| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU-Trojaner nach Windowsunlocker noch vorhandenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
03.11.2013, 13:28
| #16 |
| /// TB-Ausbilder   |  GVU-Trojaner nach Windowsunlocker noch vorhanden Hallo, ja das ist nicht so erfreulich. Da scheint noch Banking-Malware (Torpig) zu laufen.  Warnung: InfostealerAus deinen Logs ist ersichtlich, dass du Malware eingefangen hast, die es speziell auf deine sensitiven Daten (Benutzernamen, Passwörter, Onlinebankingzugangsdaten, etc.) abgesehen hat. Man kann nicht genau wissen, was alles mitgeloggt wurde, aber sicherheitshalber würd ich alle auf diesem Rechner eingegebenen Daten und Passwörter als bekannt voraussetzen. Ich würde dir daher raten, zum Schluss oder von einem sauberen Rechner aus sämtliche Zugangsdaten, welche an diesem Rechner verwendet wurden, zu ändern. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\ProgramData\3056
C:\Users\Notebook\AppData\Local\luzhjoa.dll
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2
Schritt 3 Starte noch einmal FRST.
__________________ cheers, Leo |
|
03.11.2013, 15:48
| #17 |
 | GVU-Trojaner nach Windowsunlocker noch vorhandenCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 31-10-2013
Ran by Notebook at 2013-11-03 15:35:28 Run:2
Running from C:\Users\Notebook\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\ProgramData\3056
C:\Users\Notebook\AppData\Local\luzhjoa.dll
*****************
C:\ProgramData\3056 => Moved successfully.
C:\Users\Notebook\AppData\Local\luzhjoa.dll => Moved successfully.
==== End of Fixlog ====
Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff
Log created at 15:42 on 03/11/2013 by Notebook
Administrator - Elevation successful
========== reg ==========
[HKEY_LOCAL_MACHINE\Software\Classes\Directory\Shellex\CopyHookHandlers]
(No values found)
[HKEY_LOCAL_MACHINE\Software\Classes\Directory\Shellex\CopyHookHandlers\FileSystem]
@="{217FC9C0-3AEA-1069-A2DB-08002B30309D}"
[HKEY_LOCAL_MACHINE\Software\Classes\Directory\Shellex\CopyHookHandlers\pukafukpfukpfuapfka]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1882}"
[HKEY_LOCAL_MACHINE\Software\Classes\Directory\Shellex\CopyHookHandlers\qlqlqlqlqlqlqlqlqlq]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1885}"
[HKEY_LOCAL_MACHINE\Software\Classes\Directory\Shellex\CopyHookHandlers\Sharing]
@="{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"
[HKEY_CURRENT_USER\Software\Classes\Directory\Shellex\CopyHookHandlers]
(No values found)
[HKEY_CURRENT_USER\Software\Classes\Directory\Shellex\CopyHookHandlers\fuukaapffuukaapffuu]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1885}"
[HKEY_CURRENT_USER\Software\Classes\Directory\Shellex\CopyHookHandlers\pkaappffuukkaappffu]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1888}"
========== regfind ==========
Searching for "118BEDCA-A901-4203-B4F2-ADCB957D188"
[HKEY_CURRENT_USER\Software\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1885}]
[HKEY_CURRENT_USER\Software\Classes\Directory\Shellex\CopyHookHandlers\fuukaapffuukaapffuu]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1885}"
[HKEY_CURRENT_USER\Software\Classes\Directory\Shellex\CopyHookHandlers\pkaappffuukkaappffu]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1888}"
[HKEY_CURRENT_USER\Software\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1888}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\pukafukpfukpfuapfka]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1882}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\qlqlqlqlqlqlqlqlqlq]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1885}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1882}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1882}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B}]
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000\Software\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1885}]
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000\Software\Classes\Directory\Shellex\CopyHookHandlers\fuukaapffuukaapffuu]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1885}"
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000\Software\Classes\Directory\Shellex\CopyHookHandlers\pkaappffuukkaappffu]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1888}"
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000\Software\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1888}]
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000_Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1885}]
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000_Classes\Directory\Shellex\CopyHookHandlers\fuukaapffuukaapffuu]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1885}"
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000_Classes\Directory\Shellex\CopyHookHandlers\pkaappffuukkaappffu]
@="{118BEDCA-A901-4203-B4F2-ADCB957D1888}"
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000_Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1888}]
Searching for " "
[HKEY_CURRENT_USER\Software\DSS\Product Activation\Readme]
"Readme"="The registry key 'DSS\Product Activation' contains License Information. Please see www.sonydadc.com/digitalworks/productactivation/licenseinformation.html for further information.The following text is reproduced here to comply with OpenSSL license terms: Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. All advertising materials mentioning features or use of this software must display the following acknowledgment: "This product includes softwa
[HKEY_CURRENT_USER\Software\Gabest\Media Player Classic\Shaders]
"0"="sharpen complex 2|ps_2_a|/* Sharpen complex v2 (requires ps >= 2a) */\n\nsampler s0 : register(s0);\nfloat4 p0 : register(c0);\nfloat4 p1 : register(c1);\n\n#define width (p0[0])\n#define height (p0[1])\n\n// "largeur" d'un pixel\n#define px (p1[0])\n#define py (p1[1])\n\n/* Parameters */\n\n// pour le calcul du flou\n#define moyenne 0.6\n#define dx (moyenne*px)\n#define dy (moyenne*py)\n\n#define CoefFlou 2\n#define CoefOri (1+ CoefFlou)\n\n// pour le sharpen\n#define SharpenEdge 0.2\n#define Sharpen_val0 2\n#define Sharpen_val1 ((Sharpen_val0-1) / 8.0)\n\nfloat4 main( float2 tex : TEXCOORD0 ) : COLOR\n{\n\t// recup du pixel original\n\tfloat4 ori = tex2D(s0, tex); ;\n\n\t// calcul image floue (filtre gaussien)\n\tfloat4 c1 = tex2D(s0, tex + float2(-dx,-dy));\n\tfloat4 c2 = tex2D(s0, tex + float2(0,-dy));\n\tfloat4 c3 = tex2D(s0, tex + float2(dx,-dy));\n\tfloat4 c4 = tex2D(s0, tex + float2(-dx,0));\n\tfloat4 c5 = tex2D(s0, tex + float2(dx
[HKEY_CURRENT_USER\Software\Gabest\Media Player Classic\Shaders]
"3"="sharpen complex|ps_2_0|sampler s0 : register(s0);\nfloat4 p1 : register(c1);\n\n#define dx (p1[0])\n#define dy (p1[1])\n\nfloat4 main( float2 tex : TEXCOORD0 ) : COLOR\n{\n\t// definition des pixels : original, flouté, corigé, final\n\tfloat4 ori;\n\tfloat4 flou;\n\tfloat4 cori;\n\tfloat4 final;\n\n\t// récuppération de la matrice de 9 points\n\t// [ 1, 2 , 3 ]\n\t// [ 4,ori, 5 ]\n\t// [ 6, 7 , 8 ]\n\n\tori = tex2D(s0, tex);\n\tfloat4 c1 = tex2D(s0, tex + float2(-dx,-dy));\n\tfloat4 c2 = tex2D(s0, tex + float2(0,-dy));\n\tfloat4 c3 = tex2D(s0, tex + float2(dx,-dy));\n\tfloat4 c4 = tex2D(s0, tex + float2(-dx,0));\n\tfloat4 c5 = tex2D(s0, tex + float2(dx,0));\n\tfloat4 c6 = tex2D(s0, tex + float2(-dx,dy));\n\tfloat4 c7 = tex2D(s0, tex + float2(0,dy));\n\tfloat4 c8 = tex2D(s0, tex + float2(dx,dy));\n\n\t// calcul image floue (filtre gaussien)\n\t// pour normaliser les valeurs, il faut diviser par la somme des coef\n\t// 1/(1+2+1+2+4+2+1+2+1)
[HKEY_CURRENT_USER\Software\Gabest\Media Player Classic\Shaders]
"9"="denoise|ps_3_0|sampler s0 : register(s0);\nfloat4 p0 : register(c0);\n\n#define width (p0[0])\n#define height (p0[1])\n\n#define val0 (1.0)\n#define val1 (0.125) \n\n#define effect_width (0.1)\n\nfloat4 main(float2 tex : TEXCOORD0) : COLOR\n{\t\n\tfloat dx = 0.0f;\n\tfloat dy = 0.0f;\n \tfloat fTap = effect_width;\n\n\tfloat4 cAccum = tex2D(s0, tex) * val0;\n\n\tfor ( int iDx = 0 ; iDx < 16; ++iDx )\n\t{\n\t\tdx = fTap /width; \n\t dy = fTap /height; \n\n\t\tcAccum += tex2D(s0, tex + float2(-dx,-dy)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(0,-dy)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(-dx,0)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(dx,0)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(0,dy)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(dx,dy)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(-dx,+dy)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(+dx,-dy)) * val1;\n \n\t\tfTap += 0.1f;\n\t}\n\t\n\treturn(cAccum/1
[HKEY_CURRENT_USER\Software\Gabest\Media Player Classic\Shaders]
"20"="edge sharpen|ps_2_0|sampler s0 : register(s0); \nfloat4 p0 : register(c0); \n\n#define width (p0[0]) \n#define height (p0[1]) \n\n#define NbPixel 1 \n\n#define Edge_threshold 0.2 \n\n#define Sharpen_val0 2.0 \n#define Sharpen_val1 0.125 \n\nfloat4 main(float2 tex : TEXCOORD0) : COLOR \n{ \n// taille de NbPixel pixels \nfloat dx = NbPixel/width; \nfloat dy = NbPixel/height; \nfloat4 Res = 0; \n\n// Détection de contour par Prewitt \n // récuppération des 9 points \n // [ 1, 2, 3 ] \n // [ 4, 0, 5 ] \n // [ 6, 7, 8 ] \n float4 c0 = tex2D(s0, tex); \n float4 c1 = tex2D(s0, tex + float2(-dx,-dy)); \n float4 c2 = tex2D(s0, tex + float2(0,-dy)); \n float4 c3 = tex2D(s0, tex + float2(dx,-dy)); \n float4 c4 = tex2D(s0, tex + float2(-dx,0)); \n float4 c5 = tex2D(s0, tex + float2(dx,0)); \n float4 c6 = tex2D(s0, tex + float2(-dx,dy)); \n float4 c7 = tex2D(s0, tex + float2(0,dy)); \n float4 c8 =
[HKEY_CURRENT_USER\Software\Nero\Nero 9\Nero Burning ROM\Recorder]
"Name"="MATSHITA BD-CMB UJ-120 "
[HKEY_CURRENT_USER\Software\Nero\Nero 9\Nero Burning ROM\SourceDrive]
"Name"="DAVE NG16BCDE "
[HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System]
"SystemBiosVersion"="DELL - 6040000 Ver 1.00PARTTBL"
[HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0]
"ProcessorNameString"="Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1]
"ProcessorNameString"="Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{09983440-F796-4D6D-B554-D557EAABF428}\1.0]
@="Not Public. Internal interface used by Windows Media Player."
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{09983440-F796-4D6D-B554-D557EAABF428}\1.0]
@="Not Public. Internal interface used by Windows Media Player."
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{2CCF5A37-9DDF-464B-9C13-A380F0F7286B}]
"RatingsInfo"="<Ratings xmlns="urn:schemas-microsoft-com:GameDescription.v1">
<Rating ratingSystemID="{EC290BBB-D618-4cb9-9963-1CAAE515443E}" ratingID="{068D40C4-7809-4c67-8FEA-DA457CF990B4}"/>
<Rating ratingSystemID="{768BD93D-63BE-46A9-8994-0B53C4B5248F}" ratingID="{9DD9B30C-E89F-4d1c-AEC4-174D7432C39B}">
<Descriptor descriptorID="{D65663FB-D977-4641-A742-5B47E6D8B81C}"/>
<Descriptor descriptorID="{1A796A5D-1E25-4862-9443-1550578FF4C4}"/>
<Descriptor descriptorID="{B54162A2-F67F-46dc-9ED5-F6067520EC94}"/>
<Descriptor descriptorID="{7E0BC004-F80B-402d-A1FC-5FCDFF04DAB1}"/>
</Rating>
<Rating ratingSystemID="{C705DCF4-6AFE-4f4f-BC51-21807E4E5CFB}" ratingID="{9236ED52-B5FE-4227-8EB3-353C0BDABECF}"/>
<Rating ratingSystemID="{36798944-B235-48ac-BF21-E25671F597EE}" rati
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA71301B744BA0000000010\InstallProperties]
"Comments"=" "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"=" <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> <Capability Type="Shell"/> </Resource> </Res
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idle thread tha
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Superfetch\DiskAssessment]
"PeakTransferMBsPerSecond"=" 68.7012354147"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time]
"Dlt"="Mitteleuropäische Sommerzeit "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time]
"Std"="Mitteleuropäische Zeit "
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1031-7B44-AB0000000001}]
"Comments"=" "
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32]
"ConfigXML"="<PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell32" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" Architecture="32" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time]
"Dlt"="Mitteleuropäische Sommerzeit "
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time]
"Std"="Mitteleuropäische Zeit "
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{09983440-F796-4D6D-B554-D557EAABF428}\1.0]
@="Not Public. Internal interface used by Windows Media Player."
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MPDEV]
"MPIOSupportedDeviceList"="Vendor 8Product 16"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\GenuineIntel_-_Intel64_Family_6_Model_23_-_Intel(R)_Core(TM)2_Duo_CPU_____T6400__@_2.00GHz\_0]
"FriendlyName"="Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\GenuineIntel_-_Intel64_Family_6_Model_23_-_Intel(R)_Core(TM)2_Duo_CPU_____T6400__@_2.00GHz\_1]
"FriendlyName"="Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_CN_MEMORY&REV_1100#AA04012700008412&0#]
"Mfg"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_CN_MEMORY&REV_1100#AA04012700008412&0#]
"DeviceDesc"="Cn Memory "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_USB_FLASH_MEMORY&REV_1.00#0702201756431&0#]
"Mfg"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_ACTIONS&PROD_MD_83078&REV_2.00#6&14A1315&0&________&0#]
"DeviceDesc"="MD 83078 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_BUFFALO&PROD_CLIPDRIVE&REV_1.00#A3200510110000101&0#]
"DeviceDesc"="ClipDrive "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07#BB1D038D&0#]
"DeviceDesc"="Flash Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07#C7FCAE36&0#]
"DeviceDesc"="Flash Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MULTI-CARD&REV_1.00#00000#]
"DeviceDesc"="Multi-Card "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MULTI-CARD&REV_1.00#20071114173400000&0#]
"DeviceDesc"="Multi-Card "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_HUAWEI&PROD_MMC_STORAGE&REV_2.31#7&2DA26996&0#]
"DeviceDesc"="MMC Storage "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_HUAWEI&PROD_MMC_STORAGE&REV_2.31#7&5D2FE3E&0#]
"DeviceDesc"="MMC Storage "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_HUAWEI&PROD_MMC_STORAGE&REV_2.31#7&F255F86&0#]
"DeviceDesc"="MMC Storage "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_INTENSO&PROD_RAINBOW&REV_#11101100015208&0#]
"DeviceDesc"="Rainbow "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_4GB&REV_1100#6&BB505FE&0#]
"DeviceDesc"="Transcend 4GB "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#35151113C7034983&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_TAKEMS&PROD_COLORLINE&REV_8.07#EB4DB588&0#]
"DeviceDesc"="colorline "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USB&PROD_FLASH_DISK&REV_1100#FBF1101120504474&0#]
"Mfg"="USB "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USB&PROD_FLASH_DISK&REV_1100#FBF1101120504474&0#]
"DeviceDesc"="Flash Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_UT165&PROD_USB_FLASH_DISK&REV_0.00#0000000000AC21&0#]
"Mfg"="Ut165 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_VERBATIM&PROD_STORE_N_GO&REV_5.00#07920B7B1434&0#]
"DeviceDesc"="STORE N GO "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cdrom]
"AutoRunAlwaysDisable"="NEC MBR-7 NEC MBR-7.4 PIONEER CHANGR DRM-1804X PIONEER CD-ROM DRM-6324X PIONEER CD-ROM DRM-624X TORiSAN CD-ROM CDR_C36"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msdsm\Parameters]
"DsmSupportedDeviceList"="Vendor 8Product 16"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\MPDEV]
"MPIOSupportedDeviceList"="Vendor 8Product 16"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\GenuineIntel_-_Intel64_Family_6_Model_23_-_Intel(R)_Core(TM)2_Duo_CPU_____T6400__@_2.00GHz\_0]
"FriendlyName"="Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\GenuineIntel_-_Intel64_Family_6_Model_23_-_Intel(R)_Core(TM)2_Duo_CPU_____T6400__@_2.00GHz\_1]
"FriendlyName"="Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_CN_MEMORY&REV_1100#AA04012700008412&0#]
"Mfg"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_CN_MEMORY&REV_1100#AA04012700008412&0#]
"DeviceDesc"="Cn Memory "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_USB_FLASH_MEMORY&REV_1.00#0702201756431&0#]
"Mfg"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_ACTIONS&PROD_MD_83078&REV_2.00#6&14A1315&0&________&0#]
"DeviceDesc"="MD 83078 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_BUFFALO&PROD_CLIPDRIVE&REV_1.00#A3200510110000101&0#]
"DeviceDesc"="ClipDrive "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07#BB1D038D&0#]
"DeviceDesc"="Flash Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07#C7FCAE36&0#]
"DeviceDesc"="Flash Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MULTI-CARD&REV_1.00#00000#]
"DeviceDesc"="Multi-Card "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MULTI-CARD&REV_1.00#20071114173400000&0#]
"DeviceDesc"="Multi-Card "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_HUAWEI&PROD_MMC_STORAGE&REV_2.31#7&2DA26996&0#]
"DeviceDesc"="MMC Storage "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_HUAWEI&PROD_MMC_STORAGE&REV_2.31#7&5D2FE3E&0#]
"DeviceDesc"="MMC Storage "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_HUAWEI&PROD_MMC_STORAGE&REV_2.31#7&F255F86&0#]
"DeviceDesc"="MMC Storage "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_INTENSO&PROD_RAINBOW&REV_#11101100015208&0#]
"DeviceDesc"="Rainbow "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_4GB&REV_1100#6&BB505FE&0#]
"DeviceDesc"="Transcend 4GB "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#35151113C7034983&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_TAKEMS&PROD_COLORLINE&REV_8.07#EB4DB588&0#]
"DeviceDesc"="colorline "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USB&PROD_FLASH_DISK&REV_1100#FBF1101120504474&0#]
"Mfg"="USB "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USB&PROD_FLASH_DISK&REV_1100#FBF1101120504474&0#]
"DeviceDesc"="Flash Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_UT165&PROD_USB_FLASH_DISK&REV_0.00#0000000000AC21&0#]
"Mfg"="Ut165 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_VERBATIM&PROD_STORE_N_GO&REV_5.00#07920B7B1434&0#]
"DeviceDesc"="STORE N GO "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\cdrom]
"AutoRunAlwaysDisable"="NEC MBR-7 NEC MBR-7.4 PIONEER CHANGR DRM-1804X PIONEER CD-ROM DRM-6324X PIONEER CD-ROM DRM-624X TORiSAN CD-ROM CDR_C36"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\msdsm\Parameters]
"DsmSupportedDeviceList"="Vendor 8Product 16"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MPDEV]
"MPIOSupportedDeviceList"="Vendor 8Product 16"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\GenuineIntel_-_Intel64_Family_6_Model_23_-_Intel(R)_Core(TM)2_Duo_CPU_____T6400__@_2.00GHz\_0]
"FriendlyName"="Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\GenuineIntel_-_Intel64_Family_6_Model_23_-_Intel(R)_Core(TM)2_Duo_CPU_____T6400__@_2.00GHz\_1]
"FriendlyName"="Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_CN_MEMORY&REV_1100#AA04012700008412&0#]
"Mfg"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_CN_MEMORY&REV_1100#AA04012700008412&0#]
"DeviceDesc"="Cn Memory "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_USB_FLASH_MEMORY&REV_1.00#0702201756431&0#]
"Mfg"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_ACTIONS&PROD_MD_83078&REV_2.00#6&14A1315&0&________&0#]
"DeviceDesc"="MD 83078 "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_BUFFALO&PROD_CLIPDRIVE&REV_1.00#A3200510110000101&0#]
"DeviceDesc"="ClipDrive "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07#BB1D038D&0#]
"DeviceDesc"="Flash Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07#C7FCAE36&0#]
"DeviceDesc"="Flash Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MULTI-CARD&REV_1.00#00000#]
"DeviceDesc"="Multi-Card "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MULTI-CARD&REV_1.00#20071114173400000&0#]
"DeviceDesc"="Multi-Card "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_HUAWEI&PROD_MMC_STORAGE&REV_2.31#7&2DA26996&0#]
"DeviceDesc"="MMC Storage "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_HUAWEI&PROD_MMC_STORAGE&REV_2.31#7&5D2FE3E&0#]
"DeviceDesc"="MMC Storage "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_HUAWEI&PROD_MMC_STORAGE&REV_2.31#7&F255F86&0#]
"DeviceDesc"="MMC Storage "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_INTENSO&PROD_RAINBOW&REV_#11101100015208&0#]
"DeviceDesc"="Rainbow "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_4GB&REV_1100#6&BB505FE&0#]
"DeviceDesc"="Transcend 4GB "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#35151113C7034983&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_TAKEMS&PROD_COLORLINE&REV_8.07#EB4DB588&0#]
"DeviceDesc"="colorline "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USB&PROD_FLASH_DISK&REV_1100#FBF1101120504474&0#]
"Mfg"="USB "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USB&PROD_FLASH_DISK&REV_1100#FBF1101120504474&0#]
"DeviceDesc"="Flash Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_UT165&PROD_USB_FLASH_DISK&REV_0.00#0000000000AC21&0#]
"Mfg"="Ut165 "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_VERBATIM&PROD_STORE_N_GO&REV_5.00#07920B7B1434&0#]
"DeviceDesc"="STORE N GO "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cdrom]
"AutoRunAlwaysDisable"="NEC MBR-7 NEC MBR-7.4 PIONEER CHANGR DRM-1804X PIONEER CD-ROM DRM-6324X PIONEER CD-ROM DRM-624X TORiSAN CD-ROM CDR_C36"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\msdsm\Parameters]
"DsmSupportedDeviceList"="Vendor 8Product 16"
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000\Software\DSS\Product Activation\Readme]
"Readme"="The registry key 'DSS\Product Activation' contains License Information. Please see www.sonydadc.com/digitalworks/productactivation/licenseinformation.html for further information.The following text is reproduced here to comply with OpenSSL license terms: Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. All advertising materials mentioning features or use of this software must display the following acknow
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000\Software\Gabest\Media Player Classic\Shaders]
"0"="sharpen complex 2|ps_2_a|/* Sharpen complex v2 (requires ps >= 2a) */\n\nsampler s0 : register(s0);\nfloat4 p0 : register(c0);\nfloat4 p1 : register(c1);\n\n#define width (p0[0])\n#define height (p0[1])\n\n// "largeur" d'un pixel\n#define px (p1[0])\n#define py (p1[1])\n\n/* Parameters */\n\n// pour le calcul du flou\n#define moyenne 0.6\n#define dx (moyenne*px)\n#define dy (moyenne*py)\n\n#define CoefFlou 2\n#define CoefOri (1+ CoefFlou)\n\n// pour le sharpen\n#define SharpenEdge 0.2\n#define Sharpen_val0 2\n#define Sharpen_val1 ((Sharpen_val0-1) / 8.0)\n\nfloat4 main( float2 tex : TEXCOORD0 ) : COLOR\n{\n\t// recup du pixel original\n\tfloat4 ori = tex2D(s0, tex); ;\n\n\t// calcul image floue (filtre gaussien)\n\tfloat4 c1 = tex2D(s0, tex + float2(-dx,-dy));\n\tfloat4 c2 = tex2D(s0, tex + float2(0,-dy));\n\tfloat4 c3 = tex2D(s0, tex + float2(dx,-dy));\n\tfloat4 c4 = tex2D(s0, tex + float2(-dx,0));\n
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000\Software\Gabest\Media Player Classic\Shaders]
"3"="sharpen complex|ps_2_0|sampler s0 : register(s0);\nfloat4 p1 : register(c1);\n\n#define dx (p1[0])\n#define dy (p1[1])\n\nfloat4 main( float2 tex : TEXCOORD0 ) : COLOR\n{\n\t// definition des pixels : original, flouté, corigé, final\n\tfloat4 ori;\n\tfloat4 flou;\n\tfloat4 cori;\n\tfloat4 final;\n\n\t// récuppération de la matrice de 9 points\n\t// [ 1, 2 , 3 ]\n\t// [ 4,ori, 5 ]\n\t// [ 6, 7 , 8 ]\n\n\tori = tex2D(s0, tex);\n\tfloat4 c1 = tex2D(s0, tex + float2(-dx,-dy));\n\tfloat4 c2 = tex2D(s0, tex + float2(0,-dy));\n\tfloat4 c3 = tex2D(s0, tex + float2(dx,-dy));\n\tfloat4 c4 = tex2D(s0, tex + float2(-dx,0));\n\tfloat4 c5 = tex2D(s0, tex + float2(dx,0));\n\tfloat4 c6 = tex2D(s0, tex + float2(-dx,dy));\n\tfloat4 c7 = tex2D(s0, tex + float2(0,dy));\n\tfloat4 c8 = tex2D(s0, tex + float2(dx,dy));\n\n\t// calcul image floue (filtre gaussien)\n\t// pour normaliser les valeurs, il faut diviser par la somm
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000\Software\Gabest\Media Player Classic\Shaders]
"9"="denoise|ps_3_0|sampler s0 : register(s0);\nfloat4 p0 : register(c0);\n\n#define width (p0[0])\n#define height (p0[1])\n\n#define val0 (1.0)\n#define val1 (0.125) \n\n#define effect_width (0.1)\n\nfloat4 main(float2 tex : TEXCOORD0) : COLOR\n{\t\n\tfloat dx = 0.0f;\n\tfloat dy = 0.0f;\n \tfloat fTap = effect_width;\n\n\tfloat4 cAccum = tex2D(s0, tex) * val0;\n\n\tfor ( int iDx = 0 ; iDx < 16; ++iDx )\n\t{\n\t\tdx = fTap /width; \n\t dy = fTap /height; \n\n\t\tcAccum += tex2D(s0, tex + float2(-dx,-dy)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(0,-dy)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(-dx,0)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(dx,0)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(0,dy)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(dx,dy)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(-dx,+dy)) * val1;\n\t\tcAccum += tex2D(s0, tex + float2(+dx,-dy)) * val1;\n \n\t\tfTa
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000\Software\Gabest\Media Player Classic\Shaders]
"20"="edge sharpen|ps_2_0|sampler s0 : register(s0); \nfloat4 p0 : register(c0); \n\n#define width (p0[0]) \n#define height (p0[1]) \n\n#define NbPixel 1 \n\n#define Edge_threshold 0.2 \n\n#define Sharpen_val0 2.0 \n#define Sharpen_val1 0.125 \n\nfloat4 main(float2 tex : TEXCOORD0) : COLOR \n{ \n// taille de NbPixel pixels \nfloat dx = NbPixel/width; \nfloat dy = NbPixel/height; \nfloat4 Res = 0; \n\n// Détection de contour par Prewitt \n // récuppération des 9 points \n // [ 1, 2, 3 ] \n // [ 4, 0, 5 ] \n // [ 6, 7, 8 ] \n float4 c0 = tex2D(s0, tex); \n float4 c1 = tex2D(s0, tex + float2(-dx,-dy)); \n float4 c2 = tex2D(s0, tex + float2(0,-dy)); \n float4 c3 = tex2D(s0, tex + float2(dx,-dy)); \n float4 c4 = tex2D(s0, tex + float2(-dx,0)); \n float4 c5 = tex2D(s0, tex + float2(dx,0)); \n float4 c6 = tex2D(s0, tex + float2(-dx,dy)); \n float4 c7 = tex2D(s0
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000\Software\Nero\Nero 9\Nero Burning ROM\Recorder]
"Name"="MATSHITA BD-CMB UJ-120 "
[HKEY_USERS\S-1-5-21-300217975-2781022776-3715872198-1000\Software\Nero\Nero 9\Nero Burning ROM\SourceDrive]
"Name"="DAVE NG16BCDE "
-= EOF =-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Notebook (administrator) on NOTEBOOK-69 on 03-11-2013 15:44:07
Running from C:\Users\Notebook\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winamp.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8114720 2009-09-16] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1814312 2009-08-14] (Synaptics Incorporated)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
MountPoints2: F - F:\AutoRun.exe
MountPoints2: I - I:\LaunchU3.exe -a
MountPoints2: {6018f0c1-97ef-11e0-a277-00222004b4a7} - F:\AutoRun.exe
MountPoints2: {6018f0c6-97ef-11e0-a277-00222004b4a7} - F:\AutoRun.exe
MountPoints2: {7e155d08-be4c-11e0-9d52-811ae6e2aa6c} - H:\AutoRun.exe
MountPoints2: {7e155d0c-be4c-11e0-9d52-811ae6e2aa6c} - F:\AutoRun.exe
MountPoints2: {877ce8e2-be20-11e0-a5df-ff55a6ef1b7e} - F:\AutoRun.exe
MountPoints2: {877ce8fe-be20-11e0-a5df-ff55a6ef1b7e} - F:\AutoRun.exe
MountPoints2: {877ce92b-be20-11e0-a5df-f0ef8b26f925} - F:\AutoRun.exe
MountPoints2: {ef2d4a44-afe1-11e0-917d-00222004b4a7} - F:\AutoRun.exe
MountPoints2: {ef2d4a4f-afe1-11e0-917d-00222004b4a7} - F:\AutoRun.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2011-04-08] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
==================== Internet (Whitelisted) ====================
URLSearchHook: HKCU - (No Name) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKCU - No Name - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Notebook\AppData\Roaming\Mozilla\Firefox\Profiles\oyji5x3g.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.732 - C:\Program Files (x86)\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.732 - C:\Program Files (x86)\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 - C:\Users\Notebook\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1101262-0-npoctoshape.dll (Octoshape ApS)
FF Plugin HKCU: @www.flatcast.com/FlatViewer 5.2 - C:\PROGRA~2\Opera\program\plugins\NpFv530.dll (1 mal 1 Software GmbH)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
==================== Services (Whitelisted) =================
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2012-12-19] (Nitro PDF Software)
S3 AdobeFlashPlayerUpdateSvc; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [x]
==================== Drivers (Whitelisted) ====================
S3 hcw17bda; C:\Windows\System32\drivers\hcw17bda.sys [67456 2010-01-27] (Hauppauge Computer Works, Inc.)
R3 RSUSBSTOR; C:\Windows\SysWow64\Drivers\RtsUStor.sys [225280 2010-01-23] (Realtek Semiconductor Corp.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-04-29] ()
S2 eamonm; system32\DRIVERS\eamonm.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-03 15:31 - 2013-09-26 17:46 - 00000000 ____D C:\Users\Notebook\Desktop\Berserker
2013-11-03 12:14 - 2013-10-12 01:16 - 00000000 ____D C:\Users\Notebook\Desktop\STAGE BOTTLES - FAIR ENOUGH -2013
2013-11-03 10:48 - 2013-11-01 15:54 - 04121952 _____ (Kaspersky Lab ZAO) C:\Users\Notebook\Desktop\TDSSKiller.exe
2013-11-03 10:43 - 2013-11-03 15:43 - 00071380 _____ C:\Users\Notebook\Desktop\SystemLook.txt
2013-11-03 10:42 - 2013-11-03 10:42 - 00165376 _____ C:\Users\Notebook\Desktop\SystemLook_x64.exe
2013-10-31 22:51 - 2013-10-31 22:51 - 00000000 ____D C:\Program Files (x86)\ESET
2013-10-31 22:11 - 2013-10-31 22:11 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-31 21:45 - 2013-10-31 21:47 - 00000000 ____D C:\AdwCleaner
2013-10-31 21:45 - 2013-10-31 21:45 - 01060070 _____ C:\Users\Notebook\Desktop\adwcleaner.exe
2013-10-31 21:10 - 2013-10-31 21:37 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Winamp
2013-10-31 21:10 - 2013-10-31 21:10 - 00000000 ____D C:\Program Files (x86)\Winamp
2013-10-31 20:40 - 2013-10-31 20:40 - 01957098 _____ (Farbar) C:\Users\Notebook\Desktop\FRST64.exe
2013-10-25 17:59 - 2013-10-25 17:59 - 00000000 ____D C:\FRST
2013-10-18 22:06 - 2013-10-18 22:06 - 00000071 _____ C:\Windows\SysWOW64\.directory
2013-10-17 21:26 - 2013-10-19 08:04 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0
2013-10-09 16:23 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-09 16:23 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-09 16:23 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-09 16:23 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-09 16:23 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-09 16:23 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-09 16:23 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-09 16:23 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-09 16:23 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-09 16:23 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-09 16:23 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-09 16:23 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-09 16:23 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-09 16:23 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-09 16:23 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-09 16:23 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-09 16:23 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-09 16:23 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-09 16:23 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-09 16:23 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-09 16:23 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-09 16:23 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-09 16:23 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-09 16:23 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-09 16:23 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-09 16:23 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-09 16:23 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-09 16:23 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-09 16:22 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-09 16:22 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-09 16:22 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 13:53 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-09 13:53 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-09 13:53 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-09 13:53 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-09 13:53 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-09 13:53 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-09 13:53 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-09 13:53 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 13:53 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 13:53 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 13:53 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 13:53 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-09 13:53 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 13:53 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 13:53 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-09 13:53 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 13:53 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 13:53 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 13:53 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 13:53 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 13:53 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 13:53 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-09 13:53 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-09 13:53 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-09 13:53 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-09 13:53 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 13:53 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-09 13:53 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-09 13:53 - 2012-11-28 23:56 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2013-10-09 13:53 - 2012-11-28 23:56 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2013-10-09 13:53 - 2012-11-28 23:56 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2013-10-04 20:09 - 2013-10-04 20:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2013-11-03 15:43 - 2013-11-03 10:43 - 00071380 _____ C:\Users\Notebook\Desktop\SystemLook.txt
2013-11-03 15:26 - 2012-04-20 14:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-03 15:00 - 2010-11-24 15:04 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-03 13:43 - 2013-08-20 18:29 - 00001917 ___SH C:\ProgramData\e529bfc3-c17a-4d79-b236-8b5a5d266fad
2013-11-03 10:55 - 2009-07-14 18:58 - 00645740 _____ C:\Windows\system32\perfh007.dat
2013-11-03 10:55 - 2009-07-14 18:58 - 00127028 _____ C:\Windows\system32\perfc007.dat
2013-11-03 10:55 - 2009-07-14 06:13 - 01472002 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-03 10:55 - 2009-07-14 05:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-03 10:55 - 2009-07-14 05:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-03 10:51 - 2010-11-24 15:04 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-03 10:51 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\sysprep
2013-11-03 10:50 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-03 10:50 - 2009-07-14 05:51 - 00177020 _____ C:\Windows\setupact.log
2013-11-03 10:49 - 2010-04-28 18:17 - 01515706 _____ C:\Windows\WindowsUpdate.log
2013-11-03 10:42 - 2013-11-03 10:42 - 00165376 _____ C:\Users\Notebook\Desktop\SystemLook_x64.exe
2013-11-01 15:54 - 2013-11-03 10:48 - 04121952 _____ (Kaspersky Lab ZAO) C:\Users\Notebook\Desktop\TDSSKiller.exe
2013-11-01 08:32 - 2011-10-03 09:42 - 00000000 ____D C:\Users\Notebook\Desktop\oi
2013-11-01 08:32 - 2011-10-01 11:16 - 00000000 ____D C:\Users\Notebook\Desktop\Bilder ungeordnet
2013-11-01 08:29 - 2010-09-13 15:55 - 00000000 ____D C:\Users\Notebook\Desktop\Backup
2013-11-01 08:09 - 2012-12-24 12:49 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Nitro PDF
2013-11-01 08:04 - 2010-11-17 17:17 - 00000000 ____D C:\Users\Notebook\Desktop\F.C. Hansa Rostock
2013-11-01 08:01 - 2011-01-11 15:43 - 00000000 ____D C:\Users\Notebook\Desktop\Hitfaker 0.2b
2013-10-31 23:29 - 2011-08-15 07:42 - 00001033 _____ C:\Users\Notebook\Desktop\casual.txt
2013-10-31 22:51 - 2013-10-31 22:51 - 00000000 ____D C:\Program Files (x86)\ESET
2013-10-31 22:26 - 2010-04-28 18:24 - 00036112 _____ C:\Windows\PFRO.log
2013-10-31 22:12 - 2011-08-06 13:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-31 22:11 - 2013-10-31 22:11 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-31 21:47 - 2013-10-31 21:45 - 00000000 ____D C:\AdwCleaner
2013-10-31 21:45 - 2013-10-31 21:45 - 01060070 _____ C:\Users\Notebook\Desktop\adwcleaner.exe
2013-10-31 21:37 - 2013-10-31 21:10 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Winamp
2013-10-31 21:10 - 2013-10-31 21:10 - 00000000 ____D C:\Program Files (x86)\Winamp
2013-10-31 20:40 - 2013-10-31 20:40 - 01957098 _____ (Farbar) C:\Users\Notebook\Desktop\FRST64.exe
2013-10-31 20:34 - 2010-04-29 08:47 - 00000000 ____D C:\Program Files (x86)\DivX
2013-10-31 20:29 - 2013-02-25 18:58 - 00000000 ____D C:\ProgramData\Origin
2013-10-31 20:28 - 2010-08-30 09:50 - 00000000 ____D C:\Windows\system32\appmgmt
2013-10-31 20:20 - 2010-06-09 17:50 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Skype
2013-10-31 20:19 - 2010-06-09 17:50 - 00000000 ____D C:\ProgramData\Skype
2013-10-31 20:06 - 2010-05-12 15:21 - 00000000 ____D C:\ProgramData\Nero
2013-10-31 19:54 - 2011-06-16 09:07 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-10-31 19:25 - 2010-06-30 13:07 - 00000000 ____D C:\ProgramData\Adobe
2013-10-31 19:24 - 2010-06-30 13:07 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-10-31 19:22 - 2010-08-28 18:56 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-31 19:10 - 2010-04-29 08:45 - 00000000 ____D C:\ProgramData\DivX
2013-10-30 22:55 - 2010-11-24 15:04 - 00004110 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-30 22:55 - 2010-11-24 15:04 - 00003858 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-28 16:41 - 2010-04-28 18:20 - 00000000 ___RD C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-25 17:59 - 2013-10-25 17:59 - 00000000 ____D C:\FRST
2013-10-19 08:04 - 2013-10-17 21:26 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0
2013-10-18 22:06 - 2013-10-18 22:06 - 00000071 _____ C:\Windows\SysWOW64\.directory
2013-10-12 01:16 - 2013-11-03 12:14 - 00000000 ____D C:\Users\Notebook\Desktop\STAGE BOTTLES - FAIR ENOUGH -2013
2013-10-09 17:26 - 2012-04-20 14:26 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-09 16:31 - 2009-07-14 05:45 - 04968920 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-09 16:25 - 2010-06-25 12:56 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-09 16:21 - 2013-03-13 17:35 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-09 16:21 - 2013-03-13 17:35 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-09 16:19 - 2013-08-14 14:59 - 00000000 ____D C:\Windows\system32\MRT
2013-10-09 16:17 - 2009-10-14 06:12 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-06 18:51 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-10-06 18:12 - 2013-08-20 18:12 - 00000000 ____D C:\ProgramData\6772d2f8-6c8a-4151-a5d7-0b3336329b43
2013-10-06 15:40 - 2013-01-09 22:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-04 21:15 - 2010-04-30 09:35 - 00000000 ____D C:\Users\Notebook\AppData\Local\Mozilla
2013-10-04 20:10 - 2013-10-04 20:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
Some content of TEMP:
====================
C:\Users\Notebook\AppData\Local\Temp\install_flashplayer11x32au_mssd_aaa_aih.exe
C:\Users\Notebook\AppData\Local\Temp\Quarantine.exe
C:\Users\Notebook\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-01 01:48
==================== End Of Log ============================
|
|
03.11.2013, 15:59
| #18 |
| /// TB-Ausbilder | GVU-Trojaner nach Windowsunlocker noch vorhanden Ok.
__________________Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter REG: reg delete "HKLM\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\pukafukpfukpfuapfka" /f
REG: reg delete "HKLM\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\qlqlqlqlqlqlqlqlqlq" /f
REG: reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1882}" /f
REG: reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B}" /f
REG: reg delete "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1882}" /f
REG: reg delete "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B}" /f
REG: reg delete "HKCU\Software\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1885}" /f
REG: reg delete "HKCU\Software\Classes\Directory\Shellex\CopyHookHandlers\fuukaapffuukaapffuu" /f
REG: reg delete "HKCU\Software\Classes\Directory\Shellex\CopyHookHandlers\pkaappffuukkaappffu" /f
REG: reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1888}" /f
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Starte bitte den Rechner neu auf und mach dann nochmals einen Scan mit dem ESET Online Scanner: ESET Online Scanner
__________________ |
|
03.11.2013, 19:08
| #19 |
| | GVU-Trojaner nach Windowsunlocker noch vorhanden Eigentlich muss das alles nur soweit entfernt werden, damit beim anstecken meiner externen Festplatte nichts durchgeschleust wird. Ich will die Tage den Rechner eh formatieren. Da müssten doch die Trojaner auch verschwinden oder??? Ich habe halt nur die Befürchtung, dass ich die Trojaner beim Anschließen der Platte mitführe. Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 31-10-2013
Ran by Notebook at 2013-11-03 16:17:52 Run:3
Running from C:\Users\Notebook\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
REG: reg delete "HKLM\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\pukafukpfukpfuapfka" /f
REG: reg delete "HKLM\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\qlqlqlqlqlqlqlqlqlq" /f
REG: reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1882}" /f
REG: reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B}" /f
REG: reg delete "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1882}" /f
REG: reg delete "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B}" /f
REG: reg delete "HKCU\Software\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1885}" /f
REG: reg delete "HKCU\Software\Classes\Directory\Shellex\CopyHookHandlers\fuukaapffuukaapffuu" /f
REG: reg delete "HKCU\Software\Classes\Directory\Shellex\CopyHookHandlers\pkaappffuukkaappffu" /f
REG: reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1888}" /f
*****************
========= reg delete "HKLM\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\pukafukpfukpfuapfka" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKLM\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\qlqlqlqlqlqlqlqlqlq" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1882}" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B}" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1882}" /f =========
FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.
========= End of Reg: =========
========= reg delete "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B}" /f =========
FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.
========= End of Reg: =========
========= reg delete "HKCU\Software\Classes\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1885}" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKCU\Software\Classes\Directory\Shellex\CopyHookHandlers\fuukaapffuukaapffuu" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKCU\Software\Classes\Directory\Shellex\CopyHookHandlers\pkaappffuukkaappffu" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D1888}" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
==== End of Fixlog ====
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1f89de6b73d5064084aa5a7d3dba995d
# engine=15715
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-01 12:03:46
# local_time=2013-11-01 01:03:46 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 10024 134894076 0 0
# scanned=262454
# found=9
# cleaned=0
# scan_time=7817
sh=82E6712B7E2BCD3291A4E2776C96874C79590739 ft=1 fh=2a94c3d6301eefdf vn="a variant of Win32/Kryptik.BMIA trojan" ac=I fn="C:\FRST\Quarantine\9jzt727o.plz"
sh=D4DFF355FB830CC1B6F1C72A1D6E97AF91CD891D ft=1 fh=d716849315ce6c6c vn="a variant of Win32/Reveton.W trojan" ac=I fn="C:\FRST\Quarantine\o727tzj9.fki"
sh=F2D2ED1D8D17BF4866DDE8303C56CC7A5ADEFAFE ft=1 fh=b7409d81f1a4c984 vn="Win64/Disabler.A trojan" ac=I fn="C:\FRST\Quarantine\o727tzj9.pzz"
sh=82E6712B7E2BCD3291A4E2776C96874C79590739 ft=1 fh=2a94c3d6301eefdf vn="a variant of Win32/Kryptik.BMIA trojan" ac=I fn="C:\FRST\Quarantine\~tmf5624884265661520678.dll"
sh=7A20A7A5DD9EAED4CC4EB52E8B68778A33F11AE0 ft=1 fh=8370d1c892bdb542 vn="a variant of Win64/Kryptik.DM trojan" ac=I fn="C:\ProgramData\3056\msseedir.dll"
sh=7A20A7A5DD9EAED4CC4EB52E8B68778A33F11AE0 ft=1 fh=8370d1c892bdb542 vn="a variant of Win64/Kryptik.DM trojan" ac=I fn="C:\Users\All Users\3056\msseedir.dll"
sh=393EC0210D594D6E8CB15B724F368B04629515E6 ft=1 fh=dd9fcc09b858bbfb vn="a variant of Win32/TrojanProxy.Agent.NPY trojan" ac=I fn="C:\Users\Notebook\AppData\Local\luzhjoa.dll"
sh=E02CB88A34175E29318903C88E4FC4AF79ADFBCA ft=0 fh=0000000000000000 vn="JS/Agent.NJV trojan" ac=I fn="C:\Users\Notebook\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\STIZPAK0\ww2_hozmail_com[1].htm"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="a variant of Win32/TrojanDownloader.Mebload.BA trojan" ac=I fn="${Memory}"
|
|
03.11.2013, 19:38
| #20 | |||
| /// TB-Ausbilder | GVU-Trojaner nach Windowsunlocker noch vorhandenZitat:
Zitat:
Zitat:
__________________ cheers, Leo |
|
03.11.2013, 19:41
| #21 |
| | GVU-Trojaner nach Windowsunlocker noch vorhanden Wie kann ich rausfinden, ob ich auf der Festplatte eventuell schon Schadsoftware drauf habe? Reicht der Eset Smartinstaller? |
|
03.11.2013, 19:47
| #22 |
| /// TB-Ausbilder | GVU-Trojaner nach Windowsunlocker noch vorhanden Ich hab keine Malware gesehen, die sich auf externe Festplatte ausbreiten würde.. Aber du kannst diese ganz normal mit einem Virenscanner überprüfen (z.B. dem hier eingesetzen ESET Online Scanner).
__________________ cheers, Leo |
|
03.11.2013, 19:48
| #23 |
| | GVU-Trojaner nach Windowsunlocker noch vorhanden Alles klar. Dann besten Dank  |
|
03.11.2013, 19:50
| #24 |
| /// TB-Ausbilder | GVU-Trojaner nach Windowsunlocker noch vorhanden Gerne. Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Ich bekomme somit keine Benachrichtigung mehr über neue Antworten. Solltest du das Thema erneut brauchen, schicke mir bitte eine PM und wir machen hier weiter. Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.
__________________ cheers, Leo |
|
| Themen zu GVU-Trojaner nach Windowsunlocker noch vorhanden |
| abgesicherter, abgesicherter modus, automatisch, chip.de, eingefangen, etliche, funktionier, funktioniert, gefangen, gefunde, gelöscht, gen, gvu-trojaner, modus, rechner, rojaner gefunden, runtergeladen, sich automatisch, trojaner gefunden, variante, vorhanden, windowsunlocker, woche, wochen |
Linear-Darstellung
