| |
| |||||||
Log-Analyse und Auswertung: Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
29.06.2013, 07:56
| #1 |
 |  Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) Hallo, ich habe von einem Bekannten den Rechner bekommen, anscheinend kam die Meldung vom Polizei-Trojaner (Österreich). AVG Log zeigt o.g. Eintrag: Infektion-Trojaner:Generic_s.BEX, der nicht betroffene Benutzeraccount lässt sich normal starten, am betroffenen hängt der Explorer, im abgesicherten Modus erfolgt ein Restart. Ich bitte um Eure Hilfe. Hier die OTL Logs: Code:
ATTFilter OTL logfile created on: 29.06.2013 08:25:40 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Familie Achleitner\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16614) Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 2,75 Gb Total Physical Memory | 1,14 Gb Available Physical Memory | 41,41% Memory free 5,49 Gb Paging File | 2,98 Gb Available in Paging File | 54,30% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,22 Gb Total Space | 398,75 Gb Free Space | 85,71% Space Free | Partition Type: NTFS Drive E: | 14,92 Gb Total Space | 0,88 Gb Free Space | 5,91% Space Free | Partition Type: NTFS Computer Name: CHRISTIAN-PC | User Name: Christian | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Familie Achleitner\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Users\CHRIST~1\AppData\Local\Temp\octB2C9.tmp.exe (SweetLabs,Inc.) PRC - C:\Users\Christian\AppData\Local\Smartbar\Application\SnapDo.exe (Smartbar) PRC - C:\Users\Christian\AppData\Local\Smartbar\Application\ProductsRemovalTool.exe () PRC - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Sony) PRC - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) PRC - C:\Users\Familie Achleitner\Desktop\1-Defogger.exe () PRC - C:\Users\Christian\AppData\Local\Pokki\Engine\pokki.exe (Pokki) PRC - E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe (Google Inc.) PRC - C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.) PRC - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe () PRC - C:\Program Files (x86)\KingTranslate\KingTranslate.exe (KoyoteSoft Inc.) PRC - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) PRC - C:\Program Files (x86)\Uniblue\DriverScanner\driverscanner.exe (Uniblue Systems Ltd) PRC - C:\Program Files (x86)\Uniblue\DriverScanner\dsnotifier.exe (Uniblue Systems Ltd) PRC - C:\Program Files (x86)\Uniblue\DriverScanner\dsmonitor.exe (Uniblue Systems Ltd) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - E:\PortableApps\GoogleChromePortable\GoogleChromePortable.exe (PortableApps.com) PRC - E:\PortableApps\PortableApps.com\PortableAppsPlatform.exe (PortableApps.com) PRC - E:\PortableApps\PortableApps.com\PortableAppsUpdater.exe (PortableApps.com) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Games\Game Alarm\gamealarm.exe (Europe Support Ltd. N.V.) PRC - C:\Games\Game Alarm\Updater.exe () PRC - C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files (x86)\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG) ========== Modules (No Company Name) ========== MOD - C:\Users\FAMILI~1\AppData\Local\Temp\nsuD72E.tmp\EmbeddedLists.dll () MOD - C:\Users\FAMILI~1\AppData\Local\Temp\nsfFC4B.tmp\registry.dll () MOD - C:\Users\FAMILI~1\AppData\Local\Temp\nsuD72E.tmp\System.dll () MOD - C:\Users\CHRIST~1\AppData\Local\Temp\nsb94E1.tmp\System.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Resources.Utilities.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Resources.SideBySide.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductsRemovalLibary.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Resources.ProcessDownMonitor.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Resources.NetSeer.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Resources.AutomaticUpdates.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Personalization.BusinessLogic.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.EventManager.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.GUI.Multimedia.Loader.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\MACTrackBarLib.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\ProductsRemovalTool.exe () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\Smartbar.GUI.Multimedia.dll () MOD - C:\Users\Christian\AppData\Local\Smartbar\Application\AxInterop.WMPLib.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll () MOD - C:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll () MOD - C:\Users\Familie Achleitner\Desktop\1-Defogger.exe () MOD - C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll () MOD - C:\Users\Christian\AppData\Local\Pokki\Engine\chrome.dll () MOD - E:\PortableApps\GoogleChromePortable\App\Chrome-bin\25.0.1364.172\ppgooglenaclpluginchrome.dll () MOD - E:\PortableApps\GoogleChromePortable\App\Chrome-bin\25.0.1364.172\pdf.dll () MOD - E:\PortableApps\GoogleChromePortable\App\Chrome-bin\25.0.1364.172\libglesv2.dll () MOD - E:\PortableApps\GoogleChromePortable\App\Chrome-bin\25.0.1364.172\libegl.dll () MOD - E:\PortableApps\GoogleChromePortable\App\Chrome-bin\25.0.1364.172\ffmpegsumo.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\1ea01658676f73cf48ebde8e904a0464\System.Configuration.Install.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\64cf6c356be66bb17c4667d6d8aa467b\System.Web.Services.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll () MOD - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe () MOD - C:\Program Files (x86)\KingTranslate\SmartThreadPool.dll () MOD - C:\Program Files (x86)\Uniblue\DriverScanner\locale\de\de.dll () MOD - C:\Program Files (x86)\Uniblue\DriverScanner\cwebpage.dll () MOD - C:\Program Files (x86)\Uniblue\DriverScanner\InstallerExtensions.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\302207b4fa3083899fd8ab4db98cecc5\System.Management.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\dd20416f723ee13ffb4173ec1afc4ec4\System.Data.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll () MOD - C:\Users\Christian\AppData\Local\Pokki\Engine\avformat-53.dll () MOD - C:\Users\Christian\AppData\Local\Pokki\Engine\avcodec-53.dll () MOD - C:\Users\Christian\AppData\Local\Pokki\Engine\avutil-51.dll () MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll () MOD - C:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll () MOD - C:\Games\Game Alarm\rt\jetrt\baseline720.dll () MOD - C:\Games\Game Alarm\rt\bin\zip.dll () MOD - C:\Games\Game Alarm\rt\bin\java.dll () MOD - C:\Games\Game Alarm\rt\bin\jetvm\jvm.dll () MOD - C:\Games\Game Alarm\Updater.exe () MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll () MOD - C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll () ========== Services (SafeList) ========== SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.) SRV - (McComponentHostService) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe (McAfee, Inc.) SRV - (Sony PC Companion) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe (Avanquest Software) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe (TuneUp Software) SRV - (avg9emc) -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.) SRV - (avg9wd) -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (AvgLdx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (AvgMfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (AvgTdiA) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia) DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia) DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia) DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia) DRV:64bit: - (nmwcdnsux64) -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys (Nokia) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation) DRV:64bit: - (s1039bus) -- C:\Windows\SysNative\drivers\s1039bus.sys (MCCI Corporation) DRV:64bit: - (s1039mdm) -- C:\Windows\SysNative\drivers\s1039mdm.sys (MCCI Corporation) DRV:64bit: - (s1039unic) -- C:\Windows\SysNative\drivers\s1039unic.sys (MCCI Corporation) DRV:64bit: - (s1039mgmt) -- C:\Windows\SysNative\drivers\s1039mgmt.sys (MCCI Corporation) DRV:64bit: - (s1039obex) -- C:\Windows\SysNative\drivers\s1039obex.sys (MCCI Corporation) DRV:64bit: - (s1039nd5) -- C:\Windows\SysNative\drivers\s1039nd5.sys (MCCI Corporation) DRV:64bit: - (s1039mdfl) -- C:\Windows\SysNative\drivers\s1039mdfl.sys (MCCI Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation ) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys (TuneUp Software) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=gppc&s={searchTerms}&f=4 IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD1.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=ds&q={searchTerms}&installDate=12/04/2013 IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=ds&q={searchTerms}&installDate=12/04/2013 IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=hp&installDate=12/04/2013 IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=ds&q={searchTerms}&installDate=12/04/2013 IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=ds&q={searchTerms}&installDate=12/04/2013 IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=ds&q={searchTerms}&installDate=12/04/2013 IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?babsrc=HP_Prot IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 35 06 A1 57 FB 83 CB 01 [binary data] IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\..\SearchScopes\{1BBF91A2-56B1-4C4F-B7BF-1FEE9A9935B0}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=crm&q={searchTerms}&locale=de_US&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^AT&apn_uid=218b9615-e40b-485a-8532-773bdf2e4e5a&apn_sauid=4F226C10-DAF0-4E84-924C-7E72D48D6222 IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADRA_deAT463 IE - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@logitech.com/HarmonyRemote,version=1.0.0: C:\Program Files (x86)\Logitech\Harmony Remote Driver\NprtHarmonyPlugin.dll (Logitech Inc.) FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.10.27 14:34:08 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\wcapturex@deskperience.com: C:\Program Files (x86)\KingTranslate\WCaptureMoz [2013.04.12 20:55:08 | 000,000,000 | ---D | M] [2012.03.02 02:29:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.03.02 02:29:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2011.03.18 19:56:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.01.16 01:23:28 | 000,002,310 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml [2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.05.31 19:02:17 | 000,002,047 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml [2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.) O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2:64bit: - BHO: (DVDVideoSoft WebPageAdjuster Class) - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.) O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.) O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.9\bh\facemoods.dll (facemoods.com BHO) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD1.dll (Conduit Ltd.) O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (DVDVideoSoft WebPageAdjuster Class) - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.) O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.9\facemoodsTlbr.dll (facemoods.com) O3:64bit: - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD1.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3:64bit: - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD1.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [facemoods] C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.9\facemoodssrv.exe (facemoods.com) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000..\Run: [Browser Infrastructure Helper] C:\Users\Christian\AppData\Local\Smartbar\Application\SnapDo.exe (Smartbar) O4 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000..\Run: [KingTranslate] C:\Program Files (x86)\KingTranslate\KingTranslate.exe (KoyoteSoft Inc.) O4 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000..\Run: [Pokki] "%LOCALAPPDATA%\Pokki\Engine\pokki.exe" File not found O4 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found O4 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000..\Run: [Sony PC Companion] C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Sony) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Familie Achleitner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Game Alarm.lnk = C:\Games\Game Alarm\gamealarm.exe (Europe Support Ltd. N.V.) O4 - Startup: C:\Users\Familie Achleitner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Christian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm () O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Free YouTube Download - C:\Users\Christian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9:64bit: - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.) O9:64bit: - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O9 - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000\..Trusted Domains: blank ([]about in Local intranet) O15 - HKU\S-1-5-21-2981905205-1357387969-867761577-1003\..Trusted Domains: blank ([]about in Local intranet) O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.153.32.129 213.153.32.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6BADB0B2-1EDA-46B1-9EAE-22E1C2A32CB4}: DhcpNameServer = 213.153.32.129 213.153.32.1 192.168.1.1 O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.) O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000 Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000 Winlogon: Shell - (C:\Users\Christian\AppData\Roaming\skype.dat) - C:\Users\Christian\AppData\Roaming\skype.dat () O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2013.02.25 16:48:56 | 000,000,089 | ---- | M] () - E:\Autorun.inf -- [ NTFS ] O33 - MountPoints2\{6514dba2-473d-11e1-b502-90fba66bfc0a}\Shell - "" = AutoRun O33 - MountPoints2\{6514dba2-473d-11e1-b502-90fba66bfc0a}\Shell\AutoRun\command - "" = E:\Startme.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.06.16 03:01:29 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.06.16 03:01:29 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.06.14 03:05:49 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013.06.14 03:05:49 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2013.06.14 03:05:49 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.06.14 03:05:49 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2013.06.14 03:05:49 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2013.06.14 03:05:49 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.06.14 03:05:48 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013.06.14 03:05:48 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.06.14 03:05:48 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe [2013.06.14 03:05:47 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.06.14 03:05:47 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.06.14 03:05:47 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.06.14 03:05:46 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.06.13 12:12:00 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll [2013.06.13 12:12:00 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll [2013.06.13 12:11:53 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptdlg.dll [2013.06.13 12:11:53 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cryptdlg.dll [2013.06.13 12:11:49 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll [2013.06.13 12:11:46 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certutil.exe [2013.06.13 12:11:45 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2013.06.13 12:11:45 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certutil.exe [2013.06.13 12:11:45 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2013.06.13 12:11:45 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll [2013.06.13 12:11:45 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certenc.dll [2013.06.13 12:11:28 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll [2013.06.13 12:11:28 | 001,505,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.06.29 08:27:01 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.06.29 08:25:38 | 000,013,632 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.29 08:25:38 | 000,013,632 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.29 08:22:00 | 000,001,172 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003UA.job [2013.06.29 08:18:49 | 000,000,000 | ---- | M] () -- C:\Users\Christian\defogger_reenable [2013.06.29 08:15:37 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.06.29 08:15:37 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.06.29 08:15:37 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.06.29 08:15:37 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.06.29 08:15:37 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.06.29 08:00:18 | 000,002,315 | ---- | M] () -- C:\Users\Christian\Desktop\Search.lnk [2013.06.29 07:59:05 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.06.29 07:57:35 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.06.29 07:57:31 | 000,000,348 | ---- | M] () -- C:\Windows\tasks\dsmonitor.job [2013.06.29 07:57:31 | 000,000,288 | ---- | M] () -- C:\Windows\tasks\DriverScanner.job [2013.06.29 07:47:38 | 124,871,942 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\incavi.avm [2013.06.29 07:43:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.06.29 07:43:13 | 2213,158,912 | -HS- | M] () -- C:\hiberfil.sys [2013.06.27 21:50:10 | 000,000,004 | ---- | M] () -- C:\Users\Christian\AppData\Roaming\skype.ini [2013.06.27 21:06:44 | 000,002,026 | ---- | M] () -- C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk [2013.06.27 20:22:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003Core.job [2013.06.13 12:00:18 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013.06.13 12:00:18 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013.06.08 16:06:58 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.06.08 13:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.05.30 22:12:48 | 364,272,081 | ---- | M] () -- C:\Windows\MEMORY.DMP [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.06.29 08:18:49 | 000,000,000 | ---- | C] () -- C:\Users\Christian\defogger_reenable [2013.06.29 08:00:18 | 000,002,413 | ---- | C] () -- C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk [2013.06.29 08:00:18 | 000,002,315 | ---- | C] () -- C:\Users\Christian\Desktop\Search.lnk [2013.06.27 21:06:44 | 000,002,026 | ---- | C] () -- C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk [2013.05.03 11:22:08 | 000,000,004 | ---- | C] () -- C:\Users\Christian\AppData\Roaming\skype.ini [2012.01.11 21:59:31 | 000,102,400 | ---- | C] () -- C:\Users\Christian\AppData\Roaming\skype.dat ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.01.16 01:54:38 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\.minecraft [2012.01.16 01:23:27 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Babylon [2011.07.17 20:34:11 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Clonk [2012.03.10 22:57:12 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Clonk Rage [2013.04.26 19:06:02 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\DVDVideoSoft [2012.02.03 21:19:08 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\DVDVideoSoftIEHelpers [2013.04.12 20:55:06 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\KingTranslate [2010.09.03 16:22:09 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\mquadr.at [2013.04.26 19:05:15 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\OpenCandy [2012.02.03 20:50:01 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\PacificPoker [2013.02.28 17:49:34 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TuneUp Software [2013.04.12 20:17:36 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Uniblue [2011.01.24 14:00:16 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Wildlife Park 2 [2011.01.24 14:01:44 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Wildlife Park 2 - Farm World [2012.09.13 19:58:23 | 000,000,000 | ---D | M] -- C:\Users\Familie Achleitner\AppData\Roaming\.minecraft [2011.07.17 22:02:39 | 000,000,000 | ---D | M] -- C:\Users\Familie Achleitner\AppData\Roaming\Clonk [2012.03.10 22:57:50 | 000,000,000 | ---D | M] -- C:\Users\Familie Achleitner\AppData\Roaming\Clonk Rage [2013.02.28 17:49:03 | 000,000,000 | ---D | M] -- C:\Users\Familie Achleitner\AppData\Roaming\DVDVideoSoft [2013.02.16 20:29:08 | 000,000,000 | ---D | M] -- C:\Users\Familie Achleitner\AppData\Roaming\Funmoods [2013.03.17 17:02:28 | 000,000,000 | ---D | M] -- C:\Users\Familie Achleitner\AppData\Roaming\OpenOffice.org [2011.02.06 17:58:49 | 000,000,000 | ---D | M] -- C:\Users\Familie Achleitner\AppData\Roaming\Sierra [2013.02.28 17:55:46 | 000,000,000 | ---D | M] -- C:\Users\Familie Achleitner\AppData\Roaming\TuneUp Software [2011.01.21 02:18:11 | 000,000,000 | ---D | M] -- C:\Users\Familie Achleitner\AppData\Roaming\Wildlife Park 2 - Abenteuer auf der Ranch [2011.01.21 02:17:10 | 000,000,000 | ---D | M] -- C:\Users\Familie Achleitner\AppData\Roaming\Wildlife Park 2 - Crazy Zoo [2011.01.20 18:51:14 | 000,000,000 | ---D | M] -- C:\Users\Familie Achleitner\AppData\Roaming\Wildlife Park 2 - Farm World ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 29.06.2013 08:25:40 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Familie Achleitner\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
2,75 Gb Total Physical Memory | 1,14 Gb Available Physical Memory | 41,41% Memory free
5,49 Gb Paging File | 2,98 Gb Available in Paging File | 54,30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,22 Gb Total Space | 398,75 Gb Free Space | 85,71% Space Free | Partition Type: NTFS
Drive E: | 14,92 Gb Total Space | 0,88 Gb Free Space | 5,91% Space Free | Partition Type: NTFS
Computer Name: CHRISTIAN-PC | User Name: Christian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-2981905205-1357387969-867761577-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{12FA54FB-1790-411E-A819-8840DD7DEC0A}" = rport=139 | protocol=6 | dir=out | app=system |
"{1A4B73CE-2414-41FA-8FE0-40CAA1250A0C}" = rport=138 | protocol=17 | dir=out | app=system |
"{258E201F-324B-41B7-A464-EF4237950E36}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3B7B9F02-DF72-4B78-B01D-2CF3E1A6B2E4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3DC98098-9947-4E1D-8F7D-46F1DD0D83AF}" = lport=2869 | protocol=6 | dir=in | app=system |
"{47BD0546-98BA-4292-A54D-64D26F81408C}" = rport=445 | protocol=6 | dir=out | app=system |
"{4CC62E28-5858-44C3-B12C-19F1CCAABCB5}" = lport=139 | protocol=6 | dir=in | app=system |
"{72B6CCB8-8212-4A16-81FA-7F5E0CEEC939}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{737ACBA2-F050-47F4-91F0-FA74A16C9221}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8DF72B8B-A9B3-4EF2-B626-4D0E8CD51399}" = lport=10243 | protocol=6 | dir=in | app=system |
"{912D7E1B-990E-4A1D-9467-81F40B4DE74B}" = rport=10243 | protocol=6 | dir=out | app=system |
"{9994389E-4B14-45C7-9A06-DE249B75978A}" = lport=445 | protocol=6 | dir=in | app=system |
"{A0A0B48D-254C-45CA-957E-3B45A98A39DB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A9AF3608-5896-4004-BD63-AF381D3612E7}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{AEEEC2BC-5D88-4034-AC42-055F9FE8A757}" = lport=137 | protocol=17 | dir=in | app=system |
"{B0F7FFA5-78DA-4FA5-8535-C921EA9C6759}" = rport=137 | protocol=17 | dir=out | app=system |
"{BA5D134E-AF1B-48CD-83E1-2E6FF302266F}" = lport=138 | protocol=17 | dir=in | app=system |
"{CCF247A6-9D34-41D7-B2AA-B6768BB2976A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E15208D8-54C2-4DFD-A555-0C520BDD4A41}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{EB9EF179-F46C-4E4E-BA73-FE50B543E776}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F588A2C0-7339-40C2-BE72-25F349B35F7B}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0001B651-34A4-4F71-9AD7-8EBA08C25935}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{03711A76-A81C-4450-95AF-D68812DFE1C7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{104394AF-3115-4953-86C5-28F33FF6C986}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{181917F9-95CD-433D-A9EB-DCEB8A06173A}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{2E067BEA-19EF-497C-B122-C02326B61018}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{306CA314-F02E-4CA0-A3E5-F4B5BE5D9712}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011 demo\farmingsimulator2011.exe |
"{375CA35F-F42D-46A7-BC05-8554E2FEDFA0}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{3B9A4556-E508-4708-8F2E-48CDBD935BF5}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4D7AEFD0-75CC-4F4E-8EED-CDB34178D2AC}" = dir=in | app=c:\program files (x86)\avg\avg9\avgnsa.exe |
"{54DE8E92-5696-4EF9-987F-3A23CF9EFA63}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{55AAFE8F-CEAF-4C3B-B0E6-7009A86EA8B4}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{5B845BB6-DC1A-45FF-B664-A9AA134CCB5C}" = dir=in | app=c:\program files (x86)\avg\avg9\avgupd.exe |
"{5E920FA1-92F7-43E8-83B7-340D63A1AD86}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{5FF8B5DE-522E-4207-B9DF-C21CC0013679}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6476BB3B-E523-46BA-AE1B-49E300A84AA6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6C7A5903-4979-4979-8553-9EBB273B2663}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011 demo\game.exe |
"{6FF2B672-9E23-40C8-A037-BE63B396DB4C}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011 demo\farmingsimulator2011.exe |
"{742A3FA0-7662-486B-9A6C-76E1CC6E551F}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{75E03B3F-6F0D-4A49-B200-65EE4C214003}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{8173AD92-AF78-4987-AC05-BAD0DE5ACA50}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{8179D0B2-6DE0-4B67-A585-C6EA3F87DC0B}" = protocol=6 | dir=out | app=system |
"{83627F98-E216-4C2F-BAD6-A2EE794CA595}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{90D049EC-9E15-4DD2-9F39-3F6ED8B74D68}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{A4D608DD-4B9A-4722-90EB-3D3E08129A85}" = protocol=6 | dir=in | app=c:\users\familie achleitner\downloads\facemoods.exe |
"{AAA170D9-4A4A-4FAB-954E-4AD0C7DC57E6}" = protocol=17 | dir=in | app=c:\program files (x86)\telekom austria\breitband-internet-installation\fixnet installer\installer.exe |
"{ACEB61D6-382E-4056-BB9A-E4ECFA5DFE22}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B194594F-9299-4CC8-844E-918DB6C59061}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{B3781171-5221-44A4-9127-DD3AB116DFB2}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B590B234-A623-4EF0-8180-949C658B499D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B5CC822C-0342-43ED-B8F1-7CF5CDBA0E61}" = protocol=6 | dir=in | app=c:\program files (x86)\telekom austria\breitband-internet-installation\fixnet installer\installer.exe |
"{B6845BCC-1B37-444A-BC3E-F56F9E5D3014}" = protocol=6 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe |
"{C7F22969-5DF9-48FA-B063-F61623BAD3F4}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011 demo\game.exe |
"{CF8E4362-77B7-48A0-B813-921587CA2266}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{D4B63380-22A8-4778-80F3-67972E7749B6}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D786F3FF-F93F-4D9C-B53C-2C36D83AF24E}" = protocol=17 | dir=in | app=c:\users\familie achleitner\downloads\facemoods.exe |
"{D98FA218-B0C6-44FB-8A67-F71BC8F8D8EF}" = protocol=17 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe |
"{E08FDAAA-CAB7-47DA-90EC-35E2A699EF4A}" = dir=in | app=c:\program files (x86)\avg\avg9\avgemc.exe |
"{E4CA77E4-0140-43EB-A6FA-E6C1BA0DCE20}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{EA72A4CA-350A-4ED3-A158-CFAFCBC15057}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F994373E-5EC9-45E0-9531-620F4AA06E55}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{38EB2C7D-86ED-4DFF-B8FA-9BC5D632B35D}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe |
"TCP Query User{3C75F97E-D599-4D00-B41D-CB38002B4546}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe |
"TCP Query User{BB3BE2E2-0A1F-4BBD-85F1-F779127D2ECB}C:\program files (x86)\clonk rage\clonk.exe" = protocol=6 | dir=in | app=c:\program files (x86)\clonk rage\clonk.exe |
"TCP Query User{DFE62AE2-1B77-4657-AE67-49505146B329}C:\program files (x86)\pc-küche.at\sql anywhere 7\win32\rteng7.exe" = protocol=6 | dir=in | app=c:\program files (x86)\pc-küche.at\sql anywhere 7\win32\rteng7.exe |
"UDP Query User{734536BF-A1C5-44DC-B7B0-DC4034471C2A}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe |
"UDP Query User{874607ED-9977-4313-8642-3142E129F8CA}C:\program files (x86)\clonk rage\clonk.exe" = protocol=17 | dir=in | app=c:\program files (x86)\clonk rage\clonk.exe |
"UDP Query User{9174C088-B069-44CF-9DAD-D92AF8810208}C:\program files (x86)\pc-küche.at\sql anywhere 7\win32\rteng7.exe" = protocol=17 | dir=in | app=c:\program files (x86)\pc-küche.at\sql anywhere 7\win32\rteng7.exe |
"UDP Query User{D4ABBF3E-CE9C-4253-B5FC-033A9CEB8185}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160" = Canon MP160
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6CFB1B20-ECAE-488F-9FFB-6AD420882E71}" = iTunes
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{15B4652F-38E8-4252-8374-EFE88AA2FDA7}" = Empire Earth II SP Demo
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1afbc81e-dd27-49bb-a831-e6a1298ed2ec}" = Nero 9 Essentials
"{1ED31028-6D65-4CFD-AD03-8E484A052FE7}" = aonUpdate
"{20400DBD-E6DB-45B8-9B6B-1DD7033818EC}" = Nero InfoTool Help
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2348B586-C9AE-46CE-936C-A68E9426E214}" = Nero StartSmart Help
"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{4767A89A-F6A5-41B1-903C-734483739882}" = Highspeed-Internet-Installation
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{634F79E1-2A41-4C40-9E8D-89EC740AC9D6}" = Logitech Harmony Remote Software
"{6B7FB3C4-E71B-478D-9E15-5AE97EAD67B8}" = aonFTP
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B0EE1CE-B2EF-49D6-AF4D-EBF8240EF2C2}" = Snap.Do
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{904B64C4-49D8-4941-A2B6-D13D06C5CD8B}" = Controller
"{90687432-4103-416F-B0C9-649D8CBD986F}" = Wildlife Park 2 Demo
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.6) - Deutsch
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1" = DriverScanner
"{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}" = TuneUp Utilities 2013
"{C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}" = Nero Online Upgrade
"{CC019E3F-59D2-4486-8D4B-878105B62A71}" = Nero DiscSpeed Help
"{CE33F0F6-2DB1-4C70-95F8-314CD94D6A4E}" = KingTranslate
"{E5C7D048-F9B4-4219-B323-8BDB01A2563D}" = Nero DriveSpeed Help
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.165
"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4811919-F252-4B25-9AB2-8859A85810B5}" = TuneUp Utilities Language Pack (de-DE)
"{F6BDD7C5-89ED-4569-9318-469AA9732572}" = Nero BurnRights Help
"{F9706A8C-D740-42CA-8703-E08EDD0F0778}" = LogMeIn Hamachi
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"888poker" = 888poker
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"aonFTP" = aonFTP
"aonUpdate" = aonUpdate
"AVG9Uninstall" = AVG Free 9.0
"BabylonToolbar" = Babylon toolbar on IE
"Clonk Endeavour" = Clonk Endeavour 4.95.5
"Clonk Planet" = Clonk Planet
"Clonk Rage" = Clonk Rage
"Controller" = Controller
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"Euro Truck Simulator" = Euro Truck Simulator 1.3
"facemoods" = Facemoods Toolbar
"FarmingSimulator2009DE_is1" = Landwirtschafts-Simulator 2009
"FarmingSimulator2009GoldDEESD_is1" = Landwirtschafts-Simulator 2009 Gold Addon
"FarmingSimulator2011DemoDE_is1" = Landwirtschafts Simulator 2011 Demo
"Free Video Dub_is1" = Free Video Dub version 2.0.17.128
"Free YouTube Download_is1" = Free YouTube Download version 3.2.1.320
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.2.422
"German Truck Simulator" = German Truck Simulator 1.32
"Highspeed-Internet-Installation" = Highspeed-Internet-Installation
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"LogMeIn Hamachi" = LogMeIn Hamachi
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 4.0 (x86 de)" = Mozilla Firefox 4.0 (x86 de)
"PC-Küche_is1" = PC-Küche 2.1.1
"PokerStars" = PokerStars
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"theHunter" = theHunter (remove only)
"TrackMania_is1" = TrackMania
"TuneUp Utilities 2013" = TuneUp Utilities 2013
"UK Truck Simulator" = UK Truck Simulator 1.32
"Update Engine" = Sony Ericsson Update Engine
"WLP2_is1" = Wildlife Park 2 - Farm World v2.1
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2981905205-1357387969-867761577-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"{9ecc04b6-ab3a-40a3-9344-477198b9f04e}" = Snap.Do Engine
"Pokki" = Pokki
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2981905205-1357387969-867761577-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"Funmoods" = Version Checker for Funmoods
"gamealarm-DEFAULT" = Game Alarm
"Google Chrome" = Google Chrome
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"PDF Reader" = PDF Reader
"sc11-AT_ORF_MAIN" = Ski Challenge 11 (AT)
"sc12-AT_MAIN" = Ski Challenge 12 (AT)
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 12.09.2012 16:32:44 | Computer Name = Christian-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10016
Error - 12.09.2012 16:32:45 | Computer Name = Christian-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 12.09.2012 16:32:45 | Computer Name = Christian-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 11014
Error - 12.09.2012 16:32:45 | Computer Name = Christian-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 11014
Error - 12.09.2012 16:32:46 | Computer Name = Christian-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 12.09.2012 16:32:46 | Computer Name = Christian-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 12012
Error - 12.09.2012 16:32:46 | Computer Name = Christian-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 12012
Error - 17.09.2012 13:23:35 | Computer Name = Christian-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16448 kann nicht mehr unter
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
zu suchen. Prozess-ID: cb0 Startzeit: 01cd94f8f9c91c27 Endzeit: 10 Anwendungspfad:
C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID:
Error - 19.09.2012 01:52:38 | Computer Name = Christian-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16448 kann nicht mehr unter
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
zu suchen. Prozess-ID: 7f8 Startzeit: 01cd962ad6f24a5e Endzeit: 15 Anwendungspfad:
C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID: 2dcf8f3b-021e-11e2-b3a2-90fba66bfc0a
Error - 19.09.2012 01:59:06 | Computer Name = Christian-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16448 kann nicht mehr unter
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
zu suchen. Prozess-ID: e20 Startzeit: 01cd962b17eb3d29 Endzeit: 10 Anwendungspfad:
C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID:
[ System Events ]
Error - 27.06.2013 15:49:35 | Computer Name = Christian-PC | Source = PNRPSvc | ID = 102
Description =
Error - 27.06.2013 15:49:35 | Computer Name = Christian-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
beendet: %%-2140993535
Error - 27.06.2013 15:49:35 | Computer Name = Christian-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%-2140993535
Error - 27.06.2013 15:51:12 | Computer Name = Christian-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?27.?06.?2013 um 21:49:39 unerwartet heruntergefahren.
Error - 29.06.2013 01:41:14 | Computer Name = Christian-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AvgLdx64 AvgMfx64 discache spldr Wanarpv6
Error - 29.06.2013 01:41:58 | Computer Name = Christian-PC | Source = DCOM | ID = 10005
Description =
Error - 29.06.2013 01:42:06 | Computer Name = Christian-PC | Source = DCOM | ID = 10005
Description =
Error - 29.06.2013 01:42:11 | Computer Name = Christian-PC | Source = DCOM | ID = 10010
Description =
Error - 29.06.2013 01:42:12 | Computer Name = Christian-PC | Source = DCOM | ID = 10005
Description =
Error - 29.06.2013 01:42:12 | Computer Name = Christian-PC | Source = DCOM | ID = 10005
Description =
< End of report >
|
|
29.06.2013, 08:12
| #2 |
| /// the machine /// TB-Ausbilder    | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) Hi,
__________________Fixen mit OTL
Code:
ATTFilter :OTL
O20 - HKU\S-1-5-21-2981905205-1357387969-867761577-1000 Winlogon: Shell - (C:\Users\Christian\AppData\Roaming\skype.dat) - C:\Users\Christian\AppData\Roaming\skype.dat ()
:files
C:\Users\Christian\AppData\Roaming\skype.ini
C:\Users\Christian\AppData\Roaming\skype.dat
__________________ |
|
29.06.2013, 08:22
| #3 |
| | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) Neustart wurde keiner verlangt,
__________________Code:
ATTFilter ========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-2981905205-1357387969-867761577-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Christian\AppData\Roaming\skype.dat deleted successfully.
C:\Users\Christian\AppData\Roaming\skype.dat moved successfully.
========== FILES ==========
C:\Users\Christian\AppData\Roaming\skype.ini moved successfully.
File\Folder C:\Users\Christian\AppData\Roaming\skype.dat not found.
OTL by OldTimer - Version 3.2.69.0 log created on 06292013_091919
|
|
29.06.2013, 08:23
| #4 |
| /// the machine /// TB-Ausbilder | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) Dann reboote mal 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.06.2013, 08:35
| #5 |
| | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) nach dem Neustart kann ich mich jetzt wieder in den anderen Account einloggen, sieht ja ganz gut aus  Habe auch die ASK Toolbar und den anderen Mist bereinigt.Muss ich sonst noch etwas machen? |
|
29.06.2013, 08:35
| #6 |
| /// the machine /// TB-Ausbilder | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) Jap, Kontrollscans in diesem Account Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Systemscan mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
__________________ --> Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) |
|
29.06.2013, 10:50
| #7 |
| | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) danke erst mal für deine rasche Hilfe!  Code:
ATTFilter # AdwCleaner v2.303 - Datei am 29/06/2013 um 10:32:48 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Christian - CHRISTIAN-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Christian\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\fcmdSrch.xml
Datei Gelöscht : C:\user.js
Datei Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\Searchqu.ini
Datei Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\Uninstall.exe
Datei Gelöscht : C:\Windows\SysWOW64\conduitEngine.tmp
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\DVDVideoSoftTB
Ordner Gelöscht : C:\Program Files (x86)\facemoods.com
Ordner Gelöscht : C:\Program Files (x86)\softonic-de3
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\AskSearch
Ordner Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\BabylonToolbar
Ordner Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\Smartbar
Ordner Gelöscht : C:\Users\Christian\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\Christian\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Christian\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Christian\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\Christian\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\Christian\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Christian\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\Christian\AppData\LocalLow\DVDVideoSoftTB
Ordner Gelöscht : C:\Users\Christian\AppData\LocalLow\facemoods.com
Ordner Gelöscht : C:\Users\Christian\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Christian\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\Christian\AppData\LocalLow\softonic-de3
Ordner Gelöscht : C:\Users\Christian\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Christian\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Christian\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Familie Achleitner\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Familie Achleitner\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\Familie Achleitner\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Familie Achleitner\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\Familie Achleitner\AppData\LocalLow\DVDVideoSoftTB
Ordner Gelöscht : C:\Users\Familie Achleitner\AppData\LocalLow\facemoods.com
Ordner Gelöscht : C:\Users\Familie Achleitner\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Familie Achleitner\AppData\LocalLow\softonic-de3
Ordner Gelöscht : C:\Users\Familie Achleitner\AppData\Roaming\Funmoods
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\softonic-de3
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\facemoods.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{64182481-4F71-486B-A045-B233BD0DA8FC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{315827F1-7C37-4C9C-8AAC-CE63A2F0D753}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64182481-4F71-486B-A045-B233BD0DA8FC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\SmartbarBackup
Schlüssel Gelöscht : HKCU\Software\SmartbarLog
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{AD25754E-D76C-42B3-A335-2F81478B722F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.escrtSrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.escrtSrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.xtrnl
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.xtrnl.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoodsApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoodsApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.BandObjectAttribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.DockingPanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBarBandObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarDisplayState
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarMenuForm
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2431245
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{12A5F606-B1EC-474C-83ED-95E99FD8058E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{AD25754E-D76C-42B3-A335-2F81478B722F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DVDVideoSoftTB
Schlüssel Gelöscht : HKLM\Software\facemoods.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonToolbarsrv_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonToolbarsrv_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBAutoUpdaterHelper_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBAutoUpdaterHelper_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBToolbarHelper_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBToolbarHelper_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBToolbarHelper1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBToolbarHelper1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{315827F1-7C37-4C9C-8AAC-CE63A2F0D753}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A719B82F-99C5-460E-9B7D-C167CBDCDB30}
Schlüssel Gelöscht : HKLM\Software\softonic-de3
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{315827F1-7C37-4C9C-8AAC-CE63A2F0D753}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{64182481-4F71-486B-A045-B233BD0DA8FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A719B82F-99C5-460E-9B7D-C167CBDCDB30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AD20D01C-C939-4DD2-8C55-56935A48987E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DDE2C74F-58CC-4D71-8CE1-09DEBB8CFB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{542FA950-C57A-4E17-B3E1-D935DFE15DEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5B035F86-41B5-40F1-AAAD-3D219F30244E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6365AC7B-9920-4D8B-AF5D-3BDFEAC340A8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6A934270-717F-4BC3-BA59-BC9BED47A8D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{74C012C4-00FB-4F04-9AFB-4AD5449D2018}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{78888F8B-D5E4-43CE-89F5-C8C18223AF64}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79B13431-CCAC-4097-8889-D0289E5E924F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{981334CB-7B8B-431F-B86D-67B7426B125B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ihflimipbcaljfnojhhknppphnnciiif
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0AD91136-65ED-4396-8B7A-0B65C3A94D60}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{72DADFB0-1951-43B6-8A65-23089A4A30A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{845D3821-48AC-4435-AB2C-3FC56182B03B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4F05-9A6E-5D3B778EC567}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486B-A045-B233BD0DA8FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\facemoods
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\softonic-de3 Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{542FA950-C57A-4E17-B3E1-D935DFE15DEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5B035F86-41B5-40F1-AAAD-3D219F30244E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6365AC7B-9920-4D8B-AF5D-3BDFEAC340A8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6A934270-717F-4BC3-BA59-BC9BED47A8D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{74C012C4-00FB-4F04-9AFB-4AD5449D2018}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{78888F8B-D5E4-43CE-89F5-C8C18223AF64}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79B13431-CCAC-4097-8889-D0289E5E924F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{981334CB-7B8B-431F-B86D-67B7426B125B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [facemoods]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16611
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://start.facemoods.com/?a=gppc&s={searchTerms}&f=4 --> hxxp://www.google.com
*************************
AdwCleaner[R1].txt - [22768 octets] - [29/06/2013 10:32:27]
AdwCleaner[S1].txt - [21151 octets] - [29/06/2013 10:32:48]
########## EOF - C:\AdwCleaner[S1].txt - [21212 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by Christian on 29.06.2013 at 10:45:25,18
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Suspicious HKCU\..\Run entries found. Trojan:JS/Medfos.B?
Val Name Type Value Data
======== ==== ==========
Pokki REG_EXPAND_SZ C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\LaunchDeskband.dll",RunLaunchDeskband
~~~ Registry Keys
~~~ Files
Successfully deleted: [File] C:\eula.1028.txt
Successfully deleted: [File] C:\eula.1031.txt
Successfully deleted: [File] C:\eula.1033.txt
Successfully deleted: [File] C:\eula.1036.txt
Successfully deleted: [File] C:\eula.1040.txt
Successfully deleted: [File] C:\eula.1041.txt
Successfully deleted: [File] C:\eula.1042.txt
Successfully deleted: [File] C:\eula.2052.txt
Successfully deleted: [File] C:\install.res.1028.dll
Successfully deleted: [File] C:\install.res.1031.dll
Successfully deleted: [File] C:\install.res.1033.dll
Successfully deleted: [File] C:\install.res.1036.dll
Successfully deleted: [File] C:\install.res.1040.dll
Successfully deleted: [File] C:\install.res.1041.dll
Successfully deleted: [File] C:\install.res.1042.dll
Successfully deleted: [File] C:\install.res.2052.dll
Successfully deleted: [File] C:\install.res.3082.dll
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.06.2013 at 10:48:16,17
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-06-2013
Ran by Christian (administrator) on 29-06-2013 10:54:10
Running from C:\Users\Christian\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgemc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
(Pokki) C:\Users\Christian\AppData\Local\Pokki\Engine\pokki.exe
(Pokki) C:\Users\Christian\AppData\Local\Pokki\Engine\pokki.exe
(Pokki) C:\Users\Christian\AppData\Local\Pokki\Engine\pokki.exe
(PortableApps.com) E:\PortableApps\GoogleChromePortable\GoogleChromePortable.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
==================== Registry (Whitelisted) ==================
HKCU\...\Run: [Sony PC Companion] "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background [449248 2013-05-29] (Sony)
HKCU\...\Run: [KingTranslate] "C:\Program Files (x86)\KingTranslate\KingTranslate.exe" /NotShowMainWindow [164352 2013-02-04] (KoyoteSoft Inc.)
HKCU\...\Run: [Pokki] C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\LaunchDeskband.dll",RunLaunchDeskband [x]
HKCU\...\Winlogon: [Shell] explorer.exe, <==== ATTENTION
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
MountPoints2: {6514dba2-473d-11e1-b502-90fba66bfc0a} - E:\Startme.exe
HKLM-x32\...\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe [2077536 2012-01-26] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start [2255184 2013-05-15] (LogMeIn Inc.)
HKU\Familie Achleitner\...\Run: [Google Update] "C:\Users\Familie Achleitner\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-03-02] (Google Inc.)
HKU\Familie Achleitner\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
AppInit_DLLs: avgrssta.dll [13048 2010-09-03] (AVG Technologies CZ, s.r.o.)
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Familie Achleitner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Game Alarm.lnk
ShortcutTarget: Game Alarm.lnk -> C:\Games\Game Alarm\gamealarm.exe (Europe Support Ltd. N.V.)
Startup: C:\Users\Familie Achleitner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=hp&installDate=12/04/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=ds&q={searchTerms}&installDate=12/04/2013
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
Tcpip\Parameters: [DhcpNameServer] 213.153.32.129 213.153.32.1 192.168.1.1
==================== Services (Whitelisted) =================
R2 avg9emc; C:\Program Files (x86)\AVG\AVG9\avgemc.exe [921952 2010-09-03] (AVG Technologies CZ, s.r.o.)
R2 avg9wd; C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [308136 2010-09-03] (AVG Technologies CZ, s.r.o.)
==================== Drivers (Whitelisted) ====================
R1 AvgLdx64; C:\Windows\System32\Drivers\avgldx64.sys [282976 2013-01-15] (AVG Technologies CZ, s.r.o.)
R1 AvgMfx64; C:\Windows\System32\Drivers\avgmfx64.sys [35664 2011-09-12] (AVG Technologies CZ, s.r.o.)
R1 AvgTdiA; C:\Windows\System32\Drivers\avgtdia.sys [317520 2011-05-06] (AVG Technologies CZ, s.r.o.)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-15] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-15] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-15] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-15] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-15] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-15] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-15] (MCCI Corporation)
S3 FXDrv32; \??\D:\FXDrv64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-29 10:53 - 2013-06-29 10:53 - 00000000 ____D C:\FRST
2013-06-29 10:48 - 2013-06-29 10:48 - 00001761 ____A C:\Users\Christian\Desktop\JRT.txt
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\JRT
2013-06-29 10:44 - 2013-06-29 10:44 - 01933572 ____A (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2013-06-29 10:40 - 2013-06-29 10:40 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Christian\Desktop\JRT.exe
2013-06-29 10:32 - 2013-06-29 10:33 - 00021220 ____A C:\AdwCleaner[S1].txt
2013-06-29 10:32 - 2013-06-29 10:32 - 00022768 ____A C:\AdwCleaner[R1].txt
2013-06-29 10:31 - 2013-06-29 10:31 - 00648201 ____A C:\Users\Christian\Desktop\adwcleaner.exe
2013-06-29 09:19 - 2013-06-29 09:19 - 00000000 ____D C:\_OTL
2013-06-29 08:41 - 2013-06-29 08:41 - 00061838 ____A C:\Users\Familie Achleitner\Desktop\Extras.Txt
2013-06-29 08:39 - 2013-06-29 08:39 - 00099550 ____A C:\Users\Familie Achleitner\Desktop\OTL.Txt
2013-06-29 08:23 - 2013-06-29 08:23 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Desktop\OTL.exe
2013-06-29 08:21 - 2013-06-29 08:21 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Downloads\7478.tmp
2013-06-29 08:18 - 2013-06-29 08:18 - 00000480 ____A C:\Users\Familie Achleitner\Desktop\defogger_disable.log
2013-06-29 08:18 - 2013-06-29 08:18 - 00000000 ____A C:\Users\Christian\defogger_reenable
2013-06-29 08:17 - 2013-05-14 14:22 - 00377856 ____A C:\Users\Familie Achleitner\Desktop\3-gmer_2.1.19163.exe
2013-06-29 08:17 - 2013-05-14 14:21 - 00050477 ____A C:\Users\Familie Achleitner\Desktop\1-Defogger.exe
2013-06-29 08:17 - 2013-05-14 14:00 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Desktop\2-OTL.exe
2013-06-29 08:00 - 2013-06-29 08:00 - 00002315 ____A C:\Users\Christian\Desktop\Search.lnk
2013-06-27 21:06 - 2013-06-27 21:06 - 00002026 ____A C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2013-06-16 03:01 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-16 03:01 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-16 03:01 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-16 03:01 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-16 03:01 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-16 03:01 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-16 03:01 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-16 03:01 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-14 03:05 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-14 03:05 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-14 03:05 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-14 03:05 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-14 03:05 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-14 03:05 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-13 12:12 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 12:12 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-13 12:11 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 12:11 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 12:11 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 12:11 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 12:11 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-13 12:11 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-13 12:11 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-13 12:11 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 12:11 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-13 12:11 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-13 12:11 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 12:11 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-13 12:11 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 12:11 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-13 12:11 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-13 12:11 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-13 12:11 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-02 12:59 - 2013-06-02 12:59 - 00903072 ____A (Oracle Corporation) C:\Users\Familie Achleitner\Downloads\jxpiinstall.exe
2013-05-30 22:13 - 2013-05-30 22:13 - 00282960 ____A C:\Windows\Minidump\053013-39686-01.dmp
==================== One Month Modified Files and Folders =======
2013-06-29 10:53 - 2013-06-29 10:53 - 00000000 ____D C:\FRST
2013-06-29 10:48 - 2013-06-29 10:48 - 00001761 ____A C:\Users\Christian\Desktop\JRT.txt
2013-06-29 10:47 - 2013-04-26 19:06 - 00000000 ____D C:\Users\Christian\AppData\Local\Pokki
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\JRT
2013-06-29 10:44 - 2013-06-29 10:44 - 01933572 ____A (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2013-06-29 10:43 - 2009-07-14 06:45 - 00013632 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-29 10:43 - 2009-07-14 06:45 - 00013632 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-29 10:40 - 2013-06-29 10:40 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Christian\Desktop\JRT.exe
2013-06-29 10:36 - 2012-09-20 11:10 - 00000000 ____D C:\Users\Christian\AppData\Local\LogMeIn Hamachi
2013-06-29 10:34 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-29 10:34 - 2009-07-14 06:51 - 00124414 ____A C:\Windows\setupact.log
2013-06-29 10:33 - 2013-06-29 10:32 - 00021220 ____A C:\AdwCleaner[S1].txt
2013-06-29 10:33 - 2010-09-03 15:41 - 01999639 ____A C:\Windows\WindowsUpdate.log
2013-06-29 10:32 - 2013-06-29 10:32 - 00022768 ____A C:\AdwCleaner[R1].txt
2013-06-29 10:31 - 2013-06-29 10:31 - 00648201 ____A C:\Users\Christian\Desktop\adwcleaner.exe
2013-06-29 10:30 - 2011-03-02 18:05 - 00001172 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003UA.job
2013-06-29 09:59 - 2012-11-23 16:56 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 09:30 - 2012-09-13 19:42 - 00000000 ____D C:\Users\Familie Achleitner\AppData\Local\LogMeIn Hamachi
2013-06-29 09:29 - 2011-12-20 14:11 - 00000000 ____D C:\Program Files\Google
2013-06-29 09:29 - 2011-12-20 14:10 - 00000000 ____D C:\Program Files (x86)\Google
2013-06-29 09:29 - 2010-09-14 11:20 - 00067308 ____A C:\Windows\PFRO.log
2013-06-29 09:19 - 2013-06-29 09:19 - 00000000 ____D C:\_OTL
2013-06-29 09:14 - 2011-12-20 14:10 - 00000000 ____D C:\Users\Christian\AppData\Local\Google
2013-06-29 09:14 - 2011-12-20 14:10 - 00000000 ____D C:\ProgramData\Google
2013-06-29 09:14 - 2011-03-02 18:05 - 00000000 ____D C:\Users\Familie Achleitner\AppData\Local\Google
2013-06-29 08:41 - 2013-06-29 08:41 - 00061838 ____A C:\Users\Familie Achleitner\Desktop\Extras.Txt
2013-06-29 08:39 - 2013-06-29 08:39 - 00099550 ____A C:\Users\Familie Achleitner\Desktop\OTL.Txt
2013-06-29 08:23 - 2013-06-29 08:23 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Desktop\OTL.exe
2013-06-29 08:21 - 2013-06-29 08:21 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Downloads\7478.tmp
2013-06-29 08:18 - 2013-06-29 08:18 - 00000480 ____A C:\Users\Familie Achleitner\Desktop\defogger_disable.log
2013-06-29 08:18 - 2013-06-29 08:18 - 00000000 ____A C:\Users\Christian\defogger_reenable
2013-06-29 08:18 - 2010-09-03 15:41 - 00000000 ____D C:\users\Christian
2013-06-29 08:15 - 2009-07-14 19:58 - 00654150 ____A C:\Windows\System32\perfh007.dat
2013-06-29 08:15 - 2009-07-14 19:58 - 00130022 ____A C:\Windows\System32\perfc007.dat
2013-06-29 08:15 - 2009-07-14 07:13 - 01498742 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-29 08:00 - 2013-06-29 08:00 - 00002315 ____A C:\Users\Christian\Desktop\Search.lnk
2013-06-29 07:47 - 2010-09-03 16:36 - 00000000 ____D C:\Windows\System32\Drivers\Avg
2013-06-27 21:51 - 2009-07-14 07:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-27 21:06 - 2013-06-27 21:06 - 00002026 ____A C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2013-06-27 21:06 - 2011-02-17 19:15 - 00388048 ____A C:\Windows\DPINST.LOG
2013-06-27 21:05 - 2011-01-19 15:32 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-06-27 20:22 - 2011-03-02 18:05 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003Core.job
2013-06-14 04:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-14 03:32 - 2010-09-10 11:18 - 00000000 ____D C:\users\Familie Achleitner
2013-06-14 03:07 - 2010-02-24 12:06 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 12:00 - 2012-11-23 16:56 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-13 12:00 - 2012-11-23 16:56 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-08 16:08 - 2013-06-16 03:01 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-16 03:01 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-16 03:01 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-16 03:01 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-16 03:01 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-16 03:01 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-16 03:01 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:13 - 2013-06-16 03:01 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-02 12:59 - 2013-06-02 12:59 - 00903072 ____A (Oracle Corporation) C:\Users\Familie Achleitner\Downloads\jxpiinstall.exe
2013-05-30 22:13 - 2013-05-30 22:13 - 00282960 ____A C:\Windows\Minidump\053013-39686-01.dmp
2013-05-30 22:13 - 2010-09-13 17:19 - 00000000 ____D C:\Windows\Minidump
2013-05-30 22:12 - 2010-09-13 17:19 - 364272081 ____A C:\Windows\MEMORY.DMP
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-23 10:32
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-06-2013
Ran by Christian at 2013-06-29 10:57:22
Running from C:\Users\Christian\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
Update for Microsoft Office 2007 (KB2508958) (x32)
888poker (x32)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Reader X (10.1.6) - Deutsch (x32 Version: 10.1.6)
Advertising Center (x32 Version: 0.0.0.2)
Anno 1701 (x32 Version: 1.02)
aonFTP (x32 Version: 1.6)
aonFTP (x32)
aonUpdate (x32 Version: 1.3)
aonUpdate (x32)
Apple Application Support (x32 Version: 2.1.5)
Apple Mobile Device Support (Version: 4.0.0.97)
Apple Software Update (x32 Version: 2.1.3.127)
AVG Free 9.0 (x32)
Bonjour (Version: 3.0.0.10)
Canon MP160
Clonk Endeavour 4.95.5 (x32 Version: 4.95.5)
Clonk Planet (x32 Version: 4.65)
Clonk Rage (x32)
Controller (x32 Version: 2.8.0.196)
Controller (x32)
Empire Earth (x32)
Empire Earth II SP Demo (x32 Version: 1.0)
Euro Truck Simulator 1.3 (x32 Version: 1.3)
Free Video Dub version 2.0.17.128 (x32 Version: 2.0.17.128)
Free YouTube Download version 3.2.1.320 (x32 Version: 3.2.1.320)
Free YouTube to MP3 Converter version 3.12.2.422 (x32 Version: 3.12.2.422)
German Truck Simulator 1.32 (x32 Version: 1.32)
Highspeed-Internet-Installation (x32 Version: 7.2.1.41)
Highspeed-Internet-Installation (x32)
iTunes (Version: 10.5.1.42)
Java Auto Updater (x32 Version: 2.0.7.1)
Java(TM) 6 Update 31 (x32 Version: 6.0.310)
KingTranslate (x32 Version: 1.0)
Landwirtschafts Simulator 2011 Demo (x32 Version: 1.0)
Landwirtschafts-Simulator 2009 (x32)
Landwirtschafts-Simulator 2009 Gold Addon (x32)
Logitech Harmony Remote Software (x32 Version: 1.0.110307)
LogMeIn Hamachi (x32 Version: 2.1.0.362)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Mozilla Firefox 4.0 (x86 de) (x32 Version: 4.0)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Nero 9 Essentials (x32)
Nero BurnRights (x32 Version: 3.4.13.100)
Nero BurnRights Help (x32 Version: 3.4.4.100)
Nero ControlCenter (x32 Version: 9.0.0.1)
Nero DiscSpeed (x32 Version: 5.4.13.100)
Nero DiscSpeed Help (x32 Version: 5.4.4.100)
Nero DriveSpeed (x32 Version: 4.4.12.100)
Nero DriveSpeed Help (x32 Version: 4.4.4.100)
Nero InfoTool (x32 Version: 6.4.12.100)
Nero InfoTool Help (x32 Version: 6.4.4.100)
Nero Installer (x32 Version: 4.4.9.0)
Nero Online Upgrade (x32 Version: 1.3.0.0)
Nero StartSmart (x32 Version: 9.4.19.100)
Nero StartSmart Help (x32 Version: 9.4.19.100)
neroxml (x32 Version: 1.0.0)
Nokia Connectivity Cable Driver (Version: 7.1.32.64)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
PC-Küche 2.1.1 (x32)
PokerStars (x32)
Pokki (HKCU Version: 0.263.13.325)
QuickTime (x32 Version: 7.71.80.42)
Snap.Do (x32 Version: 1.20.1.10742)
Snap.Do Engine (HKCU Version: 1.20.1.10742)
Sony Ericsson Update Engine (x32 Version: 2.13.5.201304180917)
Sony PC Companion 2.10.165 (x32 Version: 2.10.165)
theHunter (remove only) (x32)
TrackMania (x32)
UK Truck Simulator 1.32 (x32 Version: 1.32)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
Visual C++ 8.0 Runtime Setup Package (x64) (x32 Version: 9.0.0.623)
Wildlife Park 2 - Farm World v2.1 (x32)
Wildlife Park 2 Demo (x32 Version: 1.01)
==================== Restore Points =========================
04-06-2013 15:34:59 Geplanter Prüfpunkt
08-06-2013 08:06:05 Avg Update
14-06-2013 01:01:08 Windows Update
16-06-2013 01:00:26 Windows Update
23-06-2013 08:35:23 Geplanter Prüfpunkt
26-06-2013 17:06:01 Avg Update
29-06-2013 07:09:47 TuneUp Utilities 2013 wird entfernt
29-06-2013 07:11:01 TuneUp Utilities Language Pack (de-DE) wird entfernt
==================== Scheduled Tasks (whitelisted) =============
Task: {14308F2C-7555-4018-827A-ECDB21B0F333} - System32\Tasks\Funmoods => C:\Users\FAMILI~1\AppData\Roaming\Funmoods\UPDATE~1\UPDATE~1.EXE No File
Task: {3998EE44-603C-4E45-9123-B812C270E687} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003UA => C:\Users\Familie Achleitner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-02] (Google Inc.)
Task: {58406A20-9E94-49BF-9C2A-6845E45A81B3} - System32\Tasks\WPD\SqmUpload_S-1-5-21-2981905205-1357387969-867761577-1003 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {5E34ED0D-048B-41DF-A929-AC0C3B55200F} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {70C98183-CF5E-4A94-9405-B585F8041D12} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003Core => C:\Users\Familie Achleitner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-02] (Google Inc.)
Task: {7AA5D3D5-491F-4550-A6AA-902499D9C79A} - System32\Tasks\{B1AEC537-D3CA-4C9F-A28A-3280ED09179E} => C:\Program Files (x86)\Landwirtschafts-Simulator 2009\FarmingSimulator2009.exe [2009-04-20] (GIANTS Software GmbH)
Task: {B44CE28A-5611-421C-B5FB-49824D260EC7} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)
Task: {B86E8DE0-244E-4533-AA1A-2E1E04B20257} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03] (Adobe Systems Incorporated)
Task: {CD5595B5-5A66-437F-953C-971058B425F7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DE2BC537-9F94-4224-B455-FAC0DCA2CB6C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-13] (Adobe Systems Incorporated)
Task: {F88060D9-A017-479D-AAF0-B5A33544C0AC} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-01-18] (Sun Microsystems, Inc.)
Task: {FC750549-3FC7-4516-A2A4-2D06285F4059} - System32\Tasks\{0C997295-8175-49B8-B0B4-35255A8A24C4} => C:\Program Files (x86)\Landwirtschafts-Simulator 2009\FarmingSimulator2009.exe [2009-04-20] (GIANTS Software GmbH)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\BearShareNAG.job => C:\Users\FAMILI~1\AppData\Local\Temp\BearShare_setup.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003Core.job => C:\Users\Familie Achleitner\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003UA.job => C:\Users\Familie Achleitner\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 42%
Total physical RAM: 2814.18 MB
Available physical RAM: 1616.7 MB
Total Pagefile: 5626.54 MB
Available Pagefile: 3952.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.22 GB) (Free:398.85 GB) NTFS (Disk=0 Partition=2)
Drive e: (HRDesign) (Removable) (Total:14.92 GB) (Free:0.88 GB) NTFS (Disk=1 Partition=1)
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 987063A4)
Partition 1: (Active) - (Size=552 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 66205247)
Partition 1: (Not Active) - (Size=875 GB) - (Type=0A)
Partition 2: (Not Active) - (Size=932 GB) - (Type=69)
Partition 3: (Not Active) - (Size=931 GB) - (Type=6D)
Partition 4: (Not Active) - (Size=27 MB) - (Type=66)
==================== End Of Log ============================
|
|
29.06.2013, 11:46
| #8 |
| /// the machine /// TB-Ausbilder | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) Supi ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST Log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.06.2013, 15:29
| #9 |
| | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) hat etwas länger gedauert, da sind einige tmp am Rechner. Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=915aeec538fe0b40a1f45af8f597dcc0
# engine=14197
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-29 02:12:21
# local_time=2013-06-29 04:12:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 25715881 124144991 0 0
# scanned=243078
# found=4
# cleaned=0
# scan_time=12004
sh=F7953191F2E616F307C9EDDEF5E78B388FBBAD59 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Christian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\277f5fae-35d7b332"
sh=0E7DA3207341FEE532B78B44BEDF530ADEED05E3 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen virus" ac=I fn="C:\Users\Familie Achleitner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0QQIRCYE\thebobiporn_com[1].htm"
sh=2D7E1CBA04DFEB605DC522357FD92E5E6586DC1A ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen virus" ac=I fn="C:\Users\Familie Achleitner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8CQPWPIY\thebobiporn_com[1].htm"
sh=510CA1D9F767AA603A32943875290AED4D535BB3 ft=1 fh=4dc253c6253d1699 vn="Win32/LockScreen.AQD trojan" ac=I fn="C:\_OTL\MovedFiles\06292013_091919\C_Users\Christian\AppData\Roaming\skype.dat"
SecurityCheck konnte nur im Kompatibilitätsmodus ausgeführt werden. Code:
ATTFilter Results of screen317's Security Check version 0.99.68
Windows XP x64 (UAC is enabled)
Out of date service pack!!
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 31
Java version out of Date!
Adobe Flash Player 11.7.700.224
Adobe Reader 10.1.6 Adobe Reader out of Date!
Mozilla Firefox 4.0 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVG avgemc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-06-2013 01
Ran by Christian (administrator) on 29-06-2013 16:25:24
Running from C:\Users\Christian\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgemc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
(Pokki) C:\Users\Christian\AppData\Local\Pokki\Engine\pokki.exe
(Pokki) C:\Users\Christian\AppData\Local\Pokki\Engine\pokki.exe
(Pokki) C:\Users\Christian\AppData\Local\Pokki\Engine\pokki.exe
(PortableApps.com) E:\PortableApps\GoogleChromePortable\GoogleChromePortable.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
==================== Registry (Whitelisted) ==================
HKCU\...\Run: [Sony PC Companion] "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background [449248 2013-05-29] (Sony)
HKCU\...\Run: [KingTranslate] "C:\Program Files (x86)\KingTranslate\KingTranslate.exe" /NotShowMainWindow [164352 2013-02-04] (KoyoteSoft Inc.)
HKCU\...\Run: [Pokki] C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\LaunchDeskband.dll",RunLaunchDeskband [x]
HKCU\...\Winlogon: [Shell] explorer.exe, <==== ATTENTION
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
MountPoints2: {6514dba2-473d-11e1-b502-90fba66bfc0a} - E:\Startme.exe
HKLM-x32\...\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe [2077536 2012-01-26] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start [2255184 2013-05-15] (LogMeIn Inc.)
HKU\Familie Achleitner\...\Run: [Google Update] "C:\Users\Familie Achleitner\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-03-02] (Google Inc.)
HKU\Familie Achleitner\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
AppInit_DLLs: avgrssta.dll [13048 2010-09-03] (AVG Technologies CZ, s.r.o.)
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Familie Achleitner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Game Alarm.lnk
ShortcutTarget: Game Alarm.lnk -> C:\Games\Game Alarm\gamealarm.exe (Europe Support Ltd. N.V.)
Startup: C:\Users\Familie Achleitner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=hp&installDate=12/04/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=ds&q={searchTerms}&installDate=12/04/2013
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
Tcpip\Parameters: [DhcpNameServer] 213.153.32.129 213.153.32.1 192.168.1.1
==================== Services (Whitelisted) =================
R2 avg9emc; C:\Program Files (x86)\AVG\AVG9\avgemc.exe [921952 2010-09-03] (AVG Technologies CZ, s.r.o.)
R2 avg9wd; C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [308136 2010-09-03] (AVG Technologies CZ, s.r.o.)
==================== Drivers (Whitelisted) ====================
R1 AvgLdx64; C:\Windows\System32\Drivers\avgldx64.sys [282976 2013-01-15] (AVG Technologies CZ, s.r.o.)
R1 AvgMfx64; C:\Windows\System32\Drivers\avgmfx64.sys [35664 2011-09-12] (AVG Technologies CZ, s.r.o.)
R1 AvgTdiA; C:\Windows\System32\Drivers\avgtdia.sys [317520 2011-05-06] (AVG Technologies CZ, s.r.o.)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-15] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-15] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-15] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-15] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-15] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-15] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-15] (MCCI Corporation)
S3 FXDrv32; \??\D:\FXDrv64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-29 16:25 - 2013-06-29 16:25 - 01933592 ____A (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2013-06-29 16:18 - 2013-06-29 16:18 - 00890988 ____A C:\Users\Christian\Desktop\SecurityCheck.exe
2013-06-29 12:50 - 2013-06-29 12:50 - 02347384 ____A (ESET) C:\Users\Christian\Desktop\esetsmartinstaller_enu.exe
2013-06-29 10:57 - 2013-06-29 10:57 - 00011064 ____A C:\Users\Christian\Desktop\Addition.txt
2013-06-29 10:53 - 2013-06-29 10:53 - 00000000 ____D C:\FRST
2013-06-29 10:48 - 2013-06-29 10:48 - 00001761 ____A C:\Users\Christian\Desktop\JRT.txt
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\JRT
2013-06-29 10:40 - 2013-06-29 10:40 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Christian\Desktop\JRT.exe
2013-06-29 10:32 - 2013-06-29 10:33 - 00021220 ____A C:\AdwCleaner[S1].txt
2013-06-29 10:32 - 2013-06-29 10:32 - 00022768 ____A C:\AdwCleaner[R1].txt
2013-06-29 10:31 - 2013-06-29 10:31 - 00648201 ____A C:\Users\Christian\Desktop\adwcleaner.exe
2013-06-29 09:19 - 2013-06-29 09:19 - 00000000 ____D C:\_OTL
2013-06-29 08:41 - 2013-06-29 08:41 - 00061838 ____A C:\Users\Familie Achleitner\Desktop\Extras.Txt
2013-06-29 08:39 - 2013-06-29 08:39 - 00099550 ____A C:\Users\Familie Achleitner\Desktop\OTL.Txt
2013-06-29 08:23 - 2013-06-29 08:23 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Desktop\OTL.exe
2013-06-29 08:21 - 2013-06-29 08:21 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Downloads\7478.tmp
2013-06-29 08:18 - 2013-06-29 08:18 - 00000480 ____A C:\Users\Familie Achleitner\Desktop\defogger_disable.log
2013-06-29 08:18 - 2013-06-29 08:18 - 00000000 ____A C:\Users\Christian\defogger_reenable
2013-06-29 08:17 - 2013-05-14 14:22 - 00377856 ____A C:\Users\Familie Achleitner\Desktop\3-gmer_2.1.19163.exe
2013-06-29 08:17 - 2013-05-14 14:21 - 00050477 ____A C:\Users\Familie Achleitner\Desktop\1-Defogger.exe
2013-06-29 08:17 - 2013-05-14 14:00 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Desktop\2-OTL.exe
2013-06-29 08:00 - 2013-06-29 08:00 - 00002315 ____A C:\Users\Christian\Desktop\Search.lnk
2013-06-27 21:06 - 2013-06-27 21:06 - 00002026 ____A C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2013-06-16 03:01 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-16 03:01 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-16 03:01 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-16 03:01 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-16 03:01 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-16 03:01 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-16 03:01 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-16 03:01 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-14 03:05 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-14 03:05 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-14 03:05 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-14 03:05 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-14 03:05 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-14 03:05 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-13 12:12 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 12:12 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-13 12:11 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 12:11 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 12:11 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 12:11 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 12:11 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-13 12:11 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-13 12:11 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-13 12:11 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 12:11 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-13 12:11 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-13 12:11 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 12:11 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-13 12:11 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 12:11 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-13 12:11 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-13 12:11 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-13 12:11 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-02 12:59 - 2013-06-02 12:59 - 00903072 ____A (Oracle Corporation) C:\Users\Familie Achleitner\Downloads\jxpiinstall.exe
2013-05-30 22:13 - 2013-05-30 22:13 - 00282960 ____A C:\Windows\Minidump\053013-39686-01.dmp
==================== One Month Modified Files and Folders =======
2013-06-29 16:25 - 2013-06-29 16:25 - 01933592 ____A (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2013-06-29 16:22 - 2011-03-02 18:05 - 00001172 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003UA.job
2013-06-29 16:18 - 2013-06-29 16:18 - 00890988 ____A C:\Users\Christian\Desktop\SecurityCheck.exe
2013-06-29 16:08 - 2010-09-03 15:41 - 02018415 ____A C:\Windows\WindowsUpdate.log
2013-06-29 16:00 - 2012-11-23 16:56 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 12:50 - 2013-06-29 12:50 - 02347384 ____A (ESET) C:\Users\Christian\Desktop\esetsmartinstaller_enu.exe
2013-06-29 10:57 - 2013-06-29 10:57 - 00011064 ____A C:\Users\Christian\Desktop\Addition.txt
2013-06-29 10:53 - 2013-06-29 10:53 - 00000000 ____D C:\FRST
2013-06-29 10:48 - 2013-06-29 10:48 - 00001761 ____A C:\Users\Christian\Desktop\JRT.txt
2013-06-29 10:47 - 2013-04-26 19:06 - 00000000 ____D C:\Users\Christian\AppData\Local\Pokki
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\JRT
2013-06-29 10:43 - 2009-07-14 06:45 - 00013632 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-29 10:43 - 2009-07-14 06:45 - 00013632 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-29 10:40 - 2013-06-29 10:40 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Christian\Desktop\JRT.exe
2013-06-29 10:36 - 2012-09-20 11:10 - 00000000 ____D C:\Users\Christian\AppData\Local\LogMeIn Hamachi
2013-06-29 10:34 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-29 10:34 - 2009-07-14 06:51 - 00124414 ____A C:\Windows\setupact.log
2013-06-29 10:33 - 2013-06-29 10:32 - 00021220 ____A C:\AdwCleaner[S1].txt
2013-06-29 10:32 - 2013-06-29 10:32 - 00022768 ____A C:\AdwCleaner[R1].txt
2013-06-29 10:31 - 2013-06-29 10:31 - 00648201 ____A C:\Users\Christian\Desktop\adwcleaner.exe
2013-06-29 09:30 - 2012-09-13 19:42 - 00000000 ____D C:\Users\Familie Achleitner\AppData\Local\LogMeIn Hamachi
2013-06-29 09:29 - 2011-12-20 14:11 - 00000000 ____D C:\Program Files\Google
2013-06-29 09:29 - 2011-12-20 14:10 - 00000000 ____D C:\Program Files (x86)\Google
2013-06-29 09:29 - 2010-09-14 11:20 - 00067308 ____A C:\Windows\PFRO.log
2013-06-29 09:19 - 2013-06-29 09:19 - 00000000 ____D C:\_OTL
2013-06-29 09:14 - 2011-12-20 14:10 - 00000000 ____D C:\Users\Christian\AppData\Local\Google
2013-06-29 09:14 - 2011-12-20 14:10 - 00000000 ____D C:\ProgramData\Google
2013-06-29 09:14 - 2011-03-02 18:05 - 00000000 ____D C:\Users\Familie Achleitner\AppData\Local\Google
2013-06-29 08:41 - 2013-06-29 08:41 - 00061838 ____A C:\Users\Familie Achleitner\Desktop\Extras.Txt
2013-06-29 08:39 - 2013-06-29 08:39 - 00099550 ____A C:\Users\Familie Achleitner\Desktop\OTL.Txt
2013-06-29 08:23 - 2013-06-29 08:23 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Desktop\OTL.exe
2013-06-29 08:21 - 2013-06-29 08:21 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Downloads\7478.tmp
2013-06-29 08:18 - 2013-06-29 08:18 - 00000480 ____A C:\Users\Familie Achleitner\Desktop\defogger_disable.log
2013-06-29 08:18 - 2013-06-29 08:18 - 00000000 ____A C:\Users\Christian\defogger_reenable
2013-06-29 08:18 - 2010-09-03 15:41 - 00000000 ____D C:\users\Christian
2013-06-29 08:15 - 2009-07-14 19:58 - 00654150 ____A C:\Windows\System32\perfh007.dat
2013-06-29 08:15 - 2009-07-14 19:58 - 00130022 ____A C:\Windows\System32\perfc007.dat
2013-06-29 08:15 - 2009-07-14 07:13 - 01498742 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-29 08:00 - 2013-06-29 08:00 - 00002315 ____A C:\Users\Christian\Desktop\Search.lnk
2013-06-29 07:47 - 2010-09-03 16:36 - 00000000 ____D C:\Windows\System32\Drivers\Avg
2013-06-27 21:51 - 2009-07-14 07:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-27 21:06 - 2013-06-27 21:06 - 00002026 ____A C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2013-06-27 21:06 - 2011-02-17 19:15 - 00388048 ____A C:\Windows\DPINST.LOG
2013-06-27 21:05 - 2011-01-19 15:32 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-06-27 20:22 - 2011-03-02 18:05 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003Core.job
2013-06-14 04:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-14 03:32 - 2010-09-10 11:18 - 00000000 ____D C:\users\Familie Achleitner
2013-06-14 03:07 - 2010-02-24 12:06 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 12:00 - 2012-11-23 16:56 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-13 12:00 - 2012-11-23 16:56 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-08 16:08 - 2013-06-16 03:01 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-16 03:01 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-16 03:01 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-16 03:01 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-16 03:01 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-16 03:01 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-16 03:01 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:13 - 2013-06-16 03:01 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-02 12:59 - 2013-06-02 12:59 - 00903072 ____A (Oracle Corporation) C:\Users\Familie Achleitner\Downloads\jxpiinstall.exe
2013-05-30 22:13 - 2013-05-30 22:13 - 00282960 ____A C:\Windows\Minidump\053013-39686-01.dmp
2013-05-30 22:13 - 2010-09-13 17:19 - 00000000 ____D C:\Windows\Minidump
2013-05-30 22:12 - 2010-09-13 17:19 - 364272081 ____A C:\Windows\MEMORY.DMP
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-23 10:32
==================== End Of Log ============================
--- --- --- |
|
29.06.2013, 19:07
| #10 |
| /// the machine /// TB-Ausbilder | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) Java, Adobe und Firefox updaten. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.07.2013, 13:44
| #11 |
| |  Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) Hat super geklappt, besten Dank nochmals !!! Schnell und kompetent = Trojaner-board.de - die Nr.1  |
|
01.07.2013, 13:47
| #12 |
| /// the machine /// TB-Ausbilder | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) Dann aufräumen Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.07.2013, 13:56
| #13 |
| | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) Danke nochmals, du kannst das Abo schließen. Bis auf WinPatrol hatte ich bereits alles umgesetzt, jetzt muss ich nur noch meinem Arbeitskollegen die Progs erklären, da es sich nicht um meinen Rechner handelt. Schöne Grüße aus dem sonnigen Salzburg! |
|
01.07.2013, 14:15
| #14 |
| /// the machine /// TB-Ausbilder | Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) |
| babylontoolbar, bho, canon, converter, driverscanner, dvdvideosoft ltd., firefox, flash player, home, homepage, html/iframe.b.gen, iexplore.exe, install.exe, intranet, mp3, nicht möglich, plug-in, pokki, realtek, rundll, security, senden, smartbar, software, starten, svchost.exe, trojan:js/medfos.b, trojaner, win32/lockscreen.aqd, windows |
Textbox. 
Linear-Darstellung
