
|
21.03.2013, 08:49
| #10 |
| | Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.B Mit anderen Worten, ich bin davon ausgegangen das das ein echtes Programm ist und keine gecrackte Version. Sollte es nicht so sein, habe ich das nicht gewusst. :mad: |
|
21.03.2013, 10:37
| #11 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.BZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
22.03.2013, 08:54
| #12 |
| | Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.B Mir ist klar das die Lizenzen viel Geld kosten. Als ich mir mein Windows 7 gekauft hab, habe ich auch viel Geld bezahlt. Aber nur weil jemand sich die CD kauft und der Meinung ist nem Freund was gutes zu tun oder ne Freude machen will ist das gleich ne gecrackte CD? Er hat ja schließlich die CD wieder mitgenommen und nicht mir überlassen. Wo ist der Unterschied ob er mir die Software rauf spielt oder zu Hause 5 PC´s hat wo er die Software drauf hat??? Es hört sich hier so an als ob bei Geld die Freunschaft aufhört! Ich möchte mich jetzt hier auch nicht noch Tagelang dafür rechtfertigen da ich davon aus ging das ich nichts falsch gemacht hab und einfach nur Dankend das Angebot von einem Freund angenommen hab. Schade das man mir hier nicht weiter kann und Danke trotzdem das man sich die Zeit genommen hat. |
|
22.03.2013, 10:14
| #13 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.B Es geht darum, dass du ohne Lizenz eine Enterprise Edititon von MS Office drauf hast. Enterprise Editionen sind AFAIK nur als Volumenlizenz zu beziehen und du willst mir erzählen, dein Freund hätte dir etwas Gutes getan indem er dir einfach so eine Version draufspielt? Also bitte.  Zitat:
Die Software ist doch trotzdem ohne Lizenz installiert und ich glaube kaum dass dein Freund da eine Enterprise Edition einfach so mal abgibt Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Trojan:Win32/Matsnu - TrojanDownloader:Win32/Kuluoz.B |
| .dll, administrator, autorun, bho, bonjour, browser, converter, dateien, downloader, email, error, explorer, externe festplatte, feedback, fehler, festplatte, firefox, flash player, google, helper, home, homepage, iexplore.exe, kaputt, logfile, malwarebytes, microsoft, mp3, musik, nicht öffnen, object, optimizerpro, ordner, problem, pup.bundleinstaller.vio, pup.crossrider.bca, realtek, recycle.bin, registry, scan, security, senden, software, suche, svchost.exe, system, temp, trojan, trymedia, u.s.w., viren, windows, öffnet |
Linear-Darstellung
