| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Phishing Mail von WoW Link angeklickt!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.05.2013, 12:52
| #1 |
| |  Phishing Mail von WoW Link angeklickt! Hallo, ich habe heute eine Mail bekommen, die angeblich von Battle.net kam (in gebrochenem Deutsch!) In dieser stand, dass ich versuchen würde, meinen WoW Account zu verkaufen (ich weiss garnicht ob ich einen habe.......) Es waren 2 Links dabei, die ich anklicken sollte, wenn nicht würden rechtliche Schritte eingeleitet werden! Ich geriet ein wenig in Panik, klickte den 1. Link an......dieser führte auf eine Seite die so aus sah wie die von Battle.net mit den AGB`s! Dann den 2. auf dem ich meine Daten eingaben sollte (laut Mail) Als ich den angeklickt habe stand im Browser mit dicker schwarzer Schrift aus weissem Hintergrund: "Bad Request ......" (..... steht für sonst was, was ich nicht mehr so genau weiss  )Dann las ich, dass man die Links niemals anklicken sollte, da evtl. auch Viren auf den PC geladen werden könnten..... Ich habe davor echt Angst, da meine Eltern viel Onlinebanking abwickeln! Könntet ihr mir bitte helfen??? Logfiles sind folgende: OTL.Txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 13.05.2013 13:57:53 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\yannick\Desktop Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,40 Gb Available Physical Memory | 70,29% Memory free 4,23 Gb Paging File | 3,59 Gb Available in Paging File | 84,70% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 117,42 Gb Total Space | 15,16 Gb Free Space | 12,91% Space Free | Partition Type: NTFS Drive D: | 180,66 Gb Total Space | 159,54 Gb Free Space | 88,31% Space Free | Partition Type: NTFS Drive E: | 7,03 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: YANNICK-PC | User Name: yannick | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.05.13 13:56:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\yannick\Desktop\OTL.exe PRC - [2013.03.06 17:30:43 | 003,560,288 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version8\TeamViewer_Service.exe PRC - [2012.08.30 21:13:00 | 001,258,856 | R--- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.08.30 17:57:35 | 001,820,520 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe PRC - [2012.08.30 17:57:34 | 000,864,104 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe PRC - [2012.08.30 11:40:00 | 000,382,312 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.01.17 12:24:10 | 000,055,296 | ---- | M] () -- C:\Windows\System32\ASGT.exe PRC - [2011.12.26 15:46:44 | 000,375,872 | ---- | M] (Ralink Technology, Corp.) -- C:\Programme\TP-LINK\TP-LINK Wireless Configuration Utility\Service\RaRegistry.exe PRC - [2009.08.18 12:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE PRC - [2009.08.18 12:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE PRC - [2008.01.19 00:38:40 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2008.01.19 00:33:12 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.01.19 00:33:06 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe ========== Modules (No Company Name) ========== ========== Services (SafeList) ========== SRV - [2013.04.12 15:42:16 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.03.13 20:31:39 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.03.06 17:30:43 | 003,560,288 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8) SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.08.30 21:13:00 | 001,258,856 | R--- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.08.30 11:40:00 | 000,382,312 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.01.17 12:24:10 | 000,055,296 | ---- | M] () [Auto | Running] -- C:\Windows\System32\ASGT.exe -- (ASGT) SRV - [2011.12.26 15:46:44 | 000,375,872 | ---- | M] (Ralink Technology, Corp.) [Auto | Running] -- C:\Programme\TP-LINK\TP-LINK Wireless Configuration Utility\Service\RaRegistry.exe -- (RalinkRegistryWriter) SRV - [2009.08.18 12:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2008.01.19 00:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.19 00:33:40 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | Disabled | Running] -- C:\Windows\system32\drivers\IOMap.sys -- (IOMap) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - [2012.08.30 21:13:00 | 010,790,760 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2012.07.03 17:25:17 | 000,149,352 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA) DRV - [2012.02.14 08:07:50 | 001,093,472 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u) DRV - [2011.08.18 21:43:50 | 000,028,824 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\FinalWire\AIDA64 Extreme Edition\kerneld.x32 -- (AIDA64Driver) DRV - [2010.02.24 12:22:10 | 000,185,472 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11) DRV - [2007.05.11 12:40:42 | 000,329,728 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netr73.sys -- (netr73) DRV - [2006.11.02 09:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.04.12 15:42:17 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.04.19 09:52:44 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.04.12 15:42:17 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.04.19 09:52:44 | 000,000,000 | ---D | M] [2013.02.28 15:21:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\yannick\AppData\Roaming\mozilla\Extensions [2013.05.05 14:21:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\yannick\AppData\Roaming\mozilla\Firefox\Profiles\b4cu94sg.default\extensions [2013.03.11 09:08:25 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2013.04.12 15:42:17 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2013.02.27 08:15:10 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2013.02.27 08:15:10 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2013.02.27 08:15:10 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2013.02.27 08:15:10 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2013.02.27 08:15:10 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2013.02.27 08:15:10 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent File not found O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{18CA9058-44ED-4D79-87E7-90E9A8213D8E}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9DA560FD-1803-42CB-B420-60513461AD32}: DhcpNameServer = 192.168.1.1 192.168.1.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Green Sea Turtle.jpg O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Green Sea Turtle.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2008.11.15 11:52:50 | 000,161,088 | R--- | M] (Take-Two Interactive Software, Inc.) - E:\Autorun.exe -- [ UDF ] O32 - AutoRun File - [2008.10.11 19:03:48 | 000,000,054 | R--- | M] () - E:\Autorun.inf -- [ UDF ] O33 - MountPoints2\{7389a982-7cc2-11e2-8b15-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{7389a982-7cc2-11e2-8b15-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe -- [2008.11.15 11:52:50 | 000,161,088 | R--- | M] (Take-Two Interactive Software, Inc.) O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.05.13 13:56:07 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\yannick\Desktop\OTL.exe [2013.05.12 09:19:23 | 000,000,000 | ---D | C] -- C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Boeing 767-300 Condor NEW [2013.05.12 09:19:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Boeing 767-300 Condor NEW [2013.05.01 21:02:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft [2013.05.01 21:02:20 | 000,000,000 | ---D | C] -- C:\Users\yannick\AppData\Roaming\DVDVideoSoft [2013.05.01 21:02:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft [2013.05.01 21:02:19 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft [2013.05.01 10:48:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\directx [2013.04.30 21:08:40 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2013.04.30 10:35:58 | 000,000,000 | ---D | C] -- C:\Users\yannick\Desktop\sound [2013.04.26 11:46:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP [2013.04.24 19:12:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Leitstelle Albstadt 2 [2013.04.24 19:12:29 | 000,000,000 | ---D | C] -- C:\Program Files\Leitstelle Albstadt 2 [2013.04.20 19:13:10 | 029,528,267 | ---- | C] (Leonard Bienbeck) -- C:\Users\yannick\Desktop\Funkspiel-MS-Client-1.4.1(1).exe [2013.04.19 16:34:24 | 000,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard [2013.04.19 09:55:53 | 000,000,000 | ---D | C] -- C:\Users\yannick\dwhelper [2013.04.17 17:32:03 | 000,000,000 | ---D | C] -- C:\Users\yannick\AppData\Local\Quadriga Games [2013.04.17 17:28:58 | 000,000,000 | ---D | C] -- C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Die Polizei [2013.04.17 16:48:08 | 000,000,000 | ---D | C] -- C:\Users\yannick\Documents\Flight Simulator X-Dateien [2013.04.16 09:22:18 | 000,000,000 | ---D | C] -- C:\Users\yannick\Desktop\5 [2013.04.15 11:38:33 | 000,000,000 | ---D | C] -- C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Alan Starkey [2013.04.14 17:12:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Real Atc Mission AZ296 [2013.04.14 17:08:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Real Atc Mission AZ269 ========== Files - Modified Within 30 Days ========== [2013.05.13 13:56:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\yannick\Desktop\OTL.exe [2013.05.13 13:55:23 | 000,000,000 | ---- | M] () -- C:\Users\yannick\defogger_reenable [2013.05.13 13:54:58 | 000,050,477 | ---- | M] () -- C:\Users\yannick\Desktop\Defogger.exe [2013.05.13 13:29:16 | 000,686,770 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.05.13 13:29:16 | 000,644,912 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.05.13 13:29:16 | 000,150,938 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.05.13 13:29:16 | 000,123,760 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.05.13 13:24:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.05.13 13:22:41 | 000,003,776 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.05.13 13:22:41 | 000,003,776 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.05.13 13:22:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.05.13 13:22:29 | 2146,689,024 | -HS- | M] () -- C:\hiberfil.sys [2013.05.12 21:19:14 | 003,453,210 | ---- | M] () -- C:\Users\yannick\Desktop\Nelly - Hey Porsche.mp3 [2013.05.12 08:56:20 | 003,556,310 | ---- | M] () -- C:\Users\yannick\Desktop\Capital Cities -- Safe And Sound (new video).mp3 [2013.05.12 08:54:46 | 003,556,989 | ---- | M] () -- C:\Users\yannick\Desktop\Glasperlenspiel - nie vergessen lyrics.mp3 [2013.05.08 12:12:37 | 000,153,808 | ---- | M] () -- C:\Users\yannick\Desktop\ringtone_Bio_Klingelton.mp3 [2013.05.08 11:59:12 | 000,616,908 | ---- | M] () -- C:\Users\yannick\Desktop\ton-70.mp3 [2013.05.06 19:10:44 | 000,038,212 | ---- | M] () -- C:\Users\yannick\Desktop\377791_188522607902822_1134674371_n.jpg [2013.05.01 21:02:26 | 000,001,101 | ---- | M] () -- C:\Users\yannick\Desktop\Free YouTube Download.lnk [2013.05.01 14:37:56 | 000,017,200 | ---- | M] () -- C:\Users\yannick\Desktop\41HEB1Li4yL.jpg [2013.04.30 21:08:40 | 189,053,684 | ---- | M] () -- C:\Windows\MEMORY.DMP [2013.04.30 11:58:23 | 000,928,793 | ---- | M] () -- C:\Windows\System32\livdb.lmd [2013.04.29 14:25:43 | 001,352,499 | ---- | M] () -- C:\Users\yannick\Documents\pp flusi.odp [2013.04.26 11:46:39 | 000,001,089 | ---- | M] () -- C:\Users\Public\Desktop\Zubehör einkaufen - HP Officejet 6500 E710a-f.lnk [2013.04.26 11:46:38 | 000,002,121 | ---- | M] () -- C:\Users\Public\Desktop\HP Officejet 6500 E710a-f.lnk [2013.04.26 11:46:38 | 000,001,795 | ---- | M] () -- C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet 6500 E710a-f.lnk [2013.04.26 11:46:38 | 000,001,084 | ---- | M] () -- C:\Users\Public\Desktop\HP Officejet 6500 E710a-f Scan.lnk [2013.04.24 19:12:37 | 000,000,956 | ---- | M] () -- C:\Users\Public\Desktop\Leitstelle Albstadt 2.lnk [2013.04.20 19:24:27 | 029,528,267 | ---- | M] (Leonard Bienbeck) -- C:\Users\yannick\Desktop\Funkspiel-MS-Client-1.4.1(1).exe [2013.04.20 13:31:52 | 003,404,591 | ---- | M] () -- C:\Users\yannick\Desktop\James Arthur - Impossible - Official Single.mp3 [2013.04.17 15:27:34 | 003,653,695 | ---- | M] () -- C:\Users\yannick\Desktop\Gentleman - You Remember (Official Video 2013).mp3 [2013.04.17 11:50:37 | 000,665,356 | ---- | M] () -- C:\Users\yannick\Desktop\airberlin_271776.zip [2013.04.14 19:47:04 | 000,803,504 | ---- | M] () -- C:\Users\yannick\Desktop\germany516aeb97c957f.sct ========== Files Created - No Company Name ========== [2013.05.13 13:55:23 | 000,000,000 | ---- | C] () -- C:\Users\yannick\defogger_reenable [2013.05.13 13:54:57 | 000,050,477 | ---- | C] () -- C:\Users\yannick\Desktop\Defogger.exe [2013.05.12 21:16:51 | 003,453,210 | ---- | C] () -- C:\Users\yannick\Desktop\Nelly - Hey Porsche.mp3 [2013.05.12 08:55:03 | 003,556,310 | ---- | C] () -- C:\Users\yannick\Desktop\Capital Cities -- Safe And Sound (new video).mp3 [2013.05.12 08:52:25 | 003,556,989 | ---- | C] () -- C:\Users\yannick\Desktop\Glasperlenspiel - nie vergessen lyrics.mp3 [2013.05.08 12:12:32 | 000,153,808 | ---- | C] () -- C:\Users\yannick\Desktop\ringtone_Bio_Klingelton.mp3 [2013.05.08 11:58:58 | 000,616,908 | ---- | C] () -- C:\Users\yannick\Desktop\ton-70.mp3 [2013.05.06 19:10:43 | 000,038,212 | ---- | C] () -- C:\Users\yannick\Desktop\377791_188522607902822_1134674371_n.jpg [2013.05.01 21:02:26 | 000,001,101 | ---- | C] () -- C:\Users\yannick\Desktop\Free YouTube Download.lnk [2013.05.01 14:37:55 | 000,017,200 | ---- | C] () -- C:\Users\yannick\Desktop\41HEB1Li4yL.jpg [2013.04.30 21:08:25 | 189,053,684 | ---- | C] () -- C:\Windows\MEMORY.DMP [2013.04.29 14:25:40 | 001,352,499 | ---- | C] () -- C:\Users\yannick\Documents\pp flusi.odp [2013.04.26 11:46:38 | 000,002,121 | ---- | C] () -- C:\Users\Public\Desktop\HP Officejet 6500 E710a-f.lnk [2013.04.26 11:46:38 | 000,001,795 | ---- | C] () -- C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet 6500 E710a-f.lnk [2013.04.26 11:46:38 | 000,001,089 | ---- | C] () -- C:\Users\Public\Desktop\Zubehör einkaufen - HP Officejet 6500 E710a-f.lnk [2013.04.26 11:46:38 | 000,001,084 | ---- | C] () -- C:\Users\Public\Desktop\HP Officejet 6500 E710a-f Scan.lnk [2013.04.24 19:12:37 | 000,000,956 | ---- | C] () -- C:\Users\Public\Desktop\Leitstelle Albstadt 2.lnk [2013.04.20 13:30:18 | 003,404,591 | ---- | C] () -- C:\Users\yannick\Desktop\James Arthur - Impossible - Official Single.mp3 [2013.04.17 15:27:24 | 003,653,695 | ---- | C] () -- C:\Users\yannick\Desktop\Gentleman - You Remember (Official Video 2013).mp3 [2013.04.17 11:50:21 | 000,665,356 | ---- | C] () -- C:\Users\yannick\Desktop\airberlin_271776.zip [2013.04.14 19:47:19 | 000,803,504 | ---- | C] () -- C:\Users\yannick\Desktop\germany516aeb97c957f.sct [2013.04.14 17:02:46 | 000,010,246 | ---- | C] () -- C:\Users\yannick\Desktop\Concorde.air [2013.04.03 17:15:32 | 000,136,841 | ---- | C] () -- C:\Users\yannick\ESt2012_Panse_Nicole.elfo [2013.03.16 21:53:25 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini [2013.03.05 09:53:02 | 000,100,043 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2013.03.02 20:54:55 | 000,000,080 | ---- | C] () -- C:\Users\yannick\AppData\Local\X-Plane Installer.prf [2013.02.28 15:16:21 | 000,014,051 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat [2013.02.23 18:11:51 | 000,006,656 | ---- | C] () -- C:\Users\yannick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.02.22 09:46:47 | 000,000,680 | ---- | C] () -- C:\Users\yannick\AppData\Local\d3d9caps.dat [2012.08.30 11:40:14 | 000,429,416 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe [2012.01.17 12:24:10 | 000,055,296 | ---- | C] () -- C:\Windows\System32\ASGT.exe [2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat ========== ZeroAccess Check ========== [2006.11.02 14:51:16 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2008.01.19 00:36:12 | 011,580,416 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2008.01.19 00:34:22 | 000,614,400 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2008.01.19 00:36:50 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2013.05.08 10:11:19 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\Audacity [2013.03.30 11:19:42 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\com.bajasim.atc4real.kfll.desktop [2013.03.04 19:40:40 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\CPUControl [2013.05.01 21:02:35 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\DVDVideoSoft [2013.04.03 15:37:54 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\elsterformular [2013.03.03 19:52:57 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\flightgear.org [2013.03.03 19:49:10 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\fltk.org [2013.04.14 12:35:13 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\FSXToolsInfoTool_v2 [2013.03.31 14:48:12 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\Garmin [2013.04.10 10:19:51 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\IVAO [2013.04.08 14:45:55 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\Lockheed Martin [2013.04.06 17:31:55 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\OpenOffice.org [2013.03.12 10:44:03 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\Plogue [2013.03.12 11:06:39 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\PowerISO [2013.02.22 12:37:08 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\ProtectDISC [2013.04.05 13:53:36 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\TeamViewer [2013.02.28 15:54:18 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\TP-LINK [2013.03.28 17:25:37 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\Tropico 3 [2013.05.12 20:35:28 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\TS3Client [2013.03.18 18:29:34 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\uTorrent [2013.04.15 13:45:28 | 000,000,000 | ---D | M] -- C:\Users\yannick\AppData\Roaming\Virtuali [2013.03.05 14:16:16 | 000,000,000 | -HSD | M] -- C:\Users\yannick\AppData\Roaming\wyUpdate AU ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:74603393 < End of report > Extras.Txt: OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 13.05.2013 13:57:53 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\yannick\Desktop
Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,40 Gb Available Physical Memory | 70,29% Memory free
4,23 Gb Paging File | 3,59 Gb Available in Paging File | 84,70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 117,42 Gb Total Space | 15,16 Gb Free Space | 12,91% Space Free | Partition Type: NTFS
Drive D: | 180,66 Gb Total Space | 159,54 Gb Free Space | 88,31% Space Free | Partition Type: NTFS
Drive E: | 7,03 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Computer Name: YANNICK-PC | User Name: yannick | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{064EC7CC-98C4-49C8-B452-35713BE6905F}" = rport=137 | protocol=17 | dir=out | app=system |
"{16058E4F-C095-4D0D-87AC-B06CE44CC66D}" = lport=137 | protocol=17 | dir=in | app=system |
"{2C5AD172-D9A6-447E-868D-B8D8AE3F7467}" = lport=138 | protocol=17 | dir=in | app=system |
"{48B64167-9D51-4E5B-9046-AEB87D5C3089}" = rport=445 | protocol=6 | dir=out | app=system |
"{95234B62-D433-4484-B62D-4A0BA0562804}" = rport=139 | protocol=6 | dir=out | app=system |
"{B8BC75BD-1CA3-4FC5-A35D-AB4C86E97571}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{D28C36DB-AB65-4945-99B9-339EDD829364}" = rport=138 | protocol=17 | dir=out | app=system |
"{D2BC2A36-D55F-4F88-AC4B-895834E8CCC1}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{DCEC451C-CFB7-43B2-BA82-3A3774715020}" = lport=445 | protocol=6 | dir=in | app=system |
"{E9021E1F-CFED-4429-B6A3-37F98E820E0C}" = lport=139 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{090BC266-E169-4EC4-84EB-F3C1B8D681F6}" = protocol=6 | dir=in | app=c:\users\yannick\appdata\roaming\utorrent\utorrent.exe |
"{1884FA5F-F83F-46E6-AF83-490AE24F0E1E}" = protocol=6 | dir=in | app=c:\program files\war thunder\launcher.exe |
"{24BCB484-1CEA-4282-96CD-3E8F2AD3CB7D}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version8\teamviewer.exe |
"{2725B29A-2C97-452C-981B-6B022C473011}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet 6500 e710a-f\bin\devicesetup.exe |
"{3C017BD2-73BD-4A4E-8074-06385D30A267}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version8\teamviewer_service.exe |
"{3ECB5D53-710E-481B-8089-8604793AC246}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{4451B7C5-9515-4B40-9F51-6FBA145CD900}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{57AB8BFC-AA5B-4969-99BE-CD35C8B1DAD4}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version8\teamviewer.exe |
"{5B0F80DB-DB58-4F17-99DA-2A7C502D30C0}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet 6500 e710a-f\bin\hpnetworkcommunicator.exe |
"{606621F1-938C-41D1-97D2-47BD315D8F03}" = protocol=17 | dir=in | app=c:\users\yannick\appdata\roaming\utorrent\utorrent.exe |
"{629E7985-A1A5-4DAA-BA67-84BF70A07307}" = protocol=17 | dir=in | app=d:\war thunder\launcher.exe |
"{64A55F1A-F7AC-488A-94BF-239D6644B2F3}" = protocol=6 | dir=in | app=d:\war thunder\launcher.exe |
"{76C4EF0E-EBD0-40FC-AE4A-44947F4C8AD4}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{81885F92-3A46-4BCC-B16A-2CE13CCBFC83}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet 6500 e710a-f\bin\devicesetup.exe |
"{86FEAE85-D2B2-4A39-BF87-158EE5D2F023}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{89195F8C-3626-4569-84F4-F08455BC985B}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet 6500 e710a-f\bin\hpnetworkcommunicator.exe |
"{9C4E69E0-7ABF-43F0-9DFA-F596673DCC27}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{A22E0013-78A8-4882-AD92-24B4EECDD36D}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version8\teamviewer_service.exe |
"{BA8B22EA-F39B-4A9F-9BF6-D6C069E11B16}" = protocol=6 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\launchgtaiv.exe |
"{CBAF0F60-5672-47DB-8257-D93D102F819A}" = protocol=17 | dir=in | app=c:\program files\war thunder\launcher.exe |
"{D54EC894-E2EE-485A-BB78-A8A78445140F}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{DB7002E0-7468-4494-9EAF-209302E05E69}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{E18258BC-15AB-454E-B6EE-224E9C3BB135}" = protocol=17 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\launchgtaiv.exe |
"TCP Query User{692A9B76-EA6F-435D-934F-7EC5A121FD41}C:\program files\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=6 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\gtaiv.exe |
"TCP Query User{8DB61659-F230-4ECC-8357-3D9BAE045982}C:\users\yannick\downloads\urbanterror\iourbanterror.exe" = protocol=6 | dir=in | app=c:\users\yannick\downloads\urbanterror\iourbanterror.exe |
"TCP Query User{8DC131FA-1EE6-452B-85AC-E4437D3AA54F}D:\war thunder\aces.exe" = protocol=6 | dir=in | app=d:\war thunder\aces.exe |
"TCP Query User{93FF2B76-2E03-4B9C-9CFE-5EFBD687A49B}C:\program files\advanced control center\acc.exe" = protocol=6 | dir=in | app=c:\program files\advanced control center\acc.exe |
"TCP Query User{CC1FEDF1-E897-464B-8AA9-738BE053F024}D:\flight simulator x\fsx.exe" = protocol=6 | dir=in | app=d:\flight simulator x\fsx.exe |
"TCP Query User{EE81BCF1-B480-42EB-B0E4-F35DAC256C1C}C:\program files\csernakgergely\euroscope\euroscope.exe" = protocol=6 | dir=in | app=c:\program files\csernakgergely\euroscope\euroscope.exe |
"TCP Query User{EEFB6FC7-4D8B-46E5-9798-874FB750330F}C:\program files\hp\common\hpdevicedetection3.exe" = protocol=6 | dir=in | app=c:\program files\hp\common\hpdevicedetection3.exe |
"UDP Query User{2183B6F7-AF3B-4CE2-B3EA-64AC44256760}D:\war thunder\aces.exe" = protocol=17 | dir=in | app=d:\war thunder\aces.exe |
"UDP Query User{3424E3B3-CFDA-4C34-9052-1895ED5ED31B}C:\users\yannick\downloads\urbanterror\iourbanterror.exe" = protocol=17 | dir=in | app=c:\users\yannick\downloads\urbanterror\iourbanterror.exe |
"UDP Query User{AC7EE3B4-B00A-4EFC-AAD7-2946F0424178}C:\program files\hp\common\hpdevicedetection3.exe" = protocol=17 | dir=in | app=c:\program files\hp\common\hpdevicedetection3.exe |
"UDP Query User{B10BC56D-8EE7-4738-9996-BCB2827ED397}C:\program files\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=17 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\gtaiv.exe |
"UDP Query User{BFDB10A8-7364-4ED2-82AC-FAC5E37ACAE9}C:\program files\advanced control center\acc.exe" = protocol=17 | dir=in | app=c:\program files\advanced control center\acc.exe |
"UDP Query User{D2744E1E-1C64-4058-A475-5D506B4A41DF}C:\program files\csernakgergely\euroscope\euroscope.exe" = protocol=17 | dir=in | app=c:\program files\csernakgergely\euroscope\euroscope.exe |
"UDP Query User{D7A12F82-52FC-45FC-89C1-9F537CF1833F}D:\flight simulator x\fsx.exe" = protocol=17 | dir=in | app=d:\flight simulator x\fsx.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{037CD593-D760-4A00-B030-7BBAFA1123FE}" = HP Officejet 6500 E710a-f Hilfe
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0B0ADD81-270D-44C7-8AA9-882A42F2EC22}_is1" = ABC-Schutz-Simulator Version 1.0
"{15DF4EE8-DE41-453A-800A-5814A5CDF003}" = Garmin VoiceStudio v2.40
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{319D91C6-3D44-436C-9F79-36C0D22372DC}" = TP-LINK Wireless Configuration Utility
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B60A7A4-49F6-4D2A-8AE7-BCBAFA6224CE}" = Simulationsprogramm Integrierte Leitstelle V4
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{532F6E8A-AF97-41C3-915F-39F718EC07D1}" = ASUS GPU Tweak
"{5454083B-1308-4485-BF17-1110000D8301}" = Grand Theft Auto IV
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{5AF4B3C4-C393-48D7-AC7E-8E7615579548}" = Adobe AIR
"{67C82957-EDA8-43C2-8BBC-5BF17DC8201B}" = London Control Demo
"{67F30877-CBBB-425C-9511-93181EFB8F08}_is1" = Airport Simulator 2013 Demo Version 1.0
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser und SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75D04ADF-C1E8-4BF6-901B-D1DE3414DE60}_is1" = Leitstelle Albstadt 2 Version 2.1
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{879F7C80-BCA3-4A11-BDB1-658252ECD7E0}" = HP Product Detection
"{8D8E696E-916E-49CE-B2EE-C2346A6FE949}" = Harry Potter und die Heiligtümer des Todes(TM) - Teil 2 Demo
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031" = Microsoft .NET Framework 4.5 DEU Language Pack
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{93878DDD-E621-4AFF-8203-2658451A3636}" = EuroScope 3.1d
"{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D7EF9D6-212E-3C87-AB96-ED9F2A6C3218}" = Microsoft .NET Framework 4.5 DEU Language Pack
"{9F612429-4A00-3D44-88CF-146DA2EE1F92}" = Microsoft .NET Framework 4.5
"{9FB088BB-47DC-452C-BE8E-036E2243B4C8}" = City Bus Simulator 2010 - Gold Edition
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{ABA5E381-EC46-425C-86C5-5CD15BBFB4BF}" = Garmin USB Drivers
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 306.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.18.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B5778FF8-CCE7-4C57-A8CE-C87D3E42D748}" = Citybus Simulator Munich Demo
"{B7BE84B4-684D-6A37-FC7E-C559DD277BEA}" = ATC4Real Fort Lauderdale
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E796AA87-FE52-49A8-AD93-0236A9F87632}" = TP-LINK TL-WN727N Driver
"{E7CC4B85-DC2F-463F-8FEB-E7398E25C19A}" = Microsoft Flight Simulator X Service Pack 2
"{EB74294F-B8FC-4387-BEBF-275E36C6076C}" = FS Recorder 2.1 for FSX
"{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1" = War Thunder Launcher 1.0.1.199
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F2CA85EF-D86E-4F4C-99E7-8ED7AA18E7B8}" = SWAT 4 Single Player Demo
"{FBBA35E1-9449-4902-8A0F-89252C0C1407}" = HP Officejet 6500 E710a-f - Grundlegende Software für das Gerät
"{FFC78FC9-2FE6-4648-BFEB-446C61C2D61E}" = FSacars
"3D-Fahrschule Demo" = 3D-Fahrschule Demo
"98157A226B40B173301B0F53C8E98C47805D5152" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0)
"AbiWord2" = AbiWord 2.4.6 (remove only)
"Acoustica MP3 To Wave Converter PLUS" = Acoustica MP3 To Wave Converter PLUS
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Control Center_is1" = Advanced Control Center 2.0
"AIDA64 Extreme Edition_is1" = AIDA64 Extreme Edition v1.85
"ArtMoney SE_is1" = ArtMoney SE v7.40.5
"Audacity_is1" = Audacity 2.0.3
"Boeing 767-300 Condor NEW" = Boeing 767-300 Condor NEW
"BS2012StudioFahrplaneditor_is1" = BS2012 Studio Fahrplaneditor
"Bus- & Cable Car-Simulator_is1" = Bus- & Cable Car-Simulator
"Bus-Simulator 2009_is1" = Bus-Simulator 2009
"Bus-Simulator 2012_is1" = Bus-Simulator 2012
"com.bajasim.atc4real.kfll.desktop" = ATC4Real Fort Lauderdale
"CPU-Control_is1" = CPU-Control
"Die Polizei" = Die Polizei
"ElsterFormular" = ElsterFormular
"Free YouTube Download_is1" = Free YouTube Download version 3.2.2.426
"GoldWave v5.68" = GoldWave v5.68
"GTA IV - 100% Savegame File (Vista) 1.0" = GTA IV - 100% Savegame File (Vista) 1.0
"InstallShield_{532F6E8A-AF97-41C3-915F-39F718EC07D1}" = ASUS GPU Tweak
"InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"InstallShield_{F2CA85EF-D86E-4F4C-99E7-8ED7AA18E7B8}" = SWAT 4 Single Player Demo
"IvAc_is1" = IvAc v1.2.4 (b225)
"IvAp-v2_is1" = IvAp v2.0.2 (build 2773)
"Loksim3D_is1" = Loksim3D
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"Passenger Simulation" = Passenger Simulation 1.0
"Police" = Police
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Real Atc Mission AZ269" = Real Atc Mission AZ269
"Real Atc Mission AZ296" = Real Atc Mission AZ296
"SP1_9527A496-5DF9-412A-ADC7-168BA5379CA6" = Microsoft Flight Simulator X Service Pack 1
"SpaceShuttleMission2007 DEMO_is1" = SpaceShuttleMission2007 DEMO v1.31
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 8" = TeamViewer 8
"Tropico3" = Tropico 3 1.00
"uTorrent" = µTorrent
"vasFMC_is1" = vasFMC 2.1
"vBus" = vBus
"VirtualBus_is1" = VirtualBus A6C RC3.1
"VLC media player" = VLC media player 2.0.5
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"05738b33edbcf8ca" = FFMVATracker
"American Samoa Rescue" = American Samoa Rescue
"vBus" = vBus
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 04.05.2013 05:05:56 | Computer Name = yannick-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe,
fehlerhaftes Modul GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe, Ausnahmecode
0xc0000005, Fehleroffset 0x005c6687, Prozess-ID 0x568, Anwendungsstartzeit 01ce48a4ae17ce59.
Error - 06.05.2013 07:36:30 | Computer Name = yannick-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe,
fehlerhaftes Modul ELS.asi, Version 0.0.0.0, Zeitstempel 0x4c8c48b9, Ausnahmecode
0xc0000005, Fehleroffset 0x00009f54, Prozess-ID 0x708, Anwendungsstartzeit 01ce4a47c3f9abbc.
Error - 07.05.2013 11:21:14 | Computer Name = yannick-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe,
fehlerhaftes Modul GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe, Ausnahmecode
0xc0000005, Fehleroffset 0x001a9346, Prozess-ID 0x824, Anwendungsstartzeit 01ce4b31115d9f8a.
Error - 07.05.2013 11:23:24 | Computer Name = yannick-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe,
fehlerhaftes Modul GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe, Ausnahmecode
0xc0000005, Fehleroffset 0x001a9346, Prozess-ID 0x1350, Anwendungsstartzeit 01ce4b3697d22847.
Error - 08.05.2013 04:59:23 | Computer Name = yannick-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe,
fehlerhaftes Modul GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe, Ausnahmecode
0xc0000005, Fehleroffset 0x005c6687, Prozess-ID 0xfcc, Anwendungsstartzeit 01ce4bc74655c8d8.
Error - 08.05.2013 06:52:23 | Computer Name = yannick-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmplayer.exe, Version 11.0.6001.7008, Zeitstempel
0x4aa91960, fehlerhaftes Modul wmp.dll, Version 11.0.6001.7008, Zeitstempel 0x4aa938dc,
Ausnahmecode 0xc0000005, Fehleroffset 0x003a6e9c, Prozess-ID 0x698, Anwendungsstartzeit
01ce4bd96a94412f.
Error - 09.05.2013 05:23:08 | Computer Name = yannick-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe,
fehlerhaftes Modul ELS.asi, Version 0.0.0.0, Zeitstempel 0x4c8c48b9, Ausnahmecode
0xc0000005, Fehleroffset 0x00009f54, Prozess-ID 0x96c, Anwendungsstartzeit 01ce4c923db9ea83.
Error - 10.05.2013 10:18:59 | Computer Name = yannick-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe,
fehlerhaftes Modul GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe, Ausnahmecode
0xc0000005, Fehleroffset 0x001a9346, Prozess-ID 0x98c, Anwendungsstartzeit 01ce4d875496c316.
Error - 10.05.2013 10:19:36 | Computer Name = yannick-PC | Source = Application Error | ID = 1000
Error - 10.05.2013 10:19:37 | Computer Name = yannick-PC | Source = .NET Runtime
| ID = 1026
Description =
Error - 11.05.2013 04:25:29 | Computer Name = yannick-PC | Source = Application
Error | ID = 1000
Description = Fehlerhafte Anwendung GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe, fehlerhaftes Modul ELS.asi, Version 0.0.0.0, Zeitstempel 0x4c8c48b9, Ausnahmecode 0xc0000005, Fehleroffset 0x00009f54,
Prozess-ID 0xd78, Anwendungsstartzeit 01ce4e1e3ebbd224.
Error - 11.05.2013 12:33:32 | Computer Name = yannick-PC | Source = Application
Error | ID = 1000
Description = Fehlerhafte Anwendung GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe, fehlerhaftes Modul GTAIV.exe, Version 1.0.7.0, Zeitstempel 0x4bd9efbe, Ausnahmecode 0xc0000005, Fehleroffset 0x001a9346,
Prozess-ID 0xfb4, Anwendungsstartzeit 01ce4e6124393b8b.
Error encountered while reading event logs.
< End of report >
Lg Yannick Geändert von yannin (13.05.2013 um 13:29 Uhr) |
|
13.05.2013, 15:13
| #2 |
| /// Helfer-Team  | Phishing Mail von WoW Link angeklickt! alles unauffaellig  Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers dann: Downloade Dir bitte  SecurityCheck und:
__________________ |
|
14.05.2013, 08:04
| #3 |
| | Phishing Mail von WoW Link angeklickt! Hey,
__________________den mbar habe ich ausgeführt, jedoch geht er immer wieder selbständig nach dem Scan aus und findet nichts! Hier der Log: Malwarebytes Anti-Rootkit BETA 1.05.0.1001 www.malwarebytes.org Database version: v2013.05.13.06 Windows Vista Service Pack 1 x86 NTFS Internet Explorer 7.0.6001.18000 yannick :: YANNICK-PC [administrator] 13.05.2013 19:16:19 mbar-log-2013-05-13 (19-16-19).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 28817 Time elapsed: 7 minute(s), 41 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Security Check (checkup): Results of screen317's Security Check version 0.99.63 Windows Vista Service Pack 1 x86 (UAC is enabled) Out of date service pack!! Internet Explorer 7 Out of date! ``````````````Antivirus/Firewall Check:`````````````` WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Java 7 Update 17 Java version out of Date! Adobe Flash Player 11.6.602.180 Adobe Reader 10.1.4 Adobe Reader out of Date! Mozilla Firefox (20.0.1) ````````Process Check: objlist.exe by Laurent```````` Windows Defender MSASCui.exe Windows Defender MSASCui.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` LG Yannick |
|
14.05.2013, 11:13
| #4 |
| /// Helfer-Team | Phishing Mail von WoW Link angeklickt! Alles Windows Updates einspielen, inkl. Service Pack und Internet Explorer! http://windowsupdate.microsoft.com Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck Java deaktivieren Aufgrund derezeitigen Sicherheitsluecke: http://www.trojaner-board.de/122961-...ktivieren.html Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck |
|
07.07.2013, 11:05
| #5 |
| /// Helfer-Team | Phishing Mail von WoW Link angeklickt! Fehlende Rückmeldung Gibt es Probleme beim Abarbeiten obiger Anleitung? Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen. Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema. http://www.trojaner-board.de/69886-a...-beachten.html Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist. |
|
| Themen zu Phishing Mail von WoW Link angeklickt! |
| account, angeblich, bat, battle.net, brauch, browser, daten, deutsch, ebanking, grand theft auto, heute, hintergrund, install.exe, klicke, klicken, link, link angeklickt, links, logfiles, mail, nicht mehr, niemals, officejet, onlinebanking, panik, phishing, phishing mail, plug-in, rechtliche, seite, verkaufen, viren, wow account |
Linear-Darstellung
