|
Plagegeister aller Art und deren Bekämpfung: Mail: Fax von 04589016238 geoeffnet, AVGWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
13.11.2013, 08:22 | #1 |
| Mail: Fax von 04589016238 geoeffnet, AVG Hallo liebe community gestern nach einem langen Arbeitstag hatte ich eine Faxnachricht im Email-Postfach. Hab die geoeffnet, obwohl etwas verwundert, warum ich die Nachricht an meine Email gesendet bekomme; aber ich hatte auch ein Fax angekuendigt bekommen... Na ja, hab natuerlich nicht auf die Endung geachtet und in dem Moment als ich draufclickte fiel es mir erst auf. Dachte gerade darueber nach wie ich die Ausfuehrung der Datei stoppen kann, da meldetet sich der AVG Scanner mit "Bedrohung gefunden". Habe ich gleich entfernen lassen. Da ich mir nicht sicher war, ob wirklich alles weg ist, hatte ich noch einen Scan mit Malwarebyte gemacht und mir dabei - wie andere User vor mir - "Advanced System Protector" und "RegClean Pro" "OpenIT" und "MyBackup" eingefangen. (Jedenfalls glaube ich, dass es mit dem Download zusammenhaengt.) Gestern liessen die sich auch nicht deinstallieren, heute morgen schon. Ich hoffe, dass die nach dem Neustart auch wegbleiben. Der Scan mit Malwarebyte gab ausser den genannten Programmen keine Anmerkungen. Mein Freund war da aber nicht so sicher und meinte dass der bestimmt noch auf dem PC hockt. Die identifizierten Bedrohungen hatte ich entfernt und der Anschliessende Scan brachte keine neuen Infizierungen. Ich habe einen Laptop von lenovo mit Win 7 (urspruenglich XP), Firewall ist Zonealarm und Virenscanner AVG. Was meint ihr: Hat das ausgereicht? Ist der (noch) auf dem PC? Kamen die Programme durch den Download oder durch den Trojaner/Virus auf den PC? Die files kann ich gerne posten. Defogger bin ich grade dran, Scan Tool FRST hoert irgentwann auf, hatte ich jetzt 2 mal. Vielen Dank sum Geändert von sumsemann (13.11.2013 um 08:47 Uhr) |
13.11.2013, 08:50 | #2 |
/// the machine /// TB-Ausbilder | Mail: Fax von 04589016238 geoeffnet, AVG hi,
__________________Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden ).
__________________ |
13.11.2013, 09:52 | #3 |
| Mail: Fax von 04589016238 geoeffnet, AVG Hallo schrauber,
__________________danke fuer die schnelle Rueckmeldung. Hier mein OTL Report (habe aber nur eine File bekommen) Edit: So habe es noch einmal gemacht und nun zwei Files erhalten:OTL Logfile: Code:
ATTFilter OTL logfile created on: 09/11/2013 10:27:07 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = D:\ Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16721) Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy 1.99 Gb Total Physical Memory | 0.90 Gb Available Physical Memory | 45.27% Memory free 3.98 Gb Paging File | 2.44 Gb Available in Paging File | 61.28% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 27.65 Gb Total Space | 0.18 Gb Free Space | 0.66% Space Free | Partition Type: NTFS Drive D: | 46.78 Gb Total Space | 28.85 Gb Free Space | 61.67% Space Free | Partition Type: NTFS Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - D:\OTL.exe (OldTimer Tools) PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (Adobe Systems, Inc.) PRC - C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\AVG\AVG2013\avgnsx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD) PRC - C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD) PRC - C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\AVG\AVG2013\avgcsrvx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\AVG\AVG2013\avgrsx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files\WinZipper\winzipersvc.exe (Taiwan Shui Mu Chih Ching Technology Limited.) PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe (AVG Secure Search) PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe (Check Point Software Technologies, Ltd.) PRC - C:\Program Files\AVG\AVG2013\avgemcx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Program Files\OPENLiMiT\siqSEMr.exe (OPENLiMiT SignCubes GmbH) PRC - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation) PRC - C:\Program Files\Common Files\Nuance\dgnsvc.exe (Nuance Communications, Inc.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.) ========== Modules (No Company Name) ========== MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_9_900_117.dll () MOD - C:\Program Files\Mozilla Firefox\mozjs.dll () ========== Services (SafeList) ========== SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (vsmon) -- C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD) SRV - (avgwd) -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) SRV - (winzipersvc) -- C:\Program Files\WinZipper\winzipersvc.exe (Taiwan Shui Mu Chih Ching Technology Limited.) SRV - (vToolbarUpdater15.3.0) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe (AVG Secure Search) SRV - (sftvsa) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (ZAPrivacyService) -- C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe (Check Point Software Technologies, Ltd.) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (TeamViewer8) -- C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (DragonSvc) -- C:\Program Files\Common Files\Nuance\dgnsvc.exe (Nuance Communications, Inc.) SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.) SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (VClone) -- system32\DRIVERS\VClone.sys File not found DRV - (AVGIDSShim) -- C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o.) DRV - (Avgrkx86) -- C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.) DRV - (Avglogx) -- C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.) DRV - (AVGIDSDriver) -- C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o.) DRV - (AVGIDSHX) -- C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o.) DRV - (Avgldx86) -- C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.) DRV - (Avgmfx86) -- C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.) DRV - (avgtp) -- C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies) DRV - (Sftvol) -- C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation) DRV - (Sftplay) -- C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation) DRV - (Sftredir) -- C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation) DRV - (Sftfs) -- C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation) DRV - (Vsdatant) -- C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD) DRV - (Avgtdix) -- C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.) DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation) DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.) DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation) DRV - (netw5v32) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation) DRV - (e1express) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation) DRV - (silabser) -- C:\Windows\System32\drivers\silabser.sys (Silicon Laboratories) DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.) DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://uk.msn.com/?ocid=iehp IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-GB IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 83 45 C6 7E 64 B4 CD 01 [binary data] IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\..\SearchScopes\{24BF7F8D-2C49-491F-8E48-0FFDFF1F5FD8}: "URL" = hxxp://search.zonealarm.com/search?src=sp&tbid=base2013&Lan=en&q={searchTerms}&gu=a032e0599f8f440b9773e1622ad62add&tu=10GX000652B000c&sku=&tstsId=&ver=&&r=179 IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..extensions.enabledAddons: donottrack%40checkpoint.com:2.2.5.1213 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 24.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 24.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2013/10/08 05:42:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Extensions [2013/11/08 18:16:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\extensions [2013/01/12 12:27:06 | 000,000,000 | ---D | M] (ZoneAlarm Do Not Track) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\extensions\donottrack@checkpoint.com [2012/08/22 15:49:13 | 000,077,464 | ---- | M] () (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\extensions\ciuvo-extension@billiger.de.xpi [2013/01/12 12:23:48 | 000,007,919 | ---- | M] () (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\extensions\donottrack@checkpoint.com\chrome\content\ff\view_expiry.js [2013/10/05 23:50:07 | 000,001,302 | ---- | M] () -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\searchplugins\searchgol.xml [2013/10/05 23:50:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\Extensions [2013/07/03 08:28:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions [2013/07/03 08:28:15 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}, CHR - Extension: Google Docs = C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\ CHR - Extension: Google Drive = C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: Google-Suche = C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: Google Wallet = C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\ CHR - Extension: Google Mail = C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (no name) - {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (no name) - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - No CLSID value found. O3 - HKU\S-1-5-21-167141536-1578239192-4268729921-1000\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found. O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD) O4 - HKU\S-1-5-21-167141536-1578239192-4268729921-1000..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7EB67409-46F2-4DDB-9285-BB57803D27C1}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\linkscanner - No CLSID value found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013/11/09 08:29:06 | 000,000,000 | ---D | C] -- C:\FRST [2013/11/08 18:20:29 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird [2013/11/08 16:47:53 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\Malwarebytes [2013/11/08 16:46:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013/11/08 16:46:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013/11/08 16:46:56 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013/11/08 16:45:51 | 000,000,000 | ---D | C] -- C:\Program Files\MyPC Backup [2013/11/08 16:45:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector [2013/11/08 16:45:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Systweak [2013/11/08 16:43:44 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\Systweak [2013/11/08 16:42:58 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\DigitalSite [2013/10/22 16:50:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG [2013/10/17 16:05:35 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe [2013/10/17 16:05:35 | 000,174,504 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe [2013/10/17 16:05:35 | 000,094,632 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll [2013/10/17 16:05:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java [2013/10/13 17:29:26 | 000,000,000 | --SD | C] -- C:\Users\Owner\Documents\Eigene Datenquellen [2013/10/11 15:07:06 | 002,706,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2013/10/11 15:07:05 | 002,876,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2013/10/11 15:07:04 | 000,039,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2013/10/11 15:07:03 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2013/10/11 15:07:03 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2013/10/11 15:07:02 | 000,493,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2013/10/11 15:07:02 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2013/10/11 15:07:02 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe [2013/10/11 15:07:02 | 000,042,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2013/10/11 15:07:02 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2013/10/11 11:11:42 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\hidclass.sys [2013/10/11 11:11:42 | 000,025,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\hidparse.sys [2013/10/10 23:05:44 | 000,284,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys [2013/10/10 23:05:44 | 000,006,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbd.sys [2013/10/10 21:18:31 | 000,434,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scavengeui.dll [2013/10/10 21:18:19 | 000,102,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll [2013/10/10 21:18:16 | 003,969,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2013/10/10 21:18:16 | 003,914,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2013/10/10 21:18:16 | 000,619,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tdh.dll [2013/10/10 21:18:14 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2013/10/10 21:18:14 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll [2013/10/10 21:18:14 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2013/10/10 21:18:14 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dciman32.dll [2013/10/10 21:16:56 | 002,348,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys ========== Files - Modified Within 30 Days ========== [2013/11/09 09:48:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013/11/09 09:43:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013/11/09 09:43:00 | 000,000,292 | ---- | M] () -- C:\Windows\tasks\DigitalSite.job [2013/11/09 09:01:09 | 000,002,092 | ---- | M] () -- C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk [2013/11/09 07:01:13 | 000,014,032 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/11/09 07:01:13 | 000,014,032 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/11/09 06:59:58 | 000,629,128 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013/11/09 06:59:58 | 000,111,022 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013/11/09 06:53:27 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013/11/09 06:53:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013/11/09 06:53:12 | 1603,084,288 | -HS- | M] () -- C:\hiberfil.sys [2013/11/08 18:09:40 | 309,324,176 | ---- | M] () -- C:\Windows\MEMORY.DMP [2013/11/08 17:43:07 | 000,000,096 | ---- | M] () -- C:\Users\Owner\AppData\Roaming\WB.CFG [2013/11/05 14:55:35 | 000,075,746 | ---- | M] () -- C:\Users\Owner\Desktop\DB BAHN - Verbindungen - Ihre Auskunft.pdf [2013/10/26 20:47:31 | 000,334,452 | ---- | M] () -- C:\Users\Owner\Desktop\TDL11_KurzleitfadenPR_110301.pdf [2013/10/24 07:59:09 | 000,844,479 | ---- | M] () -- C:\Users\Owner\Desktop\LPM_Präsentation.pdf [2013/10/22 16:50:44 | 000,000,987 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk [2013/10/12 00:05:04 | 000,412,720 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013/10/11 09:31:52 | 000,002,261 | ---- | M] () -- C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [2013/10/11 09:31:51 | 000,002,237 | ---- | M] () -- C:\Users\Owner\Desktop\Google Chrome.lnk ========== Files Created - No Company Name ========== [2013/11/08 17:43:07 | 000,000,096 | ---- | C] () -- C:\Users\Owner\AppData\Roaming\WB.CFG [2013/11/08 16:45:06 | 000,017,136 | ---- | C] () -- C:\Windows\System32\sasnative32.exe [2013/11/08 16:43:27 | 000,000,292 | ---- | C] () -- C:\Windows\tasks\DigitalSite.job [2013/11/05 14:55:33 | 000,075,746 | ---- | C] () -- C:\Users\Owner\Desktop\DB BAHN - Verbindungen - Ihre Auskunft.pdf [2013/10/26 20:47:26 | 000,334,452 | ---- | C] () -- C:\Users\Owner\Desktop\TDL11_KurzleitfadenPR_110301.pdf [2013/10/24 07:59:08 | 000,844,479 | ---- | C] () -- C:\Users\Owner\Desktop\LPM_Präsentation.pdf [2013/10/11 09:31:51 | 000,002,237 | ---- | C] () -- C:\Users\Owner\Desktop\Google Chrome.lnk [2013/05/14 10:18:15 | 000,030,050 | ---- | C] () -- C:\Users\Owner\SIGNIERTdatei.p7m [2013/05/14 10:17:50 | 000,024,453 | ---- | C] () -- C:\Users\Owner\datei.html [2013/05/14 09:31:46 | 000,000,512 | ---- | C] () -- C:\Windows\System32\siqP11.dll.sig [2013/05/01 12:43:48 | 000,065,536 | ---- | C] () -- C:\Windows\System32\EZTW32.DLL [2012/07/07 19:58:49 | 000,001,835 | ---- | C] () -- C:\Users\Owner\AppData\Roaming\SAS7_000.DAT [2012/06/18 07:52:51 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2007/11/20 13:14:04 | 000,000,300 | ---- | C] () -- C:\Users\Owner\jSign.ini ========== ZeroAccess Check ========== [2009/07/14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013/07/26 02:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2013/01/11 09:52:08 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software [2013/01/11 09:52:08 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software [2012/11/12 19:23:05 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\APP_NAME_NON_STRING [2013/10/07 06:42:41 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\AVG [2012/12/13 08:03:43 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\AVG2013 [2013/06/29 08:22:25 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\CheckPoint [2013/11/08 18:44:19 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\DigitalSite [2013/05/14 10:06:32 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\eVergabe [2013/05/23 07:13:06 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Foxit Software [2013/10/09 20:19:24 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Notepad++ [2012/06/16 13:20:12 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Nuance [2013/10/23 22:52:07 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\SoftGrid Client [2013/11/08 18:44:19 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Systweak [2012/11/14 11:48:15 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Thunderbird [2012/05/28 13:30:01 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\TP [2013/06/28 09:54:05 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\WinZipper ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 241 bytes -> C:\ProgramData\TEMP:0FF263E8 @Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:0B4227B4 < End of report > und Extas:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 09/11/2013 10:27:07 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = D:\ Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16721) Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy 1.99 Gb Total Physical Memory | 0.90 Gb Available Physical Memory | 45.27% Memory free 3.98 Gb Paging File | 2.44 Gb Available in Paging File | 61.28% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 27.65 Gb Total Space | 0.18 Gb Free Space | 0.66% Space Free | Partition Type: NTFS Drive D: | 46.78 Gb Total Space | 28.85 Gb Free Space | 61.67% Space Free | Partition Type: NTFS Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [HKEY_USERS\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) http [open] -- Reg Error: Key error. https [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- "C:\Program Files\File Type Assistant\tsassist.exe" "%1" (Trusted Software ApS) Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 0 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{09D8C92E-2A34-4739-9064-5036C1BA54DA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{0F5E16F3-649F-41C1-BC13-2684AE9463B4}" = lport=10243 | protocol=6 | dir=in | app=system | "{10619E3E-A39F-4865-83C2-3F27CC708C2B}" = rport=139 | protocol=6 | dir=out | app=system | "{1BA8BFDB-4F73-4431-BD7B-753BFB4F8B16}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{29761FC8-3DFE-46C8-A2A9-C379E94F3137}" = lport=2869 | protocol=6 | dir=in | app=system | "{34ED0FD6-EF26-42E0-B42B-C2420A7054B9}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{43D423D4-CA68-4430-84CD-27F7A5B78BBE}" = rport=137 | protocol=17 | dir=out | app=system | "{49C704EA-FACD-4B02-8588-33510B4BACFB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{4F1321F1-94DC-4C1D-82F0-63DE418EFE11}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{5192CA0E-D1E1-43EB-A8E7-407CD164CE47}" = rport=445 | protocol=6 | dir=out | app=system | "{5479E36C-ACEC-434B-AE2E-26D9EBDD052C}" = rport=10243 | protocol=6 | dir=out | app=system | "{56B35BA3-9D3E-44DF-A694-CE3DC4B24271}" = lport=445 | protocol=6 | dir=in | app=system | "{5E8280D2-CF4D-4817-AC7E-9DB81D1EEDA0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{609DA35E-C718-4803-873F-3F6D357AC7B5}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{680CC5F1-106B-4BD5-80AD-5492BDC7FEAF}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{7226F440-0815-47BD-B32A-E9CB38CCF54D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{7D233DEA-ECEA-4617-B7BD-2CBF1D60687C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{8308A177-BA97-41CC-AF8E-2BE9405D38B4}" = lport=138 | protocol=17 | dir=in | app=system | "{834044AF-EA82-4259-941C-293C85FAE69C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{A1702E2C-A328-418D-8776-2083E40DE803}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{ADCC8B8E-CD3D-492E-818C-1C70CC9A5538}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{B2FE1C6F-42AB-4387-AC0F-8942FFCA50D1}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{B586E300-9516-41D5-A671-7FB2EE6F9FFB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{BBACB9AA-A60E-48E7-BA68-685A08F4046A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{C264A00C-9C4F-4E72-9B75-07846A5FB3DB}" = lport=137 | protocol=17 | dir=in | app=system | "{C8088D64-B520-4085-AEBA-0719DF2746A6}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | "{D4ACF1BF-3AA0-4680-A5E8-4E74C742E7BC}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{DF4329CF-E0EB-4F89-BAA3-94CD19AE2A38}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{E576AC86-74D0-4C6A-94FF-7AFB94A22109}" = lport=139 | protocol=6 | dir=in | app=system | "{E7009222-F864-4CA6-A597-6023DF655E91}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{F623C341-AC99-4353-993F-7338001900F7}" = rport=138 | protocol=17 | dir=out | app=system | "{FF4C285F-FCFA-46EE-AA13-B1B7326D8168}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{033734EF-73CC-45E2-97FB-AFC39A4200D3}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version8\teamviewer.exe | "{0EC356A3-A484-4582-A83F-AB03A08CBA25}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "{2FBC0203-B0E4-4362-B0C9-5ED622CC3EA6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{37081223-EDC6-455C-A9DC-2037E6457CDD}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{39BAD359-66A0-485F-8B36-3B6D19EE0A30}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version8\teamviewer_service.exe | "{39C90B49-52B8-4BFA-80A7-86F656D22313}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe | "{3FEDAE9D-F616-4B47-BBD6-1C106A14774E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{40514336-D627-4EC2-928D-9494A3485D8D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{43052F2D-8E7D-4BF3-81BB-D212517839F3}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{4C25B498-1169-4B3F-9B68-D3A59AEDABB2}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe | "{4F382FE0-C1EC-4C08-A364-998D60C578F7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{500F6F91-A16E-456B-9A24-21DDB1224254}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{5F170A21-D8AF-419B-8DDD-E4E170C4B72C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{632A55EB-BB04-42AB-AE06-911096669088}" = dir=in | app=c:\users\owner\appdata\local\microsoft\skydrive\skydrive.exe | "{6C127AB8-3F97-4B60-9ACF-64424E2E6B6F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{6D9890C5-9188-46B2-9AA5-441B6337B33F}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe | "{757FC4C0-A04F-49CB-8CA1-8ACA7EAF8977}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version8\teamviewer_service.exe | "{76179FA8-00EB-4C4D-AB10-D22D1E576E70}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{784F93AE-A8CD-4B82-978B-7A80E0084DCD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{A19367BF-9179-4DDD-BA8E-6AFE9C2322A4}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe | "{A8148C22-9D90-4CBC-ACD5-70C991497218}" = protocol=6 | dir=out | app=system | "{B2C7D8CD-6AD8-4E97-A278-87BB181D4270}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{C8FE77EC-0E5D-442A-B75C-364DC465BEC4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{CCF9B7D4-9FB2-4B9E-935B-7C674FBB178F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{CFB2B497-A672-4585-BF1F-591D3C407DC0}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe | "{D20ED0FF-6E85-4D71-ABA2-1129F19DC8D6}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version8\teamviewer.exe | "{D61481E6-387D-401B-905D-4B0B6808F9D3}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe | "{D65E71EA-30FF-4DA5-8F19-57CC02F331FC}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{DEE8AD4A-7760-41BD-8385-EBCF68AEFB03}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe | "{F1C9C255-E075-4A3E-96B8-044C85DA6119}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe | "{F6137487-6E2C-4FDF-883B-E1DBA96DD7AC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{F657E5DF-FDAC-41BD-9932-4EA1D9DFEC02}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{F8A8B210-01DA-4A99-93A9-D37AFEA5CCCF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{FE2E1441-67D7-4418-851E-3A051C24D92F}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{21E247D4-5E27-4BEA-AA4D-19A81203FE2A}" = Cisco Systems VPN Client 5.0.06.0160 "{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 45 "{337EDB0F-8505-4D14-9948-3A8A3D52CFCB}" = ZoneAlarm Security "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{3D305D7A-CD45-4876-94E6-F24FEB1690A3}" = ZoneAlarm Firewall "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4A5A427F-BA39-4BF0-9999-9A47FBE60C9F}" = Visual C++ 9.0 Runtime for Dragon NaturallySpeaking "{515EE4A3-6C80-4D56-824B-DF234DC50F74}" = SignCubes comdlg32.msm Update "{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM "{6280C3D1-00A3-4E79-BDF6-98332A29B706}" = AVG 2013 "{631E66F3-5BCC-4FF8-9F42-95AF0BFA38B7}" = AVG 2013 "{7451FD2D-1A23-4E67-92CD-8EDDD1846917}" = AVG PC TuneUp Language Pack (de-DE) "{78E43A83-DD74-499F-AF9E-47F9E15EBFE1}" = SignCubes comct232.msm Update "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0015-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_ULTIMATER_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_ULTIMATER_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_ULTIMATER_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007 "{90120000-00BA-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90140000-006D-0409-0000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010 "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English "{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007 "{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3) "{98286BC7-AD4C-424A-9BB9-F87A26D88CAF}" = SignCubes comct323.msm Update "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{A27E7EAE-6E50-40B6-A03B-3F4792E240EC}" = SignCubes comctl32.msm Update "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.0 - Deutsch "{EFFA53BC-8C04-2E21-3D90-A13B1697B0CA}" = Dragon NaturallySpeaking 11 "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 12.0 "AVG" = AVG 2013 "Foxit Reader_is1" = Foxit Reader "Free YouTube Download_is1" = Free YouTube Download version 3.2.13.925 "Google Chrome" = Google Chrome "HDMI" = Intel(R) Graphics Media Accelerator Driver "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Mozilla Firefox 22.0 (x86 en-US)" = Mozilla Firefox 22.0 (x86 en-US) "Mozilla Thunderbird 24.0.1 (x86 en-US)" = Mozilla Thunderbird 24.0.1 (x86 en-US) "MozillaMaintenanceService" = Mozilla Maintenance Service "Notepad++" = Notepad++ "Office14.Click2Run" = Microsoft Office Click-to-Run 2010 "Power Management Driver" = ThinkPad Power Management Driver "SignCubes" = OPENLiMiT(R) SignCubes 2.5.0.4 ReaderDeu "SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal) "TeamViewer 8" = TeamViewer 8 "Trusted Software Assistant_is1" = File Type Assistant "ULTIMATER" = Microsoft Office Ultimate 2007 "WinRAR archiver" = WinRAR 4.20 (32-bit) "ZoneAlarm Do Not Track Add-on_is1" = ZoneAlarm Do Not Track Add-on 2.2.5.1213 "ZoneAlarm Free Firewall" = ZoneAlarm Free Firewall ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-167141536-1578239192-4268729921-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Amazon Kindle" = Amazon Kindle "SkyDriveSetup.exe" = Microsoft SkyDrive ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 23/07/2013 04:40:46 | Computer Name = Owner-PC | Source = ESENT | ID = 490 Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 23/07/2013 04:40:56 | Computer Name = Owner-PC | Source = ESENT | ID = 490 Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 23/07/2013 04:41:06 | Computer Name = Owner-PC | Source = ESENT | ID = 490 Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 23/07/2013 04:41:16 | Computer Name = Owner-PC | Source = ESENT | ID = 490 Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 23/07/2013 04:41:26 | Computer Name = Owner-PC | Source = ESENT | ID = 490 Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 23/07/2013 04:41:36 | Computer Name = Owner-PC | Source = ESENT | ID = 490 Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 23/07/2013 04:41:46 | Computer Name = Owner-PC | Source = ESENT | ID = 490 Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 23/07/2013 04:41:56 | Computer Name = Owner-PC | Source = ESENT | ID = 490 Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 23/07/2013 04:42:07 | Computer Name = Owner-PC | Source = ESENT | ID = 490 Description = DllHost (2476) WebCacheLocal: An attempt to open the file "C:\Users\Owner\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error - 25/07/2013 07:11:26 | Computer Name = Owner-PC | Source = Application Error | ID = 1000 Description = Faulting application name: EXCEL.EXE, version: 12.0.6665.5003, time stamp: 0x5061d2a8 Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec49b60 Exception code: 0xc0000374 Fault offset: 0x000c380b Faulting process id: 0xa00 Faulting application start time: 0x01ce892792ccedea Faulting application path: C:\Program Files\Microsoft Office\Office12\EXCEL.EXE Faulting module path: C:\Windows\SYSTEM32\ntdll.dll Report Id: f1e6b190-f51a-11e2-bae8-0016d339d377 [ Media Center Events ] Error - 12/06/2012 09:20:57 | Computer Name = Owner-PC | Source = MCUpdate | ID = 0 Description = 14:20:57 - Error connecting to the internet. 14:20:57 - Unable to contact server.. [ OSession Events ] Error - 02/09/2012 05:36:53 | Computer Name = Owner-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 92 seconds with 0 seconds of active time. This session ended with a crash. Error - 02/09/2012 06:58:44 | Computer Name = Owner-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3801 seconds with 3180 seconds of active time. This session ended with a crash. Error - 02/09/2012 08:43:18 | Computer Name = Owner-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 6081 seconds with 2280 seconds of active time. This session ended with a crash. Error - 02/09/2012 13:29:17 | Computer Name = Owner-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 280 seconds with 60 seconds of active time. This session ended with a crash. [ System Events ] Error - 08/11/2013 13:45:27 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7006 Description = The ScRegSetValueExW call failed for FailureActions with the following error: %%5 Error - 08/11/2013 13:48:10 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7026 Description = The following boot-start or system-start driver(s) failed to load: cdrom VClone Error - 08/11/2013 14:04:53 | Computer Name = Owner-PC | Source = BROWSER | ID = 8032 Description = Error - 08/11/2013 16:47:36 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7011 Description = A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TeamViewer8 service. Error - 08/11/2013 18:27:25 | Computer Name = Owner-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20 Description = Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 11 for Windows 7. Error - 08/11/2013 18:27:26 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7006 Description = The ScRegSetValueExW call failed for FailureActions with the following error: %%5 Error - 09/11/2013 01:54:04 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7026 Description = The following boot-start or system-start driver(s) failed to load: cdrom VClone Error - 09/11/2013 02:15:57 | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7034 Description = The Computer Backup (MyPC Backup) service terminated unexpectedly. It has done this 1 time(s). Error - 09/11/2013 04:31:03 | Computer Name = Owner-PC | Source = bowser | ID = 8003 Description = Error - 09/11/2013 04:52:05 | Computer Name = Owner-PC | Source = BROWSER | ID = 8032 Description = < End of report > Geändert von sumsemann (13.11.2013 um 10:41 Uhr) |
13.11.2013, 16:01 | #4 |
/// the machine /// TB-Ausbilder | Mail: Fax von 04589016238 geoeffnet, AVG hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
14.11.2013, 07:11 | #5 |
| Mail: Fax von 04589016238 geoeffnet, AVG Hallo schrauber, Danke dir nochmals!! Combofix ist komplett durchgelaufen und ich habe die log file erstellt. Die sieht so aus: Code:
ATTFilter ComboFix 13-11-12.01 - Owner 09/11/2013 19:09:51.2.2 - x86 Microsoft Windows 7 Professional 6.1.7601.1.1252.44.1033.18.2038.1180 [GMT 1:00] Running from: c:\users\Owner\Desktop\ComboFix.exe AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B} SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((( Files Created from 2013-10-09 to 2013-11-09 ))))))))))))))))))))))))))))))) . . 2013-11-09 18:19 . 2013-11-09 18:19 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-11-09 17:52 . 2013-11-09 17:52 -------- d-----w- c:\users\Owner\AppData\Roaming\Windows Net Data 2013-11-09 07:29 . 2013-11-09 07:29 -------- d-----w- C:\FRST 2013-11-08 17:20 . 2013-11-09 08:01 -------- d-----w- c:\program files\Mozilla Thunderbird 2013-11-08 15:47 . 2013-11-08 15:47 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes 2013-11-08 15:46 . 2013-11-08 15:46 -------- d-----w- c:\programdata\Malwarebytes 2013-11-08 15:45 . 2013-11-09 06:16 -------- d-----w- c:\program files\MyPC Backup 2013-11-08 15:45 . 2013-11-08 17:44 -------- d-----w- c:\programdata\Systweak 2013-11-08 15:45 . 2012-07-25 11:03 17136 ----a-w- c:\windows\system32\sasnative32.exe 2013-11-08 15:43 . 2013-11-08 17:44 -------- d-----w- c:\users\Owner\AppData\Roaming\Systweak 2013-11-08 15:42 . 2013-11-08 17:44 -------- d-----w- c:\users\Owner\AppData\Roaming\DigitalSite 2013-10-17 15:05 . 2013-10-08 05:50 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-10-11 14:06 . 2013-09-22 23:54 770648 ----a-w- c:\program files\Internet Explorer\iexplore.exe 2013-10-11 14:06 . 2013-09-22 23:28 1767936 ----a-w- c:\windows\system32\wininet.dll 2013-10-11 10:11 . 2013-07-03 03:36 55808 ----a-w- c:\windows\system32\drivers\hidclass.sys 2013-10-11 10:11 . 2013-07-03 03:36 25728 ----a-w- c:\windows\system32\drivers\hidparse.sys 2013-10-10 22:05 . 2013-09-04 01:15 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys 2013-10-10 22:05 . 2013-09-04 01:14 76288 ----a-w- c:\windows\system32\drivers\usbccgp.sys 2013-10-10 22:05 . 2013-09-04 01:14 284672 ----a-w- c:\windows\system32\drivers\usbport.sys 2013-10-10 22:05 . 2013-09-04 01:14 43008 ----a-w- c:\windows\system32\drivers\usbehci.sys 2013-10-10 22:05 . 2013-09-04 01:14 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys 2013-10-10 22:05 . 2013-09-04 01:14 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys 2013-10-10 22:05 . 2013-09-04 01:14 6016 ----a-w- c:\windows\system32\drivers\usbd.sys 2013-10-10 20:16 . 2013-08-28 01:04 2348544 ----a-w- c:\windows\system32\win32k.sys 2013-10-10 20:16 . 2013-07-04 11:57 205824 ----a-w- c:\windows\system32\WebClnt.dll 2013-10-10 20:16 . 2013-07-04 11:51 81920 ----a-w- c:\windows\system32\davclnt.dll 2013-10-10 20:16 . 2013-07-04 09:48 115712 ----a-w- c:\windows\system32\drivers\mrxdav.sys 2013-10-10 20:16 . 2013-07-12 10:07 86016 ----a-w- c:\windows\system32\drivers\usbcir.sys 2013-10-10 20:16 . 2013-06-25 22:56 527064 ----a-w- c:\windows\system32\drivers\Wdf01000.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-10-09 05:48 . 2012-06-16 13:15 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-10-09 05:48 . 2012-06-16 13:15 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-10-08 05:51 . 2012-07-13 21:01 873384 ----a-w- c:\windows\system32\npDeployJava1.dll 2013-10-08 05:51 . 2012-07-13 21:01 796072 ----a-w- c:\windows\system32\deployJava1.dll 2013-09-09 23:34 . 2013-09-09 23:34 22328 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys 2013-09-04 23:43 . 2013-09-04 23:43 39224 ----a-w- c:\windows\system32\drivers\avgrkx86.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1] @="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}" [HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}] 2012-08-29 19:03 220608 ----a-w- c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2] @="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}" [HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}] 2012-08-29 19:03 220608 ----a-w- c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3] @="{BBACC218-34EA-4666-9D7A-C78F2274A524}" [HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}] 2012-08-29 19:03 220608 ----a-w- c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2011-06-06 222496] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552] "AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2013-09-22 4411952] "ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2013-08-12 73832] . c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ OpenLimit AutoStart.lnk - c:\program files\OPENLiMiT\siqSEMr.exe -a [2013-5-14 645048] VPN Client.lnk - c:\windows\Installer\{21E247D4-5E27-4BEA-AA4D-19A81203FE2A}\Icon3E5562ED7.ico -user_logon [2013-3-10 6144] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "DNS7reminder"="d:\nuance\NaturallySpeaking11\Ereg\Ereg.exe" -r "c:\programdata\Nuance\NaturallySpeaking11\Ereg.ini" "SCLicense"= "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" . R3 silabser;CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [2009-06-05 62592] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2013-07-19 60216] S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [2013-07-19 246072] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2013-09-04 39224] S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [2013-07-19 208184] S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [2013-09-09 22328] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2013-07-19 171320] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2013-03-21 182072] S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2013-06-27 37664] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [2013-07-04 4939312] S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [2013-07-23 283136] S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2013-04-22 822504] S2 DragonSvc;Dragon Service;c:\program files\Common Files\Nuance\dgnsvc.exe [2011-06-05 296808] S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2013-06-26 523944] S2 vToolbarUpdater15.3.0;vToolbarUpdater15.3.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [2013-06-27 1598128] S2 winzipersvc;WinZiper service;c:\program files\WinZipper\winzipersvc.exe [2013-06-28 424104] S2 ZAPrivacyService;ZoneAlarm Privacy Service;c:\program files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [2013-06-18 54160] S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2013-06-26 583848] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2013-06-26 197800] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2013-06-26 24232] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2013-06-26 20136] S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2013-06-26 207528] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-10-19 07:45 1185744 ----a-w- c:\program files\Google\Chrome\Application\30.0.1599.101\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-11-09 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-16 05:48] . 2013-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-07-06 18:10] . 2013-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-07-06 18:10] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com mStart Page = hxxp://www.google.com IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\ . - - - - ORPHANS REMOVED - - - - . AddRemove-SLABCOMM&10C4&EA60 - c:\windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60 AddRemove-{3ED2CDEC-D1BA-45F4-A524-12A1FF68135D} - c:\users\Owner\AppData\Local\{A0FE8EF8-F360-49B7-9660-46163A1206B1}\buchwaltersetup.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-11-09 19:24:20 ComboFix-quarantined-files.txt 2013-11-09 18:24 . Pre-Run: 81,137,664 bytes free Post-Run: 787,574,784 bytes free . - - End Of File - - 3A06A7AAFCFA5AB700F2665AB3663A0D A36C5E4F47E84449FF07ED3517B43A31 ich habe grade gesehen, dass sich die Systemzeit umgestellt hatte auf ein paar Tage zurueck. Sollte ich den Scanner dann nochmals durchlaufenlassen, falls der die aktuellen Dateien nicht erfasst hatte? Oder macht de Scanner das automatisch? Viele Gruesse Sum |
14.11.2013, 13:46 | #6 |
/// the machine /// TB-Ausbilder | Mail: Fax von 04589016238 geoeffnet, AVG passt schon so Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Mail: Fax von 04589016238 geoeffnet, AVG |
15.11.2013, 00:10 | #7 |
| Mail: Fax von 04589016238 geoeffnet, AVG Hallo schrauber, da bin ich ja beruhigt, wenn das so passt. Hier die Log von Malwarebytes im Quick-Scan: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.11.14.09 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 10.0.9200.16736 Owner :: OWNER-PC [administrator] 14/11/2013 22:29:28 mbam-log-2013-11-14 (22-29-28).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 200869 Time elapsed: 11 minute(s), 50 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKLM\SOFTWARE\IMINENT (PUP.Optional.Iminent.A) -> Quarantined and deleted successfully. Registry Values Detected: 1 HKLM\Software\Iminent|RefererId (PUP.Optional.Iminent.A) -> Data: 678 -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.012 - Report created 14/11/2013 at 22:56:55 # Updated 11/11/2013 by Xplode # Operating System : Windows 7 Professional Service Pack 1 (32 bits) # Username : Owner - OWNER-PC # Running from : C:\Users\Owner\Desktop\adwcleaner.exe # Option : Clean ***** [ Services ] ***** Service Deleted : winzipersvc ***** [ Files / Folders ] ***** Folder Deleted : C:\ProgramData\Systweak Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector Folder Deleted : C:\Program Files\MyPC Backup Folder Deleted : C:\Program Files\WinZipper Folder Deleted : C:\Program Files\Common Files\AVG Secure Search Folder Deleted : C:\Users\Owner\AppData\Local\filetypeassistant Folder Deleted : C:\Users\Owner\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar Folder Deleted : C:\Users\Owner\AppData\Roaming\digitalsite Folder Deleted : C:\Users\Owner\AppData\Roaming\Systweak Folder Deleted : C:\Users\Owner\AppData\Roaming\Windows Net Data Folder Deleted : C:\Users\Owner\AppData\Roaming\WinZipper Folder Deleted : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM File Deleted : C:\Program Files\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml File Deleted : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\searchplugins\searchgol.xml File Deleted : C:\Windows\System32\Tasks\Advanced System Protector File Deleted : C:\Windows\System32\Tasks\Advanced System Protector_startup File Deleted : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser ***** [ Shortcuts ] ***** ***** [ Registry ] ***** [#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4AF4846F-AFB1-48CD-B9B5-8F2116538AC1} [#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4AF4846F-AFB1-48CD-B9B5-8F2116538AC1} [#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E004E76F-7F0B-4A8E-B71E-5EC7377C0703} [#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E004E76F-7F0B-4A8E-B71E-5EC7377C0703} [#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{12625CDD-8B48-435C-8B68-701A985CA5A9} [#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{12625CDD-8B48-435C-8B68-701A985CA5A9} Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc Key Deleted : HKLM\SOFTWARE\a57dddde23fed17 Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4277F7CF-0000-46CF-BA49-D624465C4BAB} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909} Key Deleted : HKCU\Software\dsiteproducts Key Deleted : HKCU\Software\Softonic Key Deleted : HKCU\Software\systweak Key Deleted : HKLM\Software\hdcode Key Deleted : HKLM\Software\systweak Key Deleted : HKLM\Software\winzipersvc Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Iminent ***** [ Browsers ] ***** -\\ Internet Explorer v10.0.9200.16736 -\\ Mozilla Firefox v22.0 (en-US) [ File : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\prefs.js ] Line Deleted : user_pref("extensions.crossrider.bic", "13f89f5d52c6eb8c390f709822ac8871"); Line Deleted : user_pref("extensions.searchgol.admin", false); Line Deleted : user_pref("extensions.searchgol.aflt", "babsst"); Line Deleted : user_pref("extensions.searchgol.appId", "{4277F7CF-0000-46CF-BA49-D624465C4BAB}"); Line Deleted : user_pref("extensions.searchgol.autoRvrt", "false"); Line Deleted : user_pref("extensions.searchgol.dfltLng", "en"); Line Deleted : user_pref("extensions.searchgol.excTlbr", false); Line Deleted : user_pref("extensions.searchgol.ffxUnstlRst", false); Line Deleted : user_pref("extensions.searchgol.id", "aa34f31f0000000000000016d339d377"); Line Deleted : user_pref("extensions.searchgol.instlDay", "15983"); Line Deleted : user_pref("extensions.searchgol.instlRef", "sst"); Line Deleted : user_pref("extensions.searchgol.newTab", false); Line Deleted : user_pref("extensions.searchgol.prdct", "searchgol"); Line Deleted : user_pref("extensions.searchgol.prtnrId", "searchgol"); Line Deleted : user_pref("extensions.searchgol.rvrt", "false"); Line Deleted : user_pref("extensions.searchgol.smplGrp", "none"); Line Deleted : user_pref("extensions.searchgol.tlbrId", "base"); Line Deleted : user_pref("extensions.searchgol.tlbrSrchUrl", ""); Line Deleted : user_pref("extensions.searchgol.vrsn", "1.8.16.19"); Line Deleted : user_pref("extensions.searchgol.vrsnTs", "1.8.16.190:50:05"); Line Deleted : user_pref("extensions.searchgol.vrsni", "1.8.16.19"); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.initialized", true); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.contextKey", ""); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.installDate", "2013062810"); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.partnerId", "^Y6^xdm043^YY^de"); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.partnerSubId", "swissconverter"); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.success", true); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.toolbarId", "7AF668E6-4562-4403-8A3C-4459CDC4078B"); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.lastActivePing", "1372409151846"); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.defaultSearch", false); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.homePageEnabled", false); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.keywordEnabled", false); Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.tabEnabled", false); Line Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "fromdoctopdf@mindspark.com"); -\\ Google Chrome v30.0.1599.101 [ File : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [6752 octets] - [14/11/2013 22:54:52] AdwCleaner[S0].txt - [6777 octets] - [14/11/2013 22:56:55] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6837 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.0.8 (11.05.2013:1) OS: Windows 7 Professional x86 Ran by Owner on 14/11/2013 at 23:51:03.47 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-167141536-1578239192-4268729921-1000\Software\sweetim Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\backupstack_rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\backupstack_rasmancs ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Users\Owner\appdata\local\filetypeassistant" Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin" ~~~ FireFox Emptied folder: C:\Users\Owner\AppData\Roaming\mozilla\firefox\profiles\h68r321a.default\minidumps [298 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 14/11/2013 at 23:55:09.47 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
15.11.2013, 18:44 | #8 |
/// the machine /// TB-Ausbilder | Mail: Fax von 04589016238 geoeffnet, AVGESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
16.11.2013, 08:39 | #9 |
| Mail: Fax von 04589016238 geoeffnet, AVG Hallo schrauber, so hier meine neusten reports: Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=3070a3a1c8fdb0478ddb007a1c5e7f83 # engine=15904 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-11-15 08:54:26 # local_time=2013-11-15 09:54:26 (+0100, W. Europe Standard Time) # country="United Kingdom" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1039 16777213 100 92 4386 71682850 0 0 # compatibility_mode=5893 16776574 66 85 11082086 136180057 0 0 # compatibility_mode=9217 16777214 75 4 4521355 4521355 0 0 # scanned=109239 # found=0 # cleaned=0 # scan_time=3708 Code:
ATTFilter Results of screen317's Security Check version 0.99.76 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Disabled! AVG AntiVirus Free Edition 2013 Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.75.0.1300 AVG PC TuneUp Language Pack (de-DE) Java 7 Update 45 Adobe Flash Player 11.9.900.117 Adobe Reader 9 Adobe Reader out of Date! Mozilla Firefox 22.0 Firefox out of Date! Mozilla Thunderbird (24.0.1) Google Chrome 30.0.1599.101 Google Chrome 30.0.1599.69 ````````Process Check: objlist.exe by Laurent```````` AVG avgwdsvc.exe AVG avgrsx.exe AVG avgnsx.exe AVG avgemc.exe CheckPoint ZoneAlarm vsmon.exe CheckPoint ZoneAlarm zatray.exe CheckPoint ZoneAlarm ZAPrivacyService.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 10% ````````````````````End of Log`````````````````````` FRST lauft leider immernoch nich durch Der stoppt bei einer Datei die von ZoneAlarm verwendet wird.Die liegt in C:\Users\Owner\AppData\Local\Temp und heisst ~DFA036B589A3CA2737.TMP Hatte auch mit abgeschaltetem Zonealarm versucht aber kein Erfolg Ich schicke dir aber mal was ich schon habe: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-11-2013 Ran by Owner (administrator) on OWNER-PC on 16-11-2013 08:23:05 Running from C:\Users\Owner\Desktop Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: English(US) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2013\avgrsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe (Lenovo) C:\Windows\system32\ibmpmsvc.exe (Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE (Check Point Software Technologies LTD) C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe (Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Nuance Communications, Inc.) C:\Program Files\Common Files\Nuance\dgnsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Check Point Software Technologies, Ltd.) C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe (Check Point Software Technologies LTD) C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (OPENLiMiT SignCubes GmbH) C:\Program Files\OPENLiMiT\siqSEMr.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcfgex.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [AVG_UI] - C:\Program Files\AVG\AVG2013\avgui.exe [4411952 2013-09-23] (AVG Technologies CZ, s.r.o.) HKLM\...\Run: [ZoneAlarm] - C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-08-12] (Check Point Software Technologies LTD) HKCU\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2011-06-06] (Acresso Corporation) Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) BootExecute: autocheck autochk * sdnclean.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8345C67E64B4CD01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-GB SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - {24BF7F8D-2C49-491F-8E48-0FFDFF1F5FD8} URL = hxxp://search.zonealarm.com/search?src=sp&tbid=base2013&Lan=en&q={searchTerms}&gu=a032e0599f8f440b9773e1622ad62add&tu=10GX000652B000c&sku=&tstsId=&ver=&&r=179 BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Zonealarm Helper Object - {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} - No File BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - ZoneAlarm Security Toolbar - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - No File Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.) FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: ZoneAlarm Do Not Track - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\Extensions\donottrack@checkpoint.com FF Extension: ciuvo-extension - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h68r321a.default\Extensions\ciuvo-extension@billiger.de.xpi Chrome: ======= CHR Extension: (Google Docs) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0 CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0 CHR Extension: (Google Search) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: () - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmlgoencnlndpglbocajlimaikjohmab\background.html CHR Extension: (Google Wallet) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0 CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 ========================== Services (Whitelisted) ================= R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.) R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528624 2009-11-17] (Cisco Systems, Inc.) R2 DragonSvc; C:\Program Files\Common Files\Nuance\dgnsvc.exe [296808 2011-06-05] (Nuance Communications, Inc.) R2 vsmon; C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe [2445304 2013-08-12] (Check Point Software Technologies LTD) R2 ZAPrivacyService; C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [54160 2013-06-18] (Check Point Software Technologies, Ltd.) S2 vToolbarUpdater15.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [x] ==================== Drivers (Whitelisted) ==================== R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-07-20] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-07-20] (AVG Technologies CZ, s.r.o.) R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-09-10] (AVG Technologies CZ, s.r.o.) R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [171320 2013-07-20] (AVG Technologies CZ, s.r.o.) R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.) R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-07-01] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-09-05] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-06-27] (AVG Technologies) S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.) R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [308859 2009-11-17] (Cisco Systems, Inc.) R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.) S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [62592 2009-06-05] (Silicon Laboratories) R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [455704 2013-06-13] (Check Point Software Technologies LTD) S3 catchme; \??\C:\Users\Owner\AppData\Local\Temp\catchme.sys [x] S0 VClone; system32\DRIVERS\VClone.sys [x] U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-16 08:13 - 2013-11-16 08:13 - 00000244 _____ C:\Users\Owner\Desktop\defogger_enable.log 2013-11-16 08:09 - 2013-11-16 08:09 - 00000472 _____ C:\Users\Owner\Desktop\defogger_disable.log 2013-11-16 08:08 - 2013-11-16 08:08 - 00050477 _____ C:\Users\Owner\Desktop\Defogger.exe 2013-11-16 07:26 - 2013-11-16 08:24 - 00010742 _____ C:\Users\Owner\Desktop\FRST.txt 2013-11-16 07:23 - 2013-11-16 07:23 - 01090529 _____ (Farbar) C:\Users\Owner\Desktop\FRST.exe 2013-11-15 23:38 - 2013-11-15 23:38 - 00891184 _____ C:\Users\Owner\Desktop\SecurityCheck.exe 2013-11-15 06:37 - 2013-11-16 07:21 - 00000000 ____D C:\Users\Owner\AppData\Local\FileTypeAssistant 2013-11-14 23:55 - 2013-11-14 23:55 - 00001308 _____ C:\Users\Owner\Desktop\JRT.txt 2013-11-14 23:50 - 2013-11-14 23:50 - 00000000 ____D C:\Windows\ERUNT 2013-11-14 23:05 - 2013-11-14 23:05 - 01034531 _____ (Thisisu) C:\Users\Owner\Desktop\JRT.exe 2013-11-14 22:54 - 2013-11-14 22:57 - 00000000 ____D C:\AdwCleaner 2013-11-14 22:53 - 2013-11-14 22:53 - 01085542 _____ C:\Users\Owner\Desktop\adwcleaner.exe 2013-11-13 23:26 - 2013-10-12 08:04 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-13 23:26 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-13 23:26 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-13 23:26 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-13 23:26 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-13 23:26 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-13 23:26 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-13 23:26 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-13 23:26 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-13 23:26 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-13 23:26 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-13 23:26 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-13 23:26 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-13 23:26 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-13 23:25 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-13 23:25 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-09 19:24 - 2013-11-09 19:24 - 00013251 _____ C:\ComboFix.txt 2013-11-09 18:55 - 2013-11-09 18:55 - 00000273 _____ C:\Users\Owner\Application Mover.cfg 2013-11-09 18:50 - 2013-11-09 18:50 - 01694409 _____ (Funduc Software Inc. ) C:\Users\Owner\Desktop\setupam_4_2.exe 2013-11-09 17:03 - 2013-11-09 19:24 - 00000000 ____D C:\Qoobox 2013-11-09 17:03 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe 2013-11-09 17:03 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe 2013-11-09 17:03 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2013-11-09 17:03 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2013-11-09 17:03 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2013-11-09 17:03 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe 2013-11-09 17:03 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe 2013-11-09 17:03 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe 2013-11-09 17:02 - 2013-11-09 19:21 - 00000000 ____D C:\Windows\erdnt 2013-11-09 17:00 - 2013-11-09 17:00 - 05147957 ____R (Swearware) C:\Users\Owner\Desktop\ComboFix.exe 2013-11-09 11:02 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2013-11-09 11:02 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2013-11-09 11:02 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2013-11-09 11:02 - 2013-10-03 02:58 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2013-11-09 11:02 - 2013-09-25 03:01 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2013-11-09 11:02 - 2013-09-25 03:01 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2013-11-09 11:02 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2013-11-09 11:02 - 2013-09-25 02:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2013-11-09 11:02 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2013-11-09 11:02 - 2013-09-25 02:56 - 01038848 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2013-11-09 11:02 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2013-11-09 11:02 - 2013-09-25 01:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2013-11-09 11:02 - 2013-09-25 01:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2013-11-09 11:02 - 2013-07-04 13:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2013-11-09 11:01 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2013-11-09 11:01 - 2013-10-12 03:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2013-11-09 11:01 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2013-11-09 11:01 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-11-09 08:29 - 2013-11-09 08:29 - 00000000 ____D C:\FRST 2013-11-08 23:26 - 2013-11-15 06:44 - 00009535 _____ C:\Windows\IE11_main.log 2013-11-08 18:20 - 2013-11-09 09:01 - 00000000 ____D C:\Program Files\Mozilla Thunderbird 2013-11-08 18:10 - 2013-11-08 18:10 - 00152568 _____ C:\Windows\Minidump\110813-106174-01.dmp 2013-11-08 17:43 - 2013-11-08 17:43 - 00000096 _____ C:\Users\Owner\AppData\Roaming\WB.CFG 2013-11-08 16:47 - 2013-11-08 16:47 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Malwarebytes 2013-11-08 16:46 - 2013-11-08 16:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-08 16:45 - 2012-07-25 12:03 - 00017136 _____ C:\Windows\system32\sasnative32.exe 2013-11-08 16:32 - 2013-11-08 16:32 - 00152568 _____ C:\Windows\Minidump\110813-91010-01.dmp 2013-10-31 19:33 - 2013-10-31 19:33 - 00152568 _____ C:\Windows\Minidump\103113-95971-01.dmp 2013-10-30 11:05 - 2013-10-30 11:05 - 00152568 _____ C:\Windows\Minidump\103013-94614-01.dmp 2013-10-27 00:03 - 2013-10-27 00:03 - 00000699 _____ C:\Users\Owner\Desktop\new 3.txt 2013-10-27 00:03 - 2013-10-27 00:03 - 00000137 _____ C:\Users\Owner\Desktop\new 2.txt 2013-10-23 18:54 - 2013-10-23 18:55 - 00240128 _____ C:\Users\Owner\Desktop\Kopie von 2013_MonatsKundenadressenliste_Sep.xls 2013-10-17 16:05 - 2013-10-08 06:50 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2013-10-17 16:05 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-10-17 16:05 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-10-17 16:04 - 2013-10-17 16:05 - 00004734 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log ==================== One Month Modified Files and Folders ======= 2013-11-16 08:24 - 2013-11-16 07:26 - 00010742 _____ C:\Users\Owner\Desktop\FRST.txt 2013-11-16 08:13 - 2013-11-16 08:13 - 00000244 _____ C:\Users\Owner\Desktop\defogger_enable.log 2013-11-16 08:13 - 2012-05-28 13:25 - 00000000 ____D C:\Users\Owner 2013-11-16 08:09 - 2013-11-16 08:09 - 00000472 _____ C:\Users\Owner\Desktop\defogger_disable.log 2013-11-16 08:08 - 2013-11-16 08:08 - 00050477 _____ C:\Users\Owner\Desktop\Defogger.exe 2013-11-16 07:48 - 2012-10-30 20:44 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-11-16 07:48 - 2009-07-14 05:34 - 00014032 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-16 07:48 - 2009-07-14 05:34 - 00014032 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-16 07:45 - 2012-05-28 13:20 - 01457823 _____ C:\Windows\WindowsUpdate.log 2013-11-16 07:43 - 2013-07-06 19:11 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-11-16 07:40 - 2013-07-06 19:11 - 00000880 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-11-16 07:40 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-11-16 07:39 - 2013-08-21 06:18 - 00011500 _____ C:\Windows\setupact.log 2013-11-16 07:23 - 2013-11-16 07:23 - 01090529 _____ (Farbar) C:\Users\Owner\Desktop\FRST.exe 2013-11-16 07:21 - 2013-11-15 06:37 - 00000000 ____D C:\Users\Owner\AppData\Local\FileTypeAssistant 2013-11-15 23:38 - 2013-11-15 23:38 - 00891184 _____ C:\Users\Owner\Desktop\SecurityCheck.exe 2013-11-15 20:41 - 2012-06-16 13:39 - 00000000 ____D C:\ProgramData\MFAData 2013-11-15 06:44 - 2013-11-08 23:26 - 00009535 _____ C:\Windows\IE11_main.log 2013-11-14 23:55 - 2013-11-14 23:55 - 00001308 _____ C:\Users\Owner\Desktop\JRT.txt 2013-11-14 23:50 - 2013-11-14 23:50 - 00000000 ____D C:\Windows\ERUNT 2013-11-14 23:05 - 2013-11-14 23:05 - 01034531 _____ (Thisisu) C:\Users\Owner\Desktop\JRT.exe 2013-11-14 22:57 - 2013-11-14 22:54 - 00000000 ____D C:\AdwCleaner 2013-11-14 22:56 - 2012-06-16 14:00 - 00000000 ____D C:\Users\Owner\AppData\Roaming\CheckPoint 2013-11-14 22:53 - 2013-11-14 22:53 - 01085542 _____ C:\Users\Owner\Desktop\adwcleaner.exe 2013-11-14 19:47 - 2013-03-11 18:07 - 00000000 ____D C:\Program Files\File Type Assistant 2013-11-14 07:05 - 2012-09-02 11:11 - 00727182 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-14 06:58 - 2009-07-14 05:33 - 00409752 _____ C:\Windows\system32\FNTCACHE.DAT 2013-11-14 06:57 - 2012-06-14 10:56 - 00186634 _____ C:\Windows\PFRO.log 2013-11-13 23:38 - 2012-06-13 13:52 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-11-13 23:25 - 2013-08-14 16:24 - 00000000 ____D C:\Windows\system32\MRT 2013-11-13 23:17 - 2012-06-16 16:07 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-11-09 19:24 - 2013-11-09 19:24 - 00013251 _____ C:\ComboFix.txt 2013-11-09 19:24 - 2013-11-09 17:03 - 00000000 ____D C:\Qoobox 2013-11-09 19:24 - 2009-07-14 03:37 - 00000000 __RHD C:\Users\Default 2013-11-09 19:24 - 2009-07-14 03:37 - 00000000 ___RD C:\Users\Public 2013-11-09 19:21 - 2013-11-09 17:02 - 00000000 ____D C:\Windows\erdnt 2013-11-09 19:20 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini 2013-11-09 19:04 - 2013-07-08 07:09 - 00045568 ___SH C:\Users\Owner\Documents\Thumbs.db 2013-11-09 18:55 - 2013-11-09 18:55 - 00000273 _____ C:\Users\Owner\Application Mover.cfg 2013-11-09 18:50 - 2013-11-09 18:50 - 01694409 _____ (Funduc Software Inc. ) C:\Users\Owner\Desktop\setupam_4_2.exe 2013-11-09 18:50 - 2012-05-28 13:30 - 00109280 _____ C:\Users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT 2013-11-09 18:12 - 2012-07-21 14:05 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2013-11-09 17:00 - 2013-11-09 17:00 - 05147957 ____R (Swearware) C:\Users\Owner\Desktop\ComboFix.exe 2013-11-09 09:01 - 2013-11-08 18:20 - 00000000 ____D C:\Program Files\Mozilla Thunderbird 2013-11-09 08:29 - 2013-11-09 08:29 - 00000000 ____D C:\FRST 2013-11-08 18:47 - 2009-07-14 05:53 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-11-08 18:10 - 2013-11-08 18:10 - 00152568 _____ C:\Windows\Minidump\110813-106174-01.dmp 2013-11-08 18:10 - 2012-08-17 14:33 - 00000000 ____D C:\Windows\Minidump 2013-11-08 18:09 - 2013-09-25 08:53 - 309324176 ____N C:\Windows\MEMORY.DMP 2013-11-08 17:43 - 2013-11-08 17:43 - 00000096 _____ C:\Users\Owner\AppData\Roaming\WB.CFG 2013-11-08 16:47 - 2013-11-08 16:47 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Malwarebytes 2013-11-08 16:46 - 2013-11-08 16:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-08 16:32 - 2013-11-08 16:32 - 00152568 _____ C:\Windows\Minidump\110813-91010-01.dmp 2013-10-31 19:33 - 2013-10-31 19:33 - 00152568 _____ C:\Windows\Minidump\103113-95971-01.dmp 2013-10-30 11:05 - 2013-10-30 11:05 - 00152568 _____ C:\Windows\Minidump\103013-94614-01.dmp 2013-10-27 00:03 - 2013-10-27 00:03 - 00000699 _____ C:\Users\Owner\Desktop\new 3.txt 2013-10-27 00:03 - 2013-10-27 00:03 - 00000137 _____ C:\Users\Owner\Desktop\new 2.txt 2013-10-23 22:52 - 2012-06-12 12:02 - 00000000 ____D C:\Users\Owner\AppData\Roaming\SoftGrid Client 2013-10-23 18:55 - 2013-10-23 18:54 - 00240128 _____ C:\Users\Owner\Desktop\Kopie von 2013_MonatsKundenadressenliste_Sep.xls 2013-10-23 15:55 - 2012-06-13 13:52 - 00000000 ____D C:\Users\Owner\AppData\Local\Microsoft Help 2013-10-23 15:25 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared 2013-10-22 16:50 - 2012-12-13 07:56 - 00000987 _____ C:\Users\Public\Desktop\AVG 2013.lnk 2013-10-17 16:05 - 2013-10-17 16:04 - 00004734 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log 2013-10-17 16:05 - 2013-07-03 19:36 - 00000000 ____D C:\Program Files\Java 2013-10-17 16:00 - 2013-07-03 19:22 - 00915368 _____ (Oracle Corporation) C:\Users\Owner\Downloads\jxpiinstall.exe |
16.11.2013, 16:20 | #10 |
/// the machine /// TB-Ausbilder | Mail: Fax von 04589016238 geoeffnet, AVG Adobe und Firefox updaten. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
17.11.2013, 19:13 | #11 |
| Mail: Fax von 04589016238 geoeffnet, AVG Hallo Schrauber, alles geklappt. Die seltsame Temp Datei ist verschwunden. Alle Dateien sind deinstalliert und auch in der vorgegebenen Reihenfolge. Vielen Dank fuer deine Hilfe Viele Gruesse sumsemann |
18.11.2013, 10:08 | #12 |
/// the machine /// TB-Ausbilder | Mail: Fax von 04589016238 geoeffnet, AVG Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Mail: Fax von 04589016238 geoeffnet, AVG |
avg, datei, download, email, entfernen, entfernt, fax von 04589016238, files, firewall, gen, gesendet, ide, laptop, mail, neue, neuen, neustart, programme, regclean, scan, scanner, system, trojaner/virus, virenscan, virenscanner, warum, win, wirklich, zonealarm |