Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   50€-Virus-Was kann ich tun? (https://www.trojaner-board.de/111119-50-virus-tun.html)

Trivandrum 08.03.2012 09:57

50€-Virus-Was kann ich tun?
 
Hallo,

wie schon so viele, hat auch mein Laptop diesen Virus:

Nachdem ich den Laptop hochfahre, kommt folgende Meldung:

Durch das Besuchen von Seiten mit infizierten und pornographischen Inhalten ist das Computersystem an eine kritische Grenze angekommen, nach der das System zusammenbrechen und die ganzen Dateien verloren gehen können. Um das System wiederherstellen zu können müssen Sie ein zusätzliches Sicherheitsupdate herunterladen.

Dieses Update ist ein kostenpflichtiges Upgrade für besonders infizierte Windowssysteme. Es beschützt das System vollständig von Virus und Schadprogrammen, stabilisiert Ihr Computersystem und verhindert den Datenverlust.


Ich habe Windows Vista.
Mein PC verfügt über 2 Benutzerdesktops. Über den einen, den ich sonst nie benutze, kann ich mich anmelden und alles ist normal bei dem anderen Benutzer kommt oben stehende Meldung.

Ich habe auch ein Amazon-Konto und habe Angst, dass es missbraucht wird.

Könnt ihr mir helfen?

Vielen Dank

Folgende Ergebnisse hat der Scann mit oldtimer gebracht:

OTL Logfile:
Code:

OTL logfile created on: 08.03.2012 10:35:18 - Run 2
OTL by OldTimer - Version 3.2.36.1    Folder = C:\Users\janka\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 1,39 Gb Available Physical Memory | 73,97% Memory free
3,98 Gb Paging File | 3,65 Gb Available in Paging File | 91,75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 33,99 Gb Free Space | 45,61% Space Free | Partition Type: NTFS
Drive D: | 67,69 Gb Total Space | 11,16 Gb Free Space | 16,48% Space Free | Partition Type: NTFS
 
Computer Name: JANKA-PC | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\janka\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (CLTNetCnService) --  File not found
SRV - (Application Updater) -- C:\Program Files\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (vpnagent) -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (ASLDRService) -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe ()
SRV - (spmgr) -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe ()
SRV - (StkSSrv) -- C:\Windows\System32\StkCSrv.exe (Syntek America Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (ZTEusbser6k) --  File not found
DRV - (ZTEusbnmea) --  File not found
DRV - (ZTEusbmdm6k) --  File not found
DRV - (NwlnkFwd) --  File not found
DRV - (NwlnkFlt) --  File not found
DRV - (massfilter) --  File not found
DRV - (ipswuio) --  File not found
DRV - (IpInIp) --  File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (vpnva) -- C:\Windows\System32\drivers\vpnva.sys (Cisco Systems, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (EC168BDA) -- C:\Windows\System32\drivers\EC168BDA.sys (e3C, Inc.)
DRV - (StkCMini) -- C:\Windows\System32\drivers\StkCMini.sys (Syntek)
DRV - (WCPU) -- C:\Program Files\P4G\WCPU.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (ghaio) -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys ()
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
DRV - (Atc002) -- C:\Windows\System32\drivers\L260x86.sys (Attansic Corporation)
DRV - (SSPORT) -- C:\Windows\System32\drivers\SSPORT.SYS (Samsung Electronics)
DRV - (DgiVecp) -- C:\Windows\System32\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.)
DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - SOFTWARE\Classes\CLSID\{c9508125-4747-4733-b048-e4b82dc9716d}\InprocServer32 File not found
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2102572
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\5.0\pdfforgeToolbarIE.dll (Spigot, Inc.)
IE - HKCU\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - SOFTWARE\Classes\CLSID\{c9508125-4747-4733-b048-e4b82dc9716d}\InprocServer32 File not found
IE - HKCU\..\SearchScopes,DefaultScope = {2F277093-48A9-4429-AEEC-AAA3F458DEDA}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes\{2F277093-48A9-4429-AEEC-AAA3F458DEDA}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316&ilc=12"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..keyword.URL: "hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=827316&ilc=12&p="
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Users\janka\Downloads\DivX\DivX Web Player\npdivx32.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Users\janka\Downloads\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.05 14:25:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.03.05 14:26:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\janka\AppData\Roaming\mozilla\Extensions
[2012.03.05 14:25:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.02.16 15:55:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.16 12:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.16 11:48:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.16 12:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.16 12:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.16 12:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.16 12:02:53 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\5.0\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\5.0\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (PHPNukeDE Toolbar) - {C9508125-4747-4733-B048-E4B82DC9716D} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe ()
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe ()
O4 - HKLM..\Run: [ASUSTPE] C:\Windows\System32\ASUSTPE.exe (ASUS)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE (ASUSTeK Computer INC.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone.exe ()
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime File not found
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Zshutdown] c:\Preload\patch\sysprep.cmd File not found
O4 - HKCU..\Run: [{0E330D6F-EC24-11DD-9B90-806E6F6E6963}] C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe ()
O4 - HKCU..\Run: [DetectTray] C:\Program Files\Genius\TVGo DVB-T02PRO\DetectTray.exe ()
O4 - Startup: C:\Users\janka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StarOffice 8.lnk = C:\Program Files\Sun\StarOffice 8\program\quickstart.exe ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (Intertrust Technologies, Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {28B66320-9687-4B13-8757-36F901887AB5} hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/canvasx.cab (CanvasX Class)
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/jordan.cab (JordanUploader Class)
O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} https://vpn-server.rrzn.uni-hannover.de/CACHE/stc/1/binaries/vpnweb.cab (Cisco AnyConnect VPN Client Web Control)
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab (CeWe Color AG & Co. OHG Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.220.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E723881F-6E37-4CC1-AB45-21C6A8C62A46}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EF84D312-EE25-4CBC-B693-0D1E89F07D92}: DhcpNameServer = 192.168.220.1
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\janka\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\janka\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{3bb5b4ee-f83f-11dd-b359-001d60cd4205}\Shell - "" = AutoRun
O33 - MountPoints2\{3bb5b4ee-f83f-11dd-b359-001d60cd4205}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{43559195-9978-11de-ace3-001d60cd4205}\Shell - "" = AutoRun
O33 - MountPoints2\{43559195-9978-11de-ace3-001d60cd4205}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk /p \??\F:)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.05 14:25:51 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Roaming\Mozilla
[2012.03.05 14:25:51 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Local\Mozilla
[2012.03.05 14:25:41 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.03.05 14:24:36 | 015,634,456 | ---- | C] (Mozilla) -- C:\Users\janka\Firefox_Setup_10.0.2.exe
[2012.03.03 18:51:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot
[2012.03.03 18:51:23 | 000,000,000 | ---D | C] -- C:\Program Files\pdfforge Toolbar
[2012.03.03 18:51:23 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater
[2012.03.03 18:51:13 | 000,000,000 | -HSD | C] -- C:\Config.Msi
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.08 10:38:05 | 000,632,594 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.08 10:38:05 | 000,599,528 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.08 10:38:05 | 000,128,212 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.08 10:38:05 | 000,105,404 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.08 10:30:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.08 10:29:07 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.03.08 10:26:42 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.08 10:26:42 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.08 08:59:52 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2012.03.07 17:08:58 | 188,381,636 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.03.05 14:25:43 | 000,000,853 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.03.05 14:25:05 | 015,634,456 | ---- | M] (Mozilla) -- C:\Users\janka\Firefox_Setup_10.0.2.exe
[2012.02.23 09:18:36 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
 
========== Files Created - No Company Name ==========
 
[2012.03.05 14:25:43 | 000,000,865 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.03.05 14:25:43 | 000,000,853 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.02.24 17:13:53 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010.11.29 18:06:39 | 000,001,024 | ---- | C] () -- C:\Windows\System32\grcauth2.dll
[2010.11.29 18:06:39 | 000,001,024 | ---- | C] () -- C:\Windows\System32\grcauth1.dll
[2010.11.29 18:06:39 | 000,000,100 | ---- | C] () -- C:\Windows\System32\prsgrc.dll
[2010.11.29 17:58:13 | 000,001,025 | ---- | C] () -- C:\Windows\System32\sysprs7.dll
[2010.11.29 17:58:13 | 000,000,205 | ---- | C] () -- C:\Windows\System32\lsprst7.dll
[2010.10.13 17:50:29 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.10.07 13:33:35 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010.05.02 20:17:31 | 000,000,018 | ---- | C] () -- C:\Windows\ssetup.ini
 
========== LOP Check ==========
 
[2009.02.19 20:03:02 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Canon
[2010.02.07 10:44:38 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\elsterformular
[2010.11.25 22:19:51 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\FreeAudioPack
[2009.02.19 19:51:58 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\InterTrust
[2009.01.28 21:15:26 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Miranda
[2010.11.22 14:29:25 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Scientific Software
[2012.03.07 20:14:30 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\StarOffice8
[2011.02.24 16:53:17 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\UDC Profiles
[2011.02.24 17:07:32 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\WordToPDF
[2012.03.08 10:29:07 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---




und



OTL Logfile:
Code:

OTL Extras logfile created on: 08.03.2012 10:35:18 - Run 2
OTL by OldTimer - Version 3.2.36.1    Folder = C:\Users\janka\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 1,39 Gb Available Physical Memory | 73,97% Memory free
3,98 Gb Paging File | 3,65 Gb Available in Paging File | 91,75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 33,99 Gb Free Space | 45,61% Space Free | Partition Type: NTFS
Drive D: | 67,69 Gb Total Space | 11,16 Gb Free Space | 16,48% Space Free | Partition Type: NTFS
 
Computer Name: JANKA-PC | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1331460E-B590-4AFB-8603-73FE6D222879}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2EC5F36A-0D12-4DDE-B804-EB6A53C5A708}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3259E05C-38C1-4087-A7B3-6766781E5D16}" = lport=138 | protocol=17 | dir=in | app=system |
"{33CFD4D0-0DB2-4F95-A514-94E4BE68C109}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{35F1B5CE-ACF8-401E-BBC9-3A722E77D980}" = rport=445 | protocol=6 | dir=out | app=system |
"{3B500FAA-74C6-4FF3-88D3-143B2CDAB40D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{3B665BE4-6869-4D89-AE92-94163397BFCD}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{4CF29A67-8032-4409-9897-C85640FE8811}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{525E39D6-CB13-43EB-8489-FAE0EFEE9A71}" = lport=137 | protocol=17 | dir=in | app=system |
"{53A89469-2A6C-4D4A-99AB-AFAA84F479C4}" = lport=10243 | protocol=6 | dir=in | app=system |
"{54679428-10C0-4EC8-AED2-6768E60CE652}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{59C4ADAC-156A-4299-ADD9-8DA74FEABD10}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6546DC7F-F3DC-4C77-8750-4C45EB86CB50}" = rport=10243 | protocol=6 | dir=out | app=system |
"{73FC3AC9-403D-480B-85CA-ED73BDCF41A3}" = rport=138 | protocol=17 | dir=out | app=system |
"{8026C332-3A9B-4E68-B971-5BCC3FBB3977}" = lport=445 | protocol=6 | dir=in | app=system |
"{83BFA2E7-FA2A-47B7-A8E8-3D5ED5DE6DD9}" = lport=139 | protocol=6 | dir=in | app=system |
"{8DECB48A-29C3-4172-97B6-D212510825F8}" = rport=139 | protocol=6 | dir=out | app=system |
"{90052951-F440-4EBB-91E1-E73C826F8156}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{92E7EE81-4D78-4FD8-9B30-FE812D1E332B}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{9BDC01F3-521D-4F76-A68B-36F0C5975B63}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A0DC2738-F1AD-45B1-9B81-95C4D1AA0933}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{B80EE33D-5478-4B79-87F3-44C8FD5F27A2}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D2C5D045-4764-42C5-9198-A229DDCE2F7C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{DD566E88-255C-4D32-87ED-9FA01C69ED02}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F2A2F446-7FF9-4E1F-B4CD-EFE8036C1074}" = rport=137 | protocol=17 | dir=out | app=system |
"{F4FCD3B3-4949-4709-9632-6F99F977DB30}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FCFD4861-3929-407A-AF2C-342FBB91E70D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{073A3800-60AA-4E07-9911-F9BB8D13F5BD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{13BB991E-E367-4D8F-9521-F94B757C3146}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{2F2E5710-5833-4FF0-B3A1-016DFB989F9B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2FF348E0-717F-4397-9E24-386367E0A35F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{31FF50AA-75C9-4DE2-8E8B-3EBA22F6A1D8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3ED10B2F-4308-4A6C-95F9-50B28DF6253C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{46B08AA2-C2E6-4829-AB67-85A408C294D7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{667A8EB1-CFEC-4CBB-B2E5-A060937324EC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{82E346F1-4485-4287-B0B7-5F7EE8B6C88E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{8AE05991-DF8D-4A22-B6D3-D373F0BCE783}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{9C0E07CC-FD24-48AC-9B92-F9EDE7310A8E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B5258A3D-0B61-47AA-B059-C38B0AF46E75}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BE004F72-4D96-44D8-8773-2ADB8684CF41}" = protocol=6 | dir=out | app=system |
"{C1E05AFA-2A3C-4870-BF4C-ADD24751812D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C23E2D7A-D908-45D5-9103-D601F99F38F5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C5770090-7E31-4D66-AD1F-FEBBC6A77F7C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D748D32E-0F4C-4929-92EB-99951C944B2C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E87605A2-D99A-45ED-92FB-F2A0F02A6B69}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{5B8025EF-2449-41FE-9E20-C6FBE5D1F4E2}C:\program files\spssinc\statistics17\statistics.exe" = protocol=6 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe |
"TCP Query User{A4B37A3F-F184-4CB5-BA10-1C34FB7A14AD}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{B26D7D9B-06E4-4F10-B488-AC5AD4F07025}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
"TCP Query User{D563AA5A-97C3-4255-B7ED-60953FE7E9F1}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
"UDP Query User{1450BF88-C364-4BDE-88DB-AC8A0985DFF2}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{815D5560-F290-4358-BBAA-7179FD96B4DC}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
"UDP Query User{C5A14ABF-0648-4169-A4BC-C4E0D8478934}C:\program files\spssinc\statistics17\statistics.exe" = protocol=17 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe |
"UDP Query User{F91FB6DD-B1B6-4732-A0FC-D7F3B82A4774}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03F1CC67-5BD8-4C36-8394-76311B2AE69A}" = ArcSoft PhotoStudio 5
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}" = ATK Media
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = LifeFrame2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F698102-5739-441E-96F0-74F4EA540F06}" = Attansic Giga Ethernet Utility
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{232FDC0C-12DE-41F2-9701-27EFCA18BEF9}" = MediaJoin
"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}" = ATK Hotkey
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{46B65150-F8AA-42F2-94FB-2729A8AE5F7E}" = SPSS Statistics 17.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BC1CB2B-FDCE-4DB4-A557-BA8127569B0D}" = StarOffice 8
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57B15AD4-8C9D-4164-82BB-E33D8644E757}" = ASUS InstantFun
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}" = ATKOSD2
"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7F77DB04-A969-40a4-89EF-06CE06D56524}" = pdfforge Toolbar v5.0
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8CFEBE9C-F29F-4C49-80E0-7106970F8734}" = Power4Gear eXtreme
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D6D7811-43B3-463C-BC79-5D1755269989}" = Net4Switch
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B360A8E5-C171-4AAE-9777-65B3CDB0072C}" = CanoScan LiDE20,30 Manual
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BC61F51E-8AF7-46B9-AF20-B33B5EE81031}" = Nero 7 Essentials
"{BF8780F3-CB8E-4AB0-9AA4-52E1BD574226}" = ATLAS.ti 6.2 Demo
"{C0FC1C14-4824-4A73-87A6-9E888C9C3102}" = ASUS Splendid Video Enhancement Technology
"{C1D14C0D-FDAA-4DF2-8441-A902805CCE8C}" = ArcSoft PhotoBase 3
"{C2075010-F77F-44CD-8EAF-DEBCD14A46CD}" = TVGo DVB-T02PRO
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE86A0E7-818D-43EC-A181-59BA9BD3EF2E}" = LightScribe  1.8.13.1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DB891739-2EB3-45A8-9CBD-941C255CECD4}" = ASUS Touch Pad Extra
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{E6BF9670-C9E9-461A-9B14-B5ADAC3176CF}" = Cisco AnyConnect VPN Client
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FC3D290D-79BE-44B7-ABF9-FDD110925930}" = PowerForPhone
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"Canon CanoScan Toolbox 4.0" = Canon CanoScan Toolbox 4.0
"CCleaner" = CCleaner (remove only)
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"ElsterFormular 11.1.0 11.1.0.***unknown variable buildnummer***" = ElsterFormular 11.1.0
"f4" = f4 3.1.0
"GOM Player" = GOM Player
"LucasArts' Curse of Monkey Island" = LucasArts' Curse of Monkey Island
"MediaJoin" = MediaJoin
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Miranda IM" = Miranda IM 0.7.10
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"PHPNukeDE Toolbar" = PHPNukeDE Toolbar
"Picasa 3" = Picasa 3
"Samsung ML-2010 Series" = Samsung ML-2010 Series
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Universal Document Converter_is1" = Universal Document Converter (Demo)
"USB2.0 1.3M WebCam" = USB2.0 1.3M WebCam
"WordToPDF_is1" = WordToPDF 2.4
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 19.03.2011 16:14:18 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 1064  Anfangszeit: 01cbe670a90e356c  Zeitpunkt
 der Beendigung: 31
 
Error - 19.03.2011 17:16:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 13d4  Anfangszeit: 01cbe67a9b328781  Zeitpunkt
 der Beendigung: 0
 
Error - 22.03.2011 12:02:51 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: bb0  Anfangszeit: 01cbe8a808dcae6d  Zeitpunkt
 der Beendigung: 172
 
Error - 22.03.2011 12:06:01 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: dc4  Anfangszeit: 01cbe8aad6369487  Zeitpunkt der
 Beendigung: 47
 
Error - 22.03.2011 12:15:39 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: d4  Anfangszeit: 01cbe8ab10e44570  Zeitpunkt der
Beendigung: 16
 
Error - 22.03.2011 12:18:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 7b4  Anfangszeit: 01cbe8aa9b8b8dc4  Zeitpunkt
 der Beendigung: 94
 
Error - 03.04.2011 11:47:29 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit
 Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 12d4  Anfangszeit: 01cbf2160a75b91f  Zeitpunkt
 der Beendigung: 31
 
Error - 03.04.2011 11:48:17 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit
 Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 17ac  Anfangszeit: 01cbf21676aa0a7d  Zeitpunkt
 der Beendigung: 125
 
Error - 03.04.2011 11:53:09 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 1244  Anfangszeit: 01cbf216944ba00f  Zeitpunkt der
 Beendigung: 47
 
Error - 04.04.2011 13:21:03 | Computer Name = janka-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 7.0.6001.18565, Zeitstempel
 0x4d0f5fa9, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x8e8a770b,  Prozess-ID 0xc10, Anwendungsstartzeit
 01cbf2e87d4acd67.
 
[ Cisco AnyConnect VPN Client Events ]
Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line:
2188 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::applyHostConfigForNoVpn File: .\MainThread.cpp
Line:
 7578 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::OnTimerExpired File: .\MainThread.cpp Line: 4128
Invoked
 Function: CMainThread::applyHostConfigForNoVpn Return Code: -33095647 (0xFE070021)
Description:
 ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2484 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line:
2188 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 06.03.2012 12:52:02 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 06.03.2012 13:04:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 07.03.2012 15:15:54 | Computer Name = JANKA-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 08.03.2012 05:24:59 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 08.03.2012 05:29:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

--- --- ---

Trivandrum 08.03.2012 11:32

Ich habe versucht, die Punkte der Checkliste auszuführen, allerdings konnte ich dieses dds nicht machen.
Wenn ich auf ausführen geklickt habe, dann kam kurz ein schwarzes Feld mit weißer Schrift, das war dann allerdings gleich wieder weg.
Jetzt weiß ich nicht, ob ich mit den nächsten Schritten weitermachen soll.

markusg 08.03.2012 11:54

hi


dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:

:OTL
O4 - HKCU..\Run: [{0E330D6F-EC24-11DD-9B90-806E6F6E6963}] C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe ()
 :Files
C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]



• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!




Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Trivandrum 08.03.2012 13:34

Hallo,
vielen Dank schonmal für die Hilfe.
OTL hat Folgendes ausgespuckt:
[spoiler]Error: Unable to interpret <OTL EXTRAS Logfile:
Code:

OTL Extras logfile created on: 08.03.2012 10:35:18 - Run 2> in the current context!
Error: Unable to interpret <OTL by OldTimer - Version 3.2.36.1    Folder = C:\Users\janka\Downloads> in the current context!
Error: Unable to interpret <Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation> in the current context!
Error: Unable to interpret <Internet Explorer (Version = 7.0.6001.18000)> in the current context!
Error: Unable to interpret <Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <1,87 Gb Total Physical Memory | 1,39 Gb Available Physical Memory | 73,97% Memory free> in the current context!
Error: Unable to interpret <3,98 Gb Paging File | 3,65 Gb Available in Paging File | 91,75% Paging File free> in the current context!
Error: Unable to interpret <Paging file location(s): ?:\pagefile.sys [binary data]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files> in the current context!
Error: Unable to interpret <Drive C: | 74,52 Gb Total Space | 33,99 Gb Free Space | 45,61% Space Free | Partition Type: NTFS> in the current context!
Error: Unable to interpret <Drive D: | 67,69 Gb Total Space | 11,16 Gb Free Space | 16,48% Space Free | Partition Type: NTFS> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Computer Name: JANKA-PC | User Name: janka | Logged in as Administrator.> in the current context!
Error: Unable to interpret <Boot Mode: SafeMode with Networking | Scan Mode: Current user> in the current context!
Error: Unable to interpret <Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Extra Registry (SafeList) ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== File Associations ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]> in the current context!
Error: Unable to interpret <.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]> in the current context!
Error: Unable to interpret <.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Shell Spawning ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]> in the current context!
Error: Unable to interpret <batfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <cmdfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <comfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)> in the current context!
Error: Unable to interpret <exefile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <helpfile [open] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)> in the current context!
Error: Unable to interpret <inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)> in the current context!
Error: Unable to interpret <InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l> in the current context!
Error: Unable to interpret <piffile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <regfile [merge] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <scrfile [config] -- "%1"> in the current context!
Error: Unable to interpret <scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l> in the current context!
Error: Unable to interpret <scrfile [open] -- "%1" /S> in the current context!
Error: Unable to interpret <txtfile [edit] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1> in the current context!
Error: Unable to interpret <Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Security Center Settings ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]> in the current context!
Error: Unable to interpret <"cval" = 0> in the current context!
Error: Unable to interpret <"UacDisableNotify" = 0> in the current context!
Error: Unable to interpret <"InternetSettingsDisableNotify" = 0> in the current context!
Error: Unable to interpret <"AutoUpdateDisableNotify" = 0> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]> in the current context!
Error: Unable to interpret <"DisableMonitoring" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]> in the current context!
Error: Unable to interpret <"DisableMonitoring" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]> in the current context!
Error: Unable to interpret <"DisableMonitoring" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]> in the current context!
Error: Unable to interpret <"AntiVirusOverride" = 0> in the current context!
Error: Unable to interpret <"AntiSpywareOverride" = 0> in the current context!
Error: Unable to interpret <"FirewallOverride" = 0> in the current context!
Error: Unable to interpret <"VistaSp1" = Reg Error: Unknown registry data type -- File not found> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Firewall Settings ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]> in the current context!
Error: Unable to interpret <"DisableNotifications" = 0> in the current context!
Error: Unable to interpret <"EnableFirewall" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]> in the current context!
Error: Unable to interpret <"DisableNotifications" = 0> in the current context!
Error: Unable to interpret <"EnableFirewall" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]> in the current context!
Error: Unable to interpret <"DisableNotifications" = 0> in the current context!
Error: Unable to interpret <"EnableFirewall" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Authorized Applications List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Vista Active Open Ports Exception List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]> in the current context!
Error: Unable to interpret <"{1331460E-B590-4AFB-8603-73FE6D222879}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{2EC5F36A-0D12-4DDE-B804-EB6A53C5A708}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{3259E05C-38C1-4087-A7B3-6766781E5D16}" = lport=138 | protocol=17 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{33CFD4D0-0DB2-4F95-A514-94E4BE68C109}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{35F1B5CE-ACF8-401E-BBC9-3A722E77D980}" = rport=445 | protocol=6 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{3B500FAA-74C6-4FF3-88D3-143B2CDAB40D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | > in the current context!
Error: Unable to interpret <"{3B665BE4-6869-4D89-AE92-94163397BFCD}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{4CF29A67-8032-4409-9897-C85640FE8811}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{525E39D6-CB13-43EB-8489-FAE0EFEE9A71}" = lport=137 | protocol=17 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{53A89469-2A6C-4D4A-99AB-AFAA84F479C4}" = lport=10243 | protocol=6 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{54679428-10C0-4EC8-AED2-6768E60CE652}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{59C4ADAC-156A-4299-ADD9-8DA74FEABD10}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{6546DC7F-F3DC-4C77-8750-4C45EB86CB50}" = rport=10243 | protocol=6 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{73FC3AC9-403D-480B-85CA-ED73BDCF41A3}" = rport=138 | protocol=17 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{8026C332-3A9B-4E68-B971-5BCC3FBB3977}" = lport=445 | protocol=6 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{83BFA2E7-FA2A-47B7-A8E8-3D5ED5DE6DD9}" = lport=139 | protocol=6 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{8DECB48A-29C3-4172-97B6-D212510825F8}" = rport=139 | protocol=6 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{90052951-F440-4EBB-91E1-E73C826F8156}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{92E7EE81-4D78-4FD8-9B30-FE812D1E332B}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{9BDC01F3-521D-4F76-A68B-36F0C5975B63}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{A0DC2738-F1AD-45B1-9B81-95C4D1AA0933}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{B80EE33D-5478-4B79-87F3-44C8FD5F27A2}" = lport=2869 | protocol=6 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{D2C5D045-4764-42C5-9198-A229DDCE2F7C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | > in the current context!
Error: Unable to interpret <"{DD566E88-255C-4D32-87ED-9FA01C69ED02}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{F2A2F446-7FF9-4E1F-B4CD-EFE8036C1074}" = rport=137 | protocol=17 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{F4FCD3B3-4949-4709-9632-6F99F977DB30}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{FCFD4861-3929-407A-AF2C-342FBB91E70D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Vista Active Application Exception List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]> in the current context!
Error: Unable to interpret <"{073A3800-60AA-4E07-9911-F9BB8D13F5BD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | > in the current context!
Error: Unable to interpret <"{13BB991E-E367-4D8F-9521-F94B757C3146}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{2F2E5710-5833-4FF0-B3A1-016DFB989F9B}" = dir=in | app=c:\program files\skype\phone\skype.exe | > in the current context!
Error: Unable to interpret <"{2FF348E0-717F-4397-9E24-386367E0A35F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{31FF50AA-75C9-4DE2-8E8B-3EBA22F6A1D8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{3ED10B2F-4308-4A6C-95F9-50B28DF6253C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | > in the current context!
Error: Unable to interpret <"{46B08AA2-C2E6-4829-AB67-85A408C294D7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{667A8EB1-CFEC-4CBB-B2E5-A060937324EC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{82E346F1-4485-4287-B0B7-5F7EE8B6C88E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | > in the current context!
Error: Unable to interpret <"{8AE05991-DF8D-4A22-B6D3-D373F0BCE783}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | > in the current context!
Error: Unable to interpret <"{9C0E07CC-FD24-48AC-9B92-F9EDE7310A8E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{B5258A3D-0B61-47AA-B059-C38B0AF46E75}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{BE004F72-4D96-44D8-8773-2ADB8684CF41}" = protocol=6 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{C1E05AFA-2A3C-4870-BF4C-ADD24751812D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | > in the current context!
Error: Unable to interpret <"{C23E2D7A-D908-45D5-9103-D601F99F38F5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | > in the current context!
Error: Unable to interpret <"{C5770090-7E31-4D66-AD1F-FEBBC6A77F7C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{D748D32E-0F4C-4929-92EB-99951C944B2C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | > in the current context!
Error: Unable to interpret <"{E87605A2-D99A-45ED-92FB-F2A0F02A6B69}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | > in the current context!
Error: Unable to interpret <"TCP Query User{5B8025EF-2449-41FE-9E20-C6FBE5D1F4E2}C:\program files\spssinc\statistics17\statistics.exe" = protocol=6 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe | > in the current context!
Error: Unable to interpret <"TCP Query User{A4B37A3F-F184-4CB5-BA10-1C34FB7A14AD}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | > in the current context!
Error: Unable to interpret <"TCP Query User{B26D7D9B-06E4-4F10-B488-AC5AD4F07025}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | > in the current context!
Error: Unable to interpret <"TCP Query User{D563AA5A-97C3-4255-B7ED-60953FE7E9F1}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | > in the current context!
Error: Unable to interpret <"UDP Query User{1450BF88-C364-4BDE-88DB-AC8A0985DFF2}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | > in the current context!
Error: Unable to interpret <"UDP Query User{815D5560-F290-4358-BBAA-7179FD96B4DC}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | > in the current context!
Error: Unable to interpret <"UDP Query User{C5A14ABF-0648-4169-A4BC-C4E0D8478934}C:\program files\spssinc\statistics17\statistics.exe" = protocol=17 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe | > in the current context!
Error: Unable to interpret <"UDP Query User{F91FB6DD-B1B6-4732-A0FC-D7F3B82A4774}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== HKEY_LOCAL_MACHINE Uninstall List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]> in the current context!
Error: Unable to interpret <"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator> in the current context!
Error: Unable to interpret <"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148> in the current context!
Error: Unable to interpret <"{03F1CC67-5BD8-4C36-8394-76311B2AE69A}" = ArcSoft PhotoStudio 5> in the current context!
Error: Unable to interpret <"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu> in the current context!
Error: Unable to interpret <"{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}" = ATK Media> in the current context!
Error: Unable to interpret <"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter> in the current context!
Error: Unable to interpret <"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate> in the current context!
Error: Unable to interpret <"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = LifeFrame2> in the current context!
Error: Unable to interpret <"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148> in the current context!
Error: Unable to interpret <"{1F698102-5739-441E-96F0-74F4EA540F06}" = Attansic Giga Ethernet Utility> in the current context!
Error: Unable to interpret <"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime> in the current context!
Error: Unable to interpret <"{232FDC0C-12DE-41F2-9701-27EFCA18BEF9}" = MediaJoin> in the current context!
Error: Unable to interpret <"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7> in the current context!
Error: Unable to interpret <"{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}" = ATK Hotkey> in the current context!
Error: Unable to interpret <"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile> in the current context!
Error: Unable to interpret <"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker> in the current context!
Error: Unable to interpret <"{46B65150-F8AA-42F2-94FB-2729A8AE5F7E}" = SPSS Statistics 17.0> in the current context!
Error: Unable to interpret <"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater> in the current context!
Error: Unable to interpret <"{4BC1CB2B-FDCE-4DB4-A557-BA8127569B0D}" = StarOffice 8> in the current context!
Error: Unable to interpret <"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml> in the current context!
Error: Unable to interpret <"{57B15AD4-8C9D-4164-82BB-E33D8644E757}" = ASUS InstantFun> in the current context!
Error: Unable to interpret <"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3> in the current context!
Error: Unable to interpret <"{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}" = ATKOSD2> in the current context!
Error: Unable to interpret <"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe> in the current context!
Error: Unable to interpret <"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update> in the current context!
Error: Unable to interpret <"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729> in the current context!
Error: Unable to interpret <"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable> in the current context!
Error: Unable to interpret <"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762> in the current context!
Error: Unable to interpret <"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053> in the current context!
Error: Unable to interpret <"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec> in the current context!
Error: Unable to interpret <"{7F77DB04-A969-40a4-89EF-06CE06D56524}" = pdfforge Toolbar v5.0> in the current context!
Error: Unable to interpret <"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent> in the current context!
Error: Unable to interpret <"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2> in the current context!
Error: Unable to interpret <"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570> in the current context!
Error: Unable to interpret <"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight> in the current context!
Error: Unable to interpret <"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player> in the current context!
Error: Unable to interpret <"{8CFEBE9C-F29F-4C49-80E0-7106970F8734}" = Power4Gear eXtreme> in the current context!
Error: Unable to interpret <"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system> in the current context!
Error: Unable to interpret <"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme> in the current context!
Error: Unable to interpret <"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage> in the current context!
Error: Unable to interpret <"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars> in the current context!
Error: Unable to interpret <"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17> in the current context!
Error: Unable to interpret <"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161> in the current context!
Error: Unable to interpret <"{9D6D7811-43B3-463C-BC79-5D1755269989}" = Net4Switch> in the current context!
Error: Unable to interpret <"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder> in the current context!
Error: Unable to interpret <"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter> in the current context!
Error: Unable to interpret <"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch> in the current context!
Error: Unable to interpret <"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder> in the current context!
Error: Unable to interpret <"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter> in the current context!
Error: Unable to interpret <"{B360A8E5-C171-4AAE-9777-65B3CDB0072C}" = CanoScan LiDE20,30 Manual> in the current context!
Error: Unable to interpret <"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player> in the current context!
Error: Unable to interpret <"{BC61F51E-8AF7-46B9-AF20-B33B5EE81031}" = Nero 7 Essentials> in the current context!
Error: Unable to interpret <"{BF8780F3-CB8E-4AB0-9AA4-52E1BD574226}" = ATLAS.ti 6.2 Demo> in the current context!
Error: Unable to interpret <"{C0FC1C14-4824-4A73-87A6-9E888C9C3102}" = ASUS Splendid Video Enhancement Technology> in the current context!
Error: Unable to interpret <"{C1D14C0D-FDAA-4DF2-8441-A902805CCE8C}" = ArcSoft PhotoBase 3> in the current context!
Error: Unable to interpret <"{C2075010-F77F-44CD-8EAF-DEBCD14A46CD}" = TVGo DVB-T02PRO> in the current context!
Error: Unable to interpret <"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1> in the current context!
Error: Unable to interpret <"{CE86A0E7-818D-43EC-A181-59BA9BD3EF2E}" = LightScribe  1.8.13.1> in the current context!
Error: Unable to interpret <"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2> in the current context!
Error: Unable to interpret <"{DB891739-2EB3-45A8-9CBD-941C255CECD4}" = ASUS Touch Pad Extra> in the current context!
Error: Unable to interpret <"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader> in the current context!
Error: Unable to interpret <"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash> in the current context!
Error: Unable to interpret <"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update> in the current context!
Error: Unable to interpret <"{E6BF9670-C9E9-461A-9B14-B5ADAC3176CF}" = Cisco AnyConnect VPN Client> in the current context!
Error: Unable to interpret <"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver> in the current context!
Error: Unable to interpret <"{FC3D290D-79BE-44B7-ABF9-FDD110925930}" = PowerForPhone> in the current context!
Error: Unable to interpret <"Adobe Acrobat 5.0" = Adobe Acrobat 5.0> in the current context!
Error: Unable to interpret <"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX> in the current context!
Error: Unable to interpret <"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver> in the current context!
Error: Unable to interpret <"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus> in the current context!
Error: Unable to interpret <"AVMFBox" = AVM FRITZ!Box Dokumentation> in the current context!
Error: Unable to interpret <"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss> in the current context!
Error: Unable to interpret <"Canon CanoScan Toolbox 4.0" = Canon CanoScan Toolbox 4.0> in the current context!
Error: Unable to interpret <"CCleaner" = CCleaner (remove only)> in the current context!
Error: Unable to interpret <"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters> in the current context!
Error: Unable to interpret <"ElsterFormular 11.1.0 11.1.0.***unknown variable buildnummer***" = ElsterFormular 11.1.0> in the current context!
Error: Unable to interpret <"f4" = f4 3.1.0> in the current context!
Error: Unable to interpret <"GOM Player" = GOM Player> in the current context!
Error: Unable to interpret <"LucasArts' Curse of Monkey Island" = LucasArts' Curse of Monkey Island> in the current context!
Error: Unable to interpret <"MediaJoin" = MediaJoin> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile> in the current context!
Error: Unable to interpret <"Miranda IM" = Miranda IM 0.7.10> in the current context!
Error: Unable to interpret <"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)> in the current context!
Error: Unable to interpret <"PHPNukeDE Toolbar" = PHPNukeDE Toolbar> in the current context!
Error: Unable to interpret <"Picasa 3" = Picasa 3> in the current context!
Error: Unable to interpret <"Samsung ML-2010 Series" = Samsung ML-2010 Series> in the current context!
Error: Unable to interpret <"SMSERIAL" = Motorola SM56 Speakerphone Modem> in the current context!
Error: Unable to interpret <"SynTPDeinstKey" = Synaptics Pointing Device Driver> in the current context!
Error: Unable to interpret <"Universal Document Converter_is1" = Universal Document Converter (Demo)> in the current context!
Error: Unable to interpret <"USB2.0 1.3M WebCam" = USB2.0 1.3M WebCam> in the current context!
Error: Unable to interpret <"WordToPDF_is1" = WordToPDF 2.4> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Last 10 Event Log Errors ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[ Application Events ]> in the current context!
Error: Unable to interpret <Error - 19.03.2011 16:14:18 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr > in the current context!
Error: Unable to interpret <mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: 1064  Anfangszeit: 01cbe670a90e356c  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 31> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 19.03.2011 17:16:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr > in the current context!
Error: Unable to interpret <mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: 13d4  Anfangszeit: 01cbe67a9b328781  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 0> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 22.03.2011 12:02:51 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr > in the current context!
Error: Unable to interpret <mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: bb0  Anfangszeit: 01cbe8a808dcae6d  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 172> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 22.03.2011 12:06:01 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit > in the current context!
Error: Unable to interpret <Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet > in the current context!
Error: Unable to interpret <"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über> in the current context!
Error: Unable to interpret < das Problem zu suchen.  Prozess-ID: dc4  Anfangszeit: 01cbe8aad6369487  Zeitpunkt der> in the current context!
Error: Unable to interpret < Beendigung: 47> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 22.03.2011 12:15:39 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit > in the current context!
Error: Unable to interpret <Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet > in the current context!
Error: Unable to interpret <"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über> in the current context!
Error: Unable to interpret < das Problem zu suchen.  Prozess-ID: d4  Anfangszeit: 01cbe8ab10e44570  Zeitpunkt der > in the current context!
Error: Unable to interpret <Beendigung: 16> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 22.03.2011 12:18:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr > in the current context!
Error: Unable to interpret <mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: 7b4  Anfangszeit: 01cbe8aa9b8b8dc4  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 94> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.04.2011 11:47:29 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit> in the current context!
Error: Unable to interpret < Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: 12d4  Anfangszeit: 01cbf2160a75b91f  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 31> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.04.2011 11:48:17 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit> in the current context!
Error: Unable to interpret < Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: 17ac  Anfangszeit: 01cbf21676aa0a7d  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 125> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.04.2011 11:53:09 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit > in the current context!
Error: Unable to interpret <Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet > in the current context!
Error: Unable to interpret <"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über> in the current context!
Error: Unable to interpret < das Problem zu suchen.  Prozess-ID: 1244  Anfangszeit: 01cbf216944ba00f  Zeitpunkt der> in the current context!
Error: Unable to interpret < Beendigung: 47> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 04.04.2011 13:21:03 | Computer Name = janka-PC | Source = Application Error | ID = 1000> in the current context!
Error: Unable to interpret <Description = Fehlerhafte Anwendung iexplore.exe, Version 7.0.6001.18565, Zeitstempel> in the current context!
Error: Unable to interpret < 0x4d0f5fa9, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,> in the current context!
Error: Unable to interpret < Ausnahmecode 0xc0000005, Fehleroffset 0x8e8a770b,  Prozess-ID 0xc10, Anwendungsstartzeit> in the current context!
Error: Unable to interpret < 01cbf2e87d4acd67.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[ Cisco AnyConnect VPN Client Events ]> in the current context!
Error: Unable to interpret <Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866> in the current context!
Error: Unable to interpret <Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line: > in the current context!
Error: Unable to interpret <2188 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647> in the current context!
Error: Unable to interpret < (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866> in the current context!
Error: Unable to interpret <Description = Function: CMainThread::applyHostConfigForNoVpn File: .\MainThread.cpp> in the current context!
Error: Unable to interpret <Line:> in the current context!
Error: Unable to interpret < 7578 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33095647> in the current context!
Error: Unable to interpret < (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866> in the current context!
Error: Unable to interpret <Description = Function: CMainThread::OnTimerExpired File: .\MainThread.cpp Line: 4128> in the current context!
Error: Unable to interpret <Invoked> in the current context!
Error: Unable to interpret < Function: CMainThread::applyHostConfigForNoVpn Return Code: -33095647 (0xFE070021)> in the current context!
Error: Unable to interpret <Description:> in the current context!
Error: Unable to interpret < ROUTETABLE_ERROR_GETBESTROUTE_FAILED > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866> in the current context!
Error: Unable to interpret <Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp> in the current context!
Error: Unable to interpret <Line:> in the current context!
Error: Unable to interpret < 2484 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647 > in the current context!
Error: Unable to interpret <(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866> in the current context!
Error: Unable to interpret <Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line: > in the current context!
Error: Unable to interpret <2188 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647> in the current context!
Error: Unable to interpret < (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 12:52:02 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873> in the current context!
Error: Unable to interpret <Description = Termination reason code 9: Client PC is shutting down.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 13:04:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873> in the current context!
Error: Unable to interpret <Description = Termination reason code 9: Client PC is shutting down.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 07.03.2012 15:15:54 | Computer Name = JANKA-PC | Source = vpnagent | ID = 67110873> in the current context!
Error: Unable to interpret <Description = Termination reason code 9: Client PC is shutting down.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 08.03.2012 05:24:59 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873> in the current context!
Error: Unable to interpret <Description = Termination reason code 9: Client PC is shutting down.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 08.03.2012 05:29:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873> in the current context!
Error: Unable to interpret <Description = Termination reason code 9: Client PC is shutting down.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Last 10 Event Log Errors ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret << End of report >

--- --- ---
> in the current context!

OTL by OldTimer - Version 3.2.36.1 log created on 03082012_133027
[/spoiler]

Ich werde jetzt die anderen Schritte ausführen.

Trivandrum 08.03.2012 13:42

Ich habe gerade versucht, meinen PC im normalen Modus zu starten.
Leider kam nach kurzer Zeit wieder der Virus.
Deswegen weiß ich nicht, was ich tun soll:

Ich könnte wieder in den abgesicherten modus gehen und da die weiteren Schritte ausführen.

Oder ich könnte den PC im normalen Modus starten, allerdings mit einem anderen Benutzer.

Grüße

Trivandrum 08.03.2012 15:24

Hallo,

es hat jetzt doch alles geklappt, ich habe OTL als Administrator geöffnetund dann gings.
Folgendes kam dabei raus:

[spoiler]All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{0E330D6F-EC24-11DD-9B90-806E6F6E6963} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E330D6F-EC24-11DD-9B90-806E6F6E6963}\ not found.
C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: janka
->Flash cache emptied: 12688 bytes

User: klaus
->Flash cache emptied: 626 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: janka
->Temp folder emptied: 7127902 bytes
->Temporary Internet Files folder emptied: 171942174 bytes
->Java cache emptied: 48184 bytes
->FireFox cache emptied: 74380793 bytes
->Flash cache emptied: 0 bytes

User: klaus
->Temp folder emptied: 577126 bytes
->Temporary Internet Files folder emptied: 23336854 bytes
->FireFox cache emptied: 49520684 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4046190 bytes
RecycleBin emptied: 162556 bytes

Total Files Cleaned = 316,00 mb


OTL by OldTimer - Version 3.2.36.1 log created on 03082012_150926

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
[/spoiler]

Ich habe die Sachen auch im Upload hochgeladen.

Muss ich noch etwas machen oder ist der Virus nun beseitigt?

markusg 08.03.2012 15:50

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  • Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Trivandrum 08.03.2012 17:01

FOlgendes kam dabei raus:

Combofix Logfile:
Code:

ComboFix 12-03-08.02 - janka 08.03.2012  16:30:41.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6001.1.1252.49.1031.18.1919.1151 [GMT 1:00]
ausgeführt von:: c:\users\janka\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\janka\Firefox_Setup_10.0.2.exe
c:\windows\unin0407.exe
c:\windows\WindowsUpdate.log
.
Infizierte Kopie von c:\windows\system32\kernel32.dll wurde gefunden und desinfiziert
Kopie von - c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6002.18449_none_9582275d538a1db6\kernel32.dll wurde wiederhergestellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-02-08 bis 2012-03-08  ))))))))))))))))))))))))))))))
.
.
2012-03-08 12:30 . 2012-03-08 14:20        --------        d-----w-        C:\_OTL
2012-03-08 08:04 . 2012-03-08 08:04        --------        d-----w-        c:\users\klaus\AppData\Local\Mozilla
2012-03-07 14:41 . 2012-03-07 14:41        --------        d-----w-        c:\users\klaus\AppData\Roaming\Avira
2012-03-06 07:47 . 2012-02-08 06:03        6552120        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{EE2760AE-BB32-4382-81C3-5CCCAFA10515}\mpengine.dll
2012-03-05 13:25 . 2012-03-05 13:25        --------        d-----w-        c:\users\janka\AppData\Local\Mozilla
2012-03-03 17:51 . 2012-03-03 17:51        --------        d-----w-        c:\program files\Application Updater
2012-03-03 17:51 . 2012-03-03 17:51        --------        d-----w-        c:\program files\pdfforge Toolbar
2012-03-03 17:51 . 2012-03-03 17:51        --------        d-----w-        c:\program files\Common Files\Spigot
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-08 15:40 . 2009-01-26 11:25        45056        ----a-w-        c:\windows\system32\acovcnt.exe
2012-02-23 08:18 . 2009-10-03 13:28        237072        ------w-        c:\windows\system32\MpSigStub.exe
2011-12-14 07:36 . 2011-12-14 07:36        1207568        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-02-16 14:55 . 2012-03-05 13:25        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 451872]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"DetectTray"="c:\program files\Genius\TVGo DVB-T02PRO\DetectTray.exe" [2007-09-21 131072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-02 4186112]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-10-09 729088]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440]
"ASUSTPE"="c:\windows\system32\ASUSTPE.exe" [2006-12-12 106496]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-23 815104]
"ASUS Camera ScreenSaver"="c:\windows\ASScrProlog.exe" [2009-01-26 37232]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2009-01-26 33136]
"PowerForPhone"="c:\program files\PowerForPhone\PowerForPhone.exe" [2007-01-15 778240]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2007-01-02 520192]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-08 281768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"SearchSettings"="c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe" [2012-02-06 934240]
.
c:\users\janka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
StarOffice 8.lnk - c:\program files\Sun\StarOffice 8\program\quickstart.exe [2005-6-21 122880]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk /p \??\F:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-06-20 11:47        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.220.1
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/jordan.cab
DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://vpn-server.rrzn.uni-hannover.de/CACHE/stc/1/binaries/vpnweb.cab
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
FF - ProfilePath - c:\users\janka\AppData\Roaming\Mozilla\Firefox\Profiles\pfml280r.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=827316&ilc=12&p=
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{c9508125-4747-4733-b048-e4b82dc9716d} - c:\program files\PHPNukeDE\tbPHPN.dll
BHO-{c9508125-4747-4733-b048-e4b82dc9716d} - c:\program files\PHPNukeDE\tbPHPN.dll
Toolbar-{c9508125-4747-4733-b048-e4b82dc9716d} - c:\program files\PHPNukeDE\tbPHPN.dll
WebBrowser-{C9508125-4747-4733-B048-E4B82DC9716D} - c:\program files\PHPNukeDE\tbPHPN.dll
HKLM-Run-Zshutdown - c:\preload\patch\sysprep.cmd
HKLM-Run-QuickTime Task - c:\program files\QuickTime\QTTask.exe
AddRemove-DivX Plus DirectShow Filters - c:\users\janka\Downloads\DivX\DivXDSFiltersUninstall.exe
AddRemove-LucasArts' Curse of Monkey Island - c:\windows\unin0407.exe
AddRemove-Miranda IM - c:\program files\Miranda IM\Uninstall.exe
AddRemove-PHPNukeDE Toolbar - c:\progra~1\PHPNUK~1\UNWISE.EXE
AddRemove-{7585478E9D9B42108671C12F8714CEFE} - c:\users\janka\Downloads\DivX\DivXConverterUninstall.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\users\janka\Downloads\DivX\DivXCodecUninstall.exe
AddRemove-{8ADFC4160D694100B5B8A22DE9DCABD9} - c:\users\janka\Downloads\DivX\DivXPlayerUninstall.exe
AddRemove-{B13A7C41581B411290FBC0395694E2A9} - c:\users\janka\Downloads\DivX\DivXConverterUninstall.exe
AddRemove-{B7050CBDB2504B34BC2A9CA0A692CC29} - c:\users\janka\Downloads\DivX\DivXWebPlayerUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-03-08 16:40
Windows 6.0.6001 Service Pack 1 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
c:\program files\ATK Hotkey\ASLDRSrv.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Application Updater\ApplicationUpdater.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\windows\System32\StkCSrv.exe
c:\windows\system32\WUDFHost.exe
c:\program files\ASUS\Net4Switch\Net4Switch.exe
c:\program files\ATK Hotkey\Hcontrol.exe
c:\program files\ATKOSD2\ATKOSD2.exe
c:\program files\Wireless Console 2\wcourier.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\ASUS\Splendid\ACMON.exe
c:\windows\System32\ACEngSvr.exe
c:\program files\ATK Hotkey\ATKOSD.exe
c:\windows\system32\UI0Detect.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Sun\StarOffice 8\program\soffice.exe
c:\program files\Sun\StarOffice 8\program\soffice.BIN
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-03-08  16:48:50 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-03-08 15:48
.
Vor Suchlauf: 13 Verzeichnis(se), 34.339.741.696 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 34.530.611.200 Bytes frei
.
- - End Of File - - 7CAF0925A653F45CAD175F0240A5CD1B[/spoiler]

--- --- ---

markusg 08.03.2012 17:40

malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Trivandrum 08.03.2012 21:52

Es wurden keine infizierten Dateien gefunden, deswegen konnte ich auch nichts löschen.
Folgendes Ergebnis:
[spoiler]Malwarebytes Anti-Malware 1.60.1.1000
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.03.08.06

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
janka :: JANKA-PC [Administrator]

08.03.2012 20:29:52
mbam-log-2012-03-08 (20-29-52).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 334706
Laufzeit: 1 Stunde(n), 14 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
[/spoiler]

markusg 09.03.2012 13:08

Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.

wenn fertig, melden bitte

Trivandrum 09.03.2012 15:29

Okay, auch das ist erledigt!

markusg 09.03.2012 15:33

rechtsklick auf computer, eigenschaften, guck mal welches servicepack instaliert ist.

Trivandrum 09.03.2012 16:18

Es ist servicepack 2 installiert.

markusg 09.03.2012 16:22

sehr gut.

lade den CCleaner standard:
CCleaner Download - CCleaner 3.16.1666
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Trivandrum 09.03.2012 16:36

Adobe Acrobat 5.0 Adobe Systems, Inc. 18.02.2009 12,6MB notwendig
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 25.01.2009 notwendig
Adobe Reader 9.3.2 - Deutsch Adobe Systems Incorporated 20.04.2010 251,3MB notwendig
Apple Software Update Apple Inc. 07.02.2009 2,16MB unbekannt
ArcSoft PhotoBase 3 18.02.2009 72,2MB unbekannt
ArcSoft PhotoStudio 5 18.02.2009 22,9MB unbekannt
ASUS InstantFun ASUS 25.01.2009 14,6MB unbekannt
ASUS Live Update ASUS 25.01.2009 0,45MB unbekannt
ASUS Splendid Video Enhancement Technology ASUSTeK 25.01.2009 15,8MB unbekannt
ASUS Touch Pad Extra 25.01.2009 0,78MB unbekannt
Asus_Camera_ScreenSaver ASUS 25.01.2009 notwendig
ATK Hotkey ATK 25.01.2009 4,58MB unbekannt
ATK Media 25.01.2009 0,63MB unbekannt
ATKOSD2 ATK 25.01.2009 7,35MB unbekannt
ATLAS.ti 6.2 Demo ATLAS.ti Scientific Software Development GmbH 21.11.2010 63,1MB notwendig
Attansic Giga Ethernet Utility 25.01.2009 1,94MB unbekannt
Avira AntiVir Personal - Free Antivirus Avira GmbH 23.02.2012 196,6MB notwendig
AVM FRITZ!Box Dokumentation AVM Berlin 20.02.2009 1,80MB notwendig
AVM FRITZ!Box Druckeranschluss AVM Berlin 20.02.2009 notwendig
Canon CanoScan Toolbox 4.0 18.02.2009 5,99MB notwendig
CanoScan LiDE20,30 Manual 18.02.2009 1,20MB notwendig
CCleaner (remove only) Piriform 12.08.2009 2,63MB notwendig
Cisco AnyConnect VPN Client Cisco Systems, Inc. 19.05.2011 4,51MB unnötig
Compatibility Pack for the 2007 Office system Microsoft Corporation 29.02.2012 179,3MB notwendig
ElsterFormular 11.1.0 Landesfinanzdirektion Thüringen 06.02.2010 123,9MB notwendig
f4 3.1.0 MAXqda 24.11.2010 8,18MB notwendig
GOM Player 07.02.2009 20,9MB unnötig
Java(TM) 6 Update 27 Oracle 23.09.2011 95,0MB unbekannt
Java(TM) 6 Update 7 Sun Microsystems, Inc. 11.11.2010 163,8MB unbekannt
LifeFrame2 ASUS 25.01.2009 9,85MB unbekannt
Malwarebytes Anti-Malware Version 1.60.1.1000 Malwarebytes Corporation 07.03.2012 11,5MB unnötig
MediaJoin Mystik Media 24.11.2010 unbekannt
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 15.02.2009 37,0MB unbekannt
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 14.02.2009 37,0MB unbekannt
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 08.09.2010 120,3MB unbekannt
Microsoft Office Live Add-in 1.3 Microsoft Corporation 14.02.2009 0,48MB unbekannt
Microsoft Office XP Professional mit FrontPage Microsoft Corporation 15.06.2011 710,3MB unbekannt
Microsoft Silverlight Microsoft Corporation 15.02.2012 94,1MB unbekannt
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 29.11.2010 0,25MB unbekannt
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 15.06.2011 0,29MB unbekannt
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Corporation 29.07.2009 0,19MB unbekannt
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Corporation 15.04.2011 0,58MB unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Corporation 06.02.2010 0,58MB unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 23.06.2009 0,58MB unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 03.11.2010 0,58MB unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 15.06.2011 0,58MB unbekannt
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme Microsoft Corporation 23.02.2011 0,13MB unbekannt
Motorola SM56 Speakerphone Modem 25.01.2009 1,82MB unbekannt
Mozilla Firefox 10.0.2 (x86 de) Mozilla 04.03.2012 35,6MB notwendig
MSXML 4.0 SP2 (KB927978) Microsoft Corporation 17.04.2007 1,24MB unbekannt
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 25.01.2009 1,28MB unbekannt
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 25.11.2009 1,34MB unbekannt
NB Probe 25.01.2009 2,57MB unbekannt
Nero 7 Essentials Nero AG 26.01.2009 1.190,0MB notwendig
Net4Switch 25.01.2009 6,20MB unbekannt
PDFCreator Frank Heindörfer, Philip Chinery 23.02.2011 26,5MB notwendig
pdfforge Toolbar v5.0 Spigot, Inc. 02.03.2012 2,83MB nötig
Picasa 3 Google, Inc. 02.03.2011 73,5MB unnötig
Power4Gear eXtreme ATK 25.01.2009 4,69MB unbekannt
PowerForPhone PowerForPhone 25.01.2009 0,75MB unbekannt
QuickTime Apple Inc. 07.02.2009 74,4MB unnötig
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 25.01.2009 10,8MB unbekannt
Realtek USB 2.0 Card Reader Realtek 25.01.2009 1,80MB unbekannt
Samsung ML-2010 Series Samsung Electronics CO.,LTD 14.02.2009 78,7MB notwendig
Skype Toolbars Skype Technologies S.A. 12.10.2010 5,39MB notwendig
Skype™ 4.2 Skype Technologies S.A. 12.10.2010 19,5MB notwendig
SPSS Statistics 17.0 SPSS Inc. 28.11.2010 691,8MB notwendig
StarOffice 8 Sun Microsystems 04.02.2009 531,5MB notwendig
Synaptics Pointing Device Driver Synaptics 25.01.2009 12,8MB unbekannt
TVGo DVB-T02PRO Genius 26.02.2010 13,0MB unnötig
Universal Document Converter (Demo) fCoder Group, Inc. 23.02.2011 10,8MB unnötig
USB2.0 1.3M WebCam 25.01.2009 unbekannt
Windows Live Anmelde-Assistent Microsoft Corporation 04.03.2009 1,93MB unbekannt
WinFlash 25.01.2009 1,32MB unbekannt
Wireless Console 2 ATK 25.01.2009 1,59MB unbekannt
WordToPDF 2.4 Mario Noack 23.02.2011 4,11MB notwendig

markusg 09.03.2012 16:37

was ist mit den nicht beschrifteten?

Trivandrum 09.03.2012 16:43

hatte ich vergessen, jetzt ist es geändert.

markusg 09.03.2012 16:55

deinstaliere:
Adobe Acrobat 5.0
hast ja bereits acrobat reader, sollte das selbe sein.
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok



deinstaliere:
ArcSoft : beide
Cisco
GOM
Java: alle
Download der kostenlosen Java-Software
downloade java jre, instalieren

deinstaliere:
MediaJoin Mystik
Microsoft Office : falls du es nicht verwendest, weg.
Microsoft Silverlight
pdfforge Toolbar
Picasa
QuickTime
Skype Toolbars

Kostenlose Internetanrufe mit Skype. Telefone online billig anrufen
hier skype 5 laden

deinstaliere:
TVGo
Universal Document
Windows Live
öffne otl bereinigen neustart.
öffne ccleaner analysieren bereinigen neustart.
testen wie der pc läuft

Trivandrum 09.03.2012 17:43

Ich wollte gerade otl starten, da kam der virus wieder...
Jetzt bin ich wieder im abgesicherten Modus.
Was kann ich tun?

markusg 09.03.2012 17:45

wie der kam wieder.
hast du irgendwas im internet gemacht, das sollst du ja nicht bis wir fertig sind...
dann eben noch mal n neues otl log wie am anfang...

Trivandrum 09.03.2012 17:58

Es tut mir leid!
Wo erfahre ich nochmal, wie ich den Scan einstellen soll?

markusg 09.03.2012 18:07

einfach wie du es beim ersten mal gemacht hast.

Trivandrum 09.03.2012 18:35

okay, geschafft:
OTL Logfile:
Code:

OTL logfile created on: 09.03.2012 18:01:40 - Run 3
OTL by OldTimer - Version 3.2.36.1    Folder = C:\Users\janka\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 1,41 Gb Available Physical Memory | 75,00% Memory free
3,98 Gb Paging File | 3,69 Gb Available in Paging File | 92,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 41,80 Gb Free Space | 56,09% Space Free | Partition Type: NTFS
Drive D: | 67,69 Gb Total Space | 11,06 Gb Free Space | 16,35% Space Free | Partition Type: NTFS
 
Computer Name: JANKA-PC | User Name: janka | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.08 10:33:38 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\janka\Downloads\OTL.exe
PRC - [2012.02.16 15:55:51 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.02.16 15:55:51 | 001,911,768 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (CLTNetCnService)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.07.01 11:56:28 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.05.01 07:49:11 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.08.24 12:36:45 | 000,377,344 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2007.02.06 03:13:14 | 000,094,208 | ---- | M] () [Auto | Stopped] -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2006.12.29 01:17:50 | 000,123,248 | ---- | M] () [Auto | Stopped] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)
SRV - [2006.12.10 17:31:14 | 000,024,576 | ---- | M] (Syntek America Inc.) [Auto | Stopped] -- C:\Windows\System32\StkCSrv.exe -- (StkSSrv)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (ZTEusbser6k)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (ZTEusbnmea)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (ZTEusbmdm6k)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (vpnva)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (massfilter)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (ipswuio)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (catchme)
DRV - [2011.07.01 11:56:29 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.01 11:56:29 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2007.05.18 13:18:24 | 000,067,968 | ---- | M] (e3C, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EC168BDA.sys -- (EC168BDA)
DRV - [2007.01.19 16:19:12 | 001,324,544 | ---- | M] (Syntek) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\StkCMini.sys -- (StkCMini)
DRV - [2007.01.03 00:37:48 | 000,011,120 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Program Files\P4G\WCPU.sys -- (WCPU)
DRV - [2006.12.28 17:17:18 | 000,018,688 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)
DRV - [2006.12.14 16:11:58 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2006.12.13 19:00:08 | 000,025,600 | ---- | M] (Attansic Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L260x86.sys -- (Atc002)
DRV - [2006.12.08 01:50:43 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT)
DRV - [2006.12.08 01:50:42 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2006.11.02 10:50:17 | 000,041,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2006.11.02 08:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006.11.02 08:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2006.11.02 08:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006.10.14 04:04:33 | 004,422,560 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006.10.09 20:47:58 | 000,981,504 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2102572
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\SearchScopes,DefaultScope = {2F277093-48A9-4429-AEEC-AAA3F458DEDA}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes\{2F277093-48A9-4429-AEEC-AAA3F458DEDA}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316&ilc=12"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..keyword.URL: "hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=827316&ilc=12&p="
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Users\janka\Downloads\DivX\DivX Web Player\npdivx32.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Users\janka\Downloads\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.05 14:25:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.03.05 14:26:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\janka\AppData\Roaming\mozilla\Extensions
[2012.03.09 17:34:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.03.09 17:34:37 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.03.09 17:21:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
[2012.02.16 15:55:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.16 12:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.16 11:48:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.16 12:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.16 12:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.16 12:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.16 12:02:53 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.03.08 16:40:34 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe ()
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe ()
O4 - HKLM..\Run: [ASUSTPE] C:\Windows\System32\ASUSTPE.exe (ASUS)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE (ASUSTeK Computer INC.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKCU..\Run: [{0E330D6F-EC24-11DD-9B90-806E6F6E6963}] C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe ()
O4 - Startup: C:\Users\janka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StarOffice 8.lnk = C:\Program Files\Sun\StarOffice 8\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {28B66320-9687-4B13-8757-36F901887AB5} hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/canvasx.cab (CanvasX Class)
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/jordan.cab (JordanUploader Class)
O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} https://vpn-server.rrzn.uni-hannover.de/CACHE/stc/1/binaries/vpnweb.cab (Cisco AnyConnect VPN Client Web Control)
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab (CeWe Color AG & Co. OHG Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E723881F-6E37-4CC1-AB45-21C6A8C62A46}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EF84D312-EE25-4CBC-B693-0D1E89F07D92}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\janka\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\janka\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk /p \??\F:)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.09 17:41:42 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012.03.09 17:33:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.03.09 17:33:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012.03.09 17:33:29 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2012.03.09 17:21:10 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2012.03.09 17:21:09 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2012.03.09 17:21:09 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2012.03.09 17:14:29 | 000,414,368 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.03.09 17:14:18 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2012.03.09 17:14:18 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.03.09 17:14:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2012.03.09 17:14:15 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee Security Scan
[2012.03.09 17:07:23 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012.03.09 14:49:17 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2012.03.09 14:49:17 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2012.03.09 14:49:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2012.03.09 13:46:11 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2012.03.08 20:27:37 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Roaming\Malwarebytes
[2012.03.08 20:27:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.03.08 20:27:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.03.08 20:27:23 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.03.08 20:27:23 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.03.08 17:09:07 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.03.08 16:48:54 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Local\temp
[2012.03.08 16:40:41 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012.03.08 16:28:34 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.03.08 16:28:34 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.03.08 16:28:34 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.03.08 16:28:30 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.03.08 16:28:26 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.03.08 16:09:20 | 000,889,968 | ---- | C] (Babylon Ltd.) -- C:\Users\janka\Desktop\Babylon9_setup.exe
[2012.03.08 16:07:58 | 004,430,843 | R--- | C] (Swearware) -- C:\Users\janka\Desktop\ComboFix.exe
[2012.03.08 13:30:27 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.03.05 14:25:51 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Roaming\Mozilla
[2012.03.05 14:25:51 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Local\Mozilla
[2012.03.05 14:25:41 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.03.03 18:51:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot
[2012.03.03 18:51:13 | 000,000,000 | ---D | C] -- C:\Config.Msi
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.09 17:44:08 | 000,632,594 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.09 17:44:08 | 000,599,528 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.09 17:44:08 | 000,128,212 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.09 17:44:08 | 000,105,404 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.09 17:39:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.09 17:33:30 | 000,001,880 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.03.09 17:20:45 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2012.03.09 17:20:45 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2012.03.09 17:20:45 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2012.03.09 17:20:44 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2012.03.09 17:14:29 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.03.09 17:14:17 | 000,001,719 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012.03.09 17:14:17 | 000,001,717 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012.03.09 17:08:00 | 000,001,899 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.03.09 16:57:17 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.09 16:57:17 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.09 15:24:43 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2012.03.09 14:56:57 | 000,277,744 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.03.09 14:53:48 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.03.08 20:27:26 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.03.08 16:40:34 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.03.08 16:09:22 | 000,889,968 | ---- | M] (Babylon Ltd.) -- C:\Users\janka\Desktop\Babylon9_setup.exe
[2012.03.08 16:08:28 | 004,430,843 | R--- | M] (Swearware) -- C:\Users\janka\Desktop\ComboFix.exe
[2012.03.08 11:20:10 | 000,000,000 | ---- | M] () -- C:\Users\janka\defogger_reenable
[2012.03.08 10:50:58 | 000,000,049 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2012.03.08 10:50:57 | 000,077,824 | ---- | M] () -- C:\Users\janka\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.07 17:08:58 | 188,381,636 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.03.05 14:25:43 | 000,000,853 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.02.23 09:18:36 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
 
========== Files Created - No Company Name ==========
 
[2012.03.09 17:14:17 | 000,001,719 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012.03.09 17:14:17 | 000,001,717 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012.03.09 17:08:00 | 000,001,899 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.03.09 17:08:00 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.03.08 20:27:26 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.03.08 16:28:34 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.03.08 16:28:34 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.03.08 16:28:34 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.03.08 16:28:34 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.03.08 16:28:34 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.03.08 11:20:10 | 000,000,000 | ---- | C] () -- C:\Users\janka\defogger_reenable
[2012.03.05 14:25:43 | 000,000,865 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.03.05 14:25:43 | 000,000,853 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.02.24 17:13:53 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010.11.29 18:06:39 | 000,001,024 | ---- | C] () -- C:\Windows\System32\grcauth2.dll
[2010.11.29 18:06:39 | 000,001,024 | ---- | C] () -- C:\Windows\System32\grcauth1.dll
[2010.11.29 18:06:39 | 000,000,100 | ---- | C] () -- C:\Windows\System32\prsgrc.dll
[2010.11.29 17:58:13 | 000,001,025 | ---- | C] () -- C:\Windows\System32\sysprs7.dll
[2010.11.29 17:58:13 | 000,000,205 | ---- | C] () -- C:\Windows\System32\lsprst7.dll
[2010.10.13 17:50:29 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.10.07 13:33:35 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010.05.02 20:17:31 | 000,000,018 | ---- | C] () -- C:\Windows\ssetup.ini
 
========== LOP Check ==========
 
[2009.02.19 20:03:02 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Canon
[2010.02.07 10:44:38 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\elsterformular
[2010.11.25 22:19:51 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\FreeAudioPack
[2009.01.28 21:15:26 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Miranda
[2010.11.22 14:29:25 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Scientific Software
[2012.03.09 15:25:31 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\StarOffice8
[2011.02.24 16:53:17 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\UDC Profiles
[2011.02.24 17:07:32 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\WordToPDF
[2012.03.09 14:53:50 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---



und

OTL Logfile:
Code:

OTL Extras logfile created on: 09.03.2012 18:01:40 - Run 3
OTL by OldTimer - Version 3.2.36.1    Folder = C:\Users\janka\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 1,41 Gb Available Physical Memory | 75,00% Memory free
3,98 Gb Paging File | 3,69 Gb Available in Paging File | 92,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 41,80 Gb Free Space | 56,09% Space Free | Partition Type: NTFS
Drive D: | 67,69 Gb Total Space | 11,06 Gb Free Space | 16,35% Space Free | Partition Type: NTFS
 
Computer Name: JANKA-PC | User Name: janka | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1331460E-B590-4AFB-8603-73FE6D222879}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2EC5F36A-0D12-4DDE-B804-EB6A53C5A708}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3259E05C-38C1-4087-A7B3-6766781E5D16}" = lport=138 | protocol=17 | dir=in | app=system |
"{33CFD4D0-0DB2-4F95-A514-94E4BE68C109}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{35F1B5CE-ACF8-401E-BBC9-3A722E77D980}" = rport=445 | protocol=6 | dir=out | app=system |
"{3B500FAA-74C6-4FF3-88D3-143B2CDAB40D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{3B665BE4-6869-4D89-AE92-94163397BFCD}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{4CF29A67-8032-4409-9897-C85640FE8811}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{525E39D6-CB13-43EB-8489-FAE0EFEE9A71}" = lport=137 | protocol=17 | dir=in | app=system |
"{53A89469-2A6C-4D4A-99AB-AFAA84F479C4}" = lport=10243 | protocol=6 | dir=in | app=system |
"{54679428-10C0-4EC8-AED2-6768E60CE652}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{59C4ADAC-156A-4299-ADD9-8DA74FEABD10}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6546DC7F-F3DC-4C77-8750-4C45EB86CB50}" = rport=10243 | protocol=6 | dir=out | app=system |
"{73FC3AC9-403D-480B-85CA-ED73BDCF41A3}" = rport=138 | protocol=17 | dir=out | app=system |
"{8026C332-3A9B-4E68-B971-5BCC3FBB3977}" = lport=445 | protocol=6 | dir=in | app=system |
"{83BFA2E7-FA2A-47B7-A8E8-3D5ED5DE6DD9}" = lport=139 | protocol=6 | dir=in | app=system |
"{8DECB48A-29C3-4172-97B6-D212510825F8}" = rport=139 | protocol=6 | dir=out | app=system |
"{90052951-F440-4EBB-91E1-E73C826F8156}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{92E7EE81-4D78-4FD8-9B30-FE812D1E332B}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{9BDC01F3-521D-4F76-A68B-36F0C5975B63}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A0DC2738-F1AD-45B1-9B81-95C4D1AA0933}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{B80EE33D-5478-4B79-87F3-44C8FD5F27A2}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D2C5D045-4764-42C5-9198-A229DDCE2F7C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{DD566E88-255C-4D32-87ED-9FA01C69ED02}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F2A2F446-7FF9-4E1F-B4CD-EFE8036C1074}" = rport=137 | protocol=17 | dir=out | app=system |
"{F4FCD3B3-4949-4709-9632-6F99F977DB30}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FCFD4861-3929-407A-AF2C-342FBB91E70D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{073A3800-60AA-4E07-9911-F9BB8D13F5BD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{13BB991E-E367-4D8F-9521-F94B757C3146}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{2F2E5710-5833-4FF0-B3A1-016DFB989F9B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2FF348E0-717F-4397-9E24-386367E0A35F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{31FF50AA-75C9-4DE2-8E8B-3EBA22F6A1D8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3ED10B2F-4308-4A6C-95F9-50B28DF6253C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{46B08AA2-C2E6-4829-AB67-85A408C294D7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{667A8EB1-CFEC-4CBB-B2E5-A060937324EC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{82E346F1-4485-4287-B0B7-5F7EE8B6C88E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{8AE05991-DF8D-4A22-B6D3-D373F0BCE783}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{9C0E07CC-FD24-48AC-9B92-F9EDE7310A8E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B5258A3D-0B61-47AA-B059-C38B0AF46E75}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BE004F72-4D96-44D8-8773-2ADB8684CF41}" = protocol=6 | dir=out | app=system |
"{C1E05AFA-2A3C-4870-BF4C-ADD24751812D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C23E2D7A-D908-45D5-9103-D601F99F38F5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C5770090-7E31-4D66-AD1F-FEBBC6A77F7C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D748D32E-0F4C-4929-92EB-99951C944B2C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E87605A2-D99A-45ED-92FB-F2A0F02A6B69}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{5B8025EF-2449-41FE-9E20-C6FBE5D1F4E2}C:\program files\spssinc\statistics17\statistics.exe" = protocol=6 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe |
"TCP Query User{A4B37A3F-F184-4CB5-BA10-1C34FB7A14AD}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{B26D7D9B-06E4-4F10-B488-AC5AD4F07025}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
"TCP Query User{D563AA5A-97C3-4255-B7ED-60953FE7E9F1}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
"UDP Query User{1450BF88-C364-4BDE-88DB-AC8A0985DFF2}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{815D5560-F290-4358-BBAA-7179FD96B4DC}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
"UDP Query User{C5A14ABF-0648-4169-A4BC-C4E0D8478934}C:\program files\spssinc\statistics17\statistics.exe" = protocol=17 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe |
"UDP Query User{F91FB6DD-B1B6-4732-A0FC-D7F3B82A4774}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}" = ATK Media
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = LifeFrame2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F698102-5739-441E-96F0-74F4EA540F06}" = Attansic Giga Ethernet Utility
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}" = ATK Hotkey
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{46B65150-F8AA-42F2-94FB-2729A8AE5F7E}" = SPSS Statistics 17.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BC1CB2B-FDCE-4DB4-A557-BA8127569B0D}" = StarOffice 8
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57B15AD4-8C9D-4164-82BB-E33D8644E757}" = ASUS InstantFun
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}" = ATKOSD2
"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8CFEBE9C-F29F-4C49-80E0-7106970F8734}" = Power4Gear eXtreme
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D6D7811-43B3-463C-BC79-5D1755269989}" = Net4Switch
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B360A8E5-C171-4AAE-9777-65B3CDB0072C}" = CanoScan LiDE20,30 Manual
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BC61F51E-8AF7-46B9-AF20-B33B5EE81031}" = Nero 7 Essentials
"{BF8780F3-CB8E-4AB0-9AA4-52E1BD574226}" = ATLAS.ti 6.2 Demo
"{C0FC1C14-4824-4A73-87A6-9E888C9C3102}" = ASUS Splendid Video Enhancement Technology
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE86A0E7-818D-43EC-A181-59BA9BD3EF2E}" = LightScribe  1.8.13.1
"{DB891739-2EB3-45A8-9CBD-941C255CECD4}" = ASUS Touch Pad Extra
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FC3D290D-79BE-44B7-ABF9-FDD110925930}" = PowerForPhone
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"Canon CanoScan Toolbox 4.0" = Canon CanoScan Toolbox 4.0
"CCleaner" = CCleaner (remove only)
"ElsterFormular 11.1.0 11.1.0.***unknown variable buildnummer***" = ElsterFormular 11.1.0
"f4" = f4 3.1.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"Samsung ML-2010 Series" = Samsung ML-2010 Series
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"USB2.0 1.3M WebCam" = USB2.0 1.3M WebCam
"WordToPDF_is1" = WordToPDF 2.4
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 19.03.2011 16:14:18 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 1064  Anfangszeit: 01cbe670a90e356c  Zeitpunkt
 der Beendigung: 31
 
Error - 19.03.2011 17:16:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 13d4  Anfangszeit: 01cbe67a9b328781  Zeitpunkt
 der Beendigung: 0
 
Error - 22.03.2011 12:02:51 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: bb0  Anfangszeit: 01cbe8a808dcae6d  Zeitpunkt
 der Beendigung: 172
 
Error - 22.03.2011 12:06:01 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: dc4  Anfangszeit: 01cbe8aad6369487  Zeitpunkt der
 Beendigung: 47
 
Error - 22.03.2011 12:15:39 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: d4  Anfangszeit: 01cbe8ab10e44570  Zeitpunkt der
Beendigung: 16
 
Error - 22.03.2011 12:18:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 7b4  Anfangszeit: 01cbe8aa9b8b8dc4  Zeitpunkt
 der Beendigung: 94
 
Error - 03.04.2011 11:47:29 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit
 Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 12d4  Anfangszeit: 01cbf2160a75b91f  Zeitpunkt
 der Beendigung: 31
 
Error - 03.04.2011 11:48:17 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit
 Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 17ac  Anfangszeit: 01cbf21676aa0a7d  Zeitpunkt
 der Beendigung: 125
 
Error - 03.04.2011 11:53:09 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 1244  Anfangszeit: 01cbf216944ba00f  Zeitpunkt der
 Beendigung: 47
 
Error - 04.04.2011 13:21:03 | Computer Name = janka-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 7.0.6001.18565, Zeitstempel
 0x4d0f5fa9, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x8e8a770b,  Prozess-ID 0xc10, Anwendungsstartzeit
 01cbf2e87d4acd67.
 
[ Cisco AnyConnect VPN Client Events ]
Error - 08.03.2012 12:03:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::genericNoticeHandler File: .\MainThread.cpp Line:
 5613 Invoked Function: CMainThread::applyHostConfigForNoVpn Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.03.2012 12:03:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::processNotice File: .\MainThread.cpp Line: 5353
Invoked
 Function: CMainThread::genericNoticeHandler Return Code: -33095647 (0xFE070021) Description:
 ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.03.2012 12:03:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::noticeHandler File: .\MainThread.cpp Line: 5315
Invoked
 Function: CMainThread::processNotice Return Code: -33095647 (0xFE070021) Description:
 ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.03.2012 12:03:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::internalCallbackHandler File: .\MainThread.cpp
Line:
 5077 Invoked Function: CMainThread::noticeHandler Return Code: -33095647 (0xFE070021)
Description:
 ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.03.2012 12:03:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::callbackHandler File: .\MainThread.cpp Line:
5003 Invoked Function: internalCallbackHandler Return Code: -33095647 (0xFE070021)
Description:
 ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.03.2012 12:03:35 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 08.03.2012 12:24:00 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 08.03.2012 17:38:02 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 09.03.2012 04:55:39 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 09.03.2012 12:16:28 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 7: The agent has been stopped.
 
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

--- --- ---

Trivandrum 09.03.2012 18:36

okay, geschafft:
OTL Logfile:
Code:

OTL logfile created on: 09.03.2012 18:01:40 - Run 3
OTL by OldTimer - Version 3.2.36.1    Folder = C:\Users\janka\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 1,41 Gb Available Physical Memory | 75,00% Memory free
3,98 Gb Paging File | 3,69 Gb Available in Paging File | 92,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 41,80 Gb Free Space | 56,09% Space Free | Partition Type: NTFS
Drive D: | 67,69 Gb Total Space | 11,06 Gb Free Space | 16,35% Space Free | Partition Type: NTFS
 
Computer Name: JANKA-PC | User Name: janka | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.08 10:33:38 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\janka\Downloads\OTL.exe
PRC - [2012.02.16 15:55:51 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.02.16 15:55:51 | 001,911,768 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (CLTNetCnService)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.07.01 11:56:28 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.05.01 07:49:11 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.08.24 12:36:45 | 000,377,344 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2007.02.06 03:13:14 | 000,094,208 | ---- | M] () [Auto | Stopped] -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2006.12.29 01:17:50 | 000,123,248 | ---- | M] () [Auto | Stopped] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)
SRV - [2006.12.10 17:31:14 | 000,024,576 | ---- | M] (Syntek America Inc.) [Auto | Stopped] -- C:\Windows\System32\StkCSrv.exe -- (StkSSrv)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (ZTEusbser6k)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (ZTEusbnmea)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (ZTEusbmdm6k)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (vpnva)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (massfilter)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (ipswuio)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (catchme)
DRV - [2011.07.01 11:56:29 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.01 11:56:29 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2007.05.18 13:18:24 | 000,067,968 | ---- | M] (e3C, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EC168BDA.sys -- (EC168BDA)
DRV - [2007.01.19 16:19:12 | 001,324,544 | ---- | M] (Syntek) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\StkCMini.sys -- (StkCMini)
DRV - [2007.01.03 00:37:48 | 000,011,120 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Program Files\P4G\WCPU.sys -- (WCPU)
DRV - [2006.12.28 17:17:18 | 000,018,688 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)
DRV - [2006.12.14 16:11:58 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2006.12.13 19:00:08 | 000,025,600 | ---- | M] (Attansic Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L260x86.sys -- (Atc002)
DRV - [2006.12.08 01:50:43 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT)
DRV - [2006.12.08 01:50:42 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2006.11.02 10:50:17 | 000,041,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2006.11.02 08:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006.11.02 08:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2006.11.02 08:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006.10.14 04:04:33 | 004,422,560 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006.10.09 20:47:58 | 000,981,504 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2102572
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\SearchScopes,DefaultScope = {2F277093-48A9-4429-AEEC-AAA3F458DEDA}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes\{2F277093-48A9-4429-AEEC-AAA3F458DEDA}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316&ilc=12"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..keyword.URL: "hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=827316&ilc=12&p="
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Users\janka\Downloads\DivX\DivX Web Player\npdivx32.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Users\janka\Downloads\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.05 14:25:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.03.05 14:26:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\janka\AppData\Roaming\mozilla\Extensions
[2012.03.09 17:34:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.03.09 17:34:37 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.03.09 17:21:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
[2012.02.16 15:55:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.16 12:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.16 11:48:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.16 12:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.16 12:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.16 12:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.16 12:02:53 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.03.08 16:40:34 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe ()
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe ()
O4 - HKLM..\Run: [ASUSTPE] C:\Windows\System32\ASUSTPE.exe (ASUS)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE (ASUSTeK Computer INC.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKCU..\Run: [{0E330D6F-EC24-11DD-9B90-806E6F6E6963}] C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe ()
O4 - Startup: C:\Users\janka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StarOffice 8.lnk = C:\Program Files\Sun\StarOffice 8\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {28B66320-9687-4B13-8757-36F901887AB5} hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/canvasx.cab (CanvasX Class)
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/jordan.cab (JordanUploader Class)
O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} https://vpn-server.rrzn.uni-hannover.de/CACHE/stc/1/binaries/vpnweb.cab (Cisco AnyConnect VPN Client Web Control)
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab (CeWe Color AG & Co. OHG Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E723881F-6E37-4CC1-AB45-21C6A8C62A46}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EF84D312-EE25-4CBC-B693-0D1E89F07D92}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\janka\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\janka\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk /p \??\F:)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.09 17:41:42 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012.03.09 17:33:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.03.09 17:33:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012.03.09 17:33:29 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2012.03.09 17:21:10 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2012.03.09 17:21:09 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2012.03.09 17:21:09 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2012.03.09 17:14:29 | 000,414,368 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.03.09 17:14:18 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2012.03.09 17:14:18 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.03.09 17:14:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2012.03.09 17:14:15 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee Security Scan
[2012.03.09 17:07:23 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012.03.09 14:49:17 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2012.03.09 14:49:17 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2012.03.09 14:49:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2012.03.09 13:46:11 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2012.03.08 20:27:37 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Roaming\Malwarebytes
[2012.03.08 20:27:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.03.08 20:27:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.03.08 20:27:23 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.03.08 20:27:23 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.03.08 17:09:07 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.03.08 16:48:54 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Local\temp
[2012.03.08 16:40:41 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012.03.08 16:28:34 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.03.08 16:28:34 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.03.08 16:28:34 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.03.08 16:28:30 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.03.08 16:28:26 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.03.08 16:09:20 | 000,889,968 | ---- | C] (Babylon Ltd.) -- C:\Users\janka\Desktop\Babylon9_setup.exe
[2012.03.08 16:07:58 | 004,430,843 | R--- | C] (Swearware) -- C:\Users\janka\Desktop\ComboFix.exe
[2012.03.08 13:30:27 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.03.05 14:25:51 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Roaming\Mozilla
[2012.03.05 14:25:51 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Local\Mozilla
[2012.03.05 14:25:41 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.03.03 18:51:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot
[2012.03.03 18:51:13 | 000,000,000 | ---D | C] -- C:\Config.Msi
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.09 17:44:08 | 000,632,594 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.09 17:44:08 | 000,599,528 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.09 17:44:08 | 000,128,212 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.09 17:44:08 | 000,105,404 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.09 17:39:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.09 17:33:30 | 000,001,880 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.03.09 17:20:45 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2012.03.09 17:20:45 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2012.03.09 17:20:45 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2012.03.09 17:20:44 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2012.03.09 17:14:29 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.03.09 17:14:17 | 000,001,719 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012.03.09 17:14:17 | 000,001,717 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012.03.09 17:08:00 | 000,001,899 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.03.09 16:57:17 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.09 16:57:17 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.09 15:24:43 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2012.03.09 14:56:57 | 000,277,744 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.03.09 14:53:48 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.03.08 20:27:26 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.03.08 16:40:34 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.03.08 16:09:22 | 000,889,968 | ---- | M] (Babylon Ltd.) -- C:\Users\janka\Desktop\Babylon9_setup.exe
[2012.03.08 16:08:28 | 004,430,843 | R--- | M] (Swearware) -- C:\Users\janka\Desktop\ComboFix.exe
[2012.03.08 11:20:10 | 000,000,000 | ---- | M] () -- C:\Users\janka\defogger_reenable
[2012.03.08 10:50:58 | 000,000,049 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2012.03.08 10:50:57 | 000,077,824 | ---- | M] () -- C:\Users\janka\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.07 17:08:58 | 188,381,636 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.03.05 14:25:43 | 000,000,853 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.02.23 09:18:36 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
 
========== Files Created - No Company Name ==========
 
[2012.03.09 17:14:17 | 000,001,719 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012.03.09 17:14:17 | 000,001,717 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012.03.09 17:08:00 | 000,001,899 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.03.09 17:08:00 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.03.08 20:27:26 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.03.08 16:28:34 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.03.08 16:28:34 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.03.08 16:28:34 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.03.08 16:28:34 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.03.08 16:28:34 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.03.08 11:20:10 | 000,000,000 | ---- | C] () -- C:\Users\janka\defogger_reenable
[2012.03.05 14:25:43 | 000,000,865 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.03.05 14:25:43 | 000,000,853 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.02.24 17:13:53 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010.11.29 18:06:39 | 000,001,024 | ---- | C] () -- C:\Windows\System32\grcauth2.dll
[2010.11.29 18:06:39 | 000,001,024 | ---- | C] () -- C:\Windows\System32\grcauth1.dll
[2010.11.29 18:06:39 | 000,000,100 | ---- | C] () -- C:\Windows\System32\prsgrc.dll
[2010.11.29 17:58:13 | 000,001,025 | ---- | C] () -- C:\Windows\System32\sysprs7.dll
[2010.11.29 17:58:13 | 000,000,205 | ---- | C] () -- C:\Windows\System32\lsprst7.dll
[2010.10.13 17:50:29 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.10.07 13:33:35 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010.05.02 20:17:31 | 000,000,018 | ---- | C] () -- C:\Windows\ssetup.ini
 
========== LOP Check ==========
 
[2009.02.19 20:03:02 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Canon
[2010.02.07 10:44:38 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\elsterformular
[2010.11.25 22:19:51 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\FreeAudioPack
[2009.01.28 21:15:26 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Miranda
[2010.11.22 14:29:25 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Scientific Software
[2012.03.09 15:25:31 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\StarOffice8
[2011.02.24 16:53:17 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\UDC Profiles
[2011.02.24 17:07:32 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\WordToPDF
[2012.03.09 14:53:50 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---



und

OTL Logfile:
Code:

OTL Extras logfile created on: 09.03.2012 18:01:40 - Run 3
OTL by OldTimer - Version 3.2.36.1    Folder = C:\Users\janka\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 1,41 Gb Available Physical Memory | 75,00% Memory free
3,98 Gb Paging File | 3,69 Gb Available in Paging File | 92,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 41,80 Gb Free Space | 56,09% Space Free | Partition Type: NTFS
Drive D: | 67,69 Gb Total Space | 11,06 Gb Free Space | 16,35% Space Free | Partition Type: NTFS
 
Computer Name: JANKA-PC | User Name: janka | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1331460E-B590-4AFB-8603-73FE6D222879}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2EC5F36A-0D12-4DDE-B804-EB6A53C5A708}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3259E05C-38C1-4087-A7B3-6766781E5D16}" = lport=138 | protocol=17 | dir=in | app=system |
"{33CFD4D0-0DB2-4F95-A514-94E4BE68C109}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{35F1B5CE-ACF8-401E-BBC9-3A722E77D980}" = rport=445 | protocol=6 | dir=out | app=system |
"{3B500FAA-74C6-4FF3-88D3-143B2CDAB40D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{3B665BE4-6869-4D89-AE92-94163397BFCD}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{4CF29A67-8032-4409-9897-C85640FE8811}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{525E39D6-CB13-43EB-8489-FAE0EFEE9A71}" = lport=137 | protocol=17 | dir=in | app=system |
"{53A89469-2A6C-4D4A-99AB-AFAA84F479C4}" = lport=10243 | protocol=6 | dir=in | app=system |
"{54679428-10C0-4EC8-AED2-6768E60CE652}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{59C4ADAC-156A-4299-ADD9-8DA74FEABD10}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6546DC7F-F3DC-4C77-8750-4C45EB86CB50}" = rport=10243 | protocol=6 | dir=out | app=system |
"{73FC3AC9-403D-480B-85CA-ED73BDCF41A3}" = rport=138 | protocol=17 | dir=out | app=system |
"{8026C332-3A9B-4E68-B971-5BCC3FBB3977}" = lport=445 | protocol=6 | dir=in | app=system |
"{83BFA2E7-FA2A-47B7-A8E8-3D5ED5DE6DD9}" = lport=139 | protocol=6 | dir=in | app=system |
"{8DECB48A-29C3-4172-97B6-D212510825F8}" = rport=139 | protocol=6 | dir=out | app=system |
"{90052951-F440-4EBB-91E1-E73C826F8156}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{92E7EE81-4D78-4FD8-9B30-FE812D1E332B}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{9BDC01F3-521D-4F76-A68B-36F0C5975B63}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A0DC2738-F1AD-45B1-9B81-95C4D1AA0933}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{B80EE33D-5478-4B79-87F3-44C8FD5F27A2}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D2C5D045-4764-42C5-9198-A229DDCE2F7C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{DD566E88-255C-4D32-87ED-9FA01C69ED02}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F2A2F446-7FF9-4E1F-B4CD-EFE8036C1074}" = rport=137 | protocol=17 | dir=out | app=system |
"{F4FCD3B3-4949-4709-9632-6F99F977DB30}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FCFD4861-3929-407A-AF2C-342FBB91E70D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{073A3800-60AA-4E07-9911-F9BB8D13F5BD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{13BB991E-E367-4D8F-9521-F94B757C3146}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{2F2E5710-5833-4FF0-B3A1-016DFB989F9B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2FF348E0-717F-4397-9E24-386367E0A35F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{31FF50AA-75C9-4DE2-8E8B-3EBA22F6A1D8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3ED10B2F-4308-4A6C-95F9-50B28DF6253C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{46B08AA2-C2E6-4829-AB67-85A408C294D7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{667A8EB1-CFEC-4CBB-B2E5-A060937324EC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{82E346F1-4485-4287-B0B7-5F7EE8B6C88E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{8AE05991-DF8D-4A22-B6D3-D373F0BCE783}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{9C0E07CC-FD24-48AC-9B92-F9EDE7310A8E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B5258A3D-0B61-47AA-B059-C38B0AF46E75}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BE004F72-4D96-44D8-8773-2ADB8684CF41}" = protocol=6 | dir=out | app=system |
"{C1E05AFA-2A3C-4870-BF4C-ADD24751812D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C23E2D7A-D908-45D5-9103-D601F99F38F5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C5770090-7E31-4D66-AD1F-FEBBC6A77F7C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D748D32E-0F4C-4929-92EB-99951C944B2C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E87605A2-D99A-45ED-92FB-F2A0F02A6B69}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{5B8025EF-2449-41FE-9E20-C6FBE5D1F4E2}C:\program files\spssinc\statistics17\statistics.exe" = protocol=6 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe |
"TCP Query User{A4B37A3F-F184-4CB5-BA10-1C34FB7A14AD}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{B26D7D9B-06E4-4F10-B488-AC5AD4F07025}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
"TCP Query User{D563AA5A-97C3-4255-B7ED-60953FE7E9F1}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
"UDP Query User{1450BF88-C364-4BDE-88DB-AC8A0985DFF2}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{815D5560-F290-4358-BBAA-7179FD96B4DC}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
"UDP Query User{C5A14ABF-0648-4169-A4BC-C4E0D8478934}C:\program files\spssinc\statistics17\statistics.exe" = protocol=17 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe |
"UDP Query User{F91FB6DD-B1B6-4732-A0FC-D7F3B82A4774}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}" = ATK Media
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = LifeFrame2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F698102-5739-441E-96F0-74F4EA540F06}" = Attansic Giga Ethernet Utility
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}" = ATK Hotkey
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{46B65150-F8AA-42F2-94FB-2729A8AE5F7E}" = SPSS Statistics 17.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BC1CB2B-FDCE-4DB4-A557-BA8127569B0D}" = StarOffice 8
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57B15AD4-8C9D-4164-82BB-E33D8644E757}" = ASUS InstantFun
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}" = ATKOSD2
"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8CFEBE9C-F29F-4C49-80E0-7106970F8734}" = Power4Gear eXtreme
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D6D7811-43B3-463C-BC79-5D1755269989}" = Net4Switch
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B360A8E5-C171-4AAE-9777-65B3CDB0072C}" = CanoScan LiDE20,30 Manual
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BC61F51E-8AF7-46B9-AF20-B33B5EE81031}" = Nero 7 Essentials
"{BF8780F3-CB8E-4AB0-9AA4-52E1BD574226}" = ATLAS.ti 6.2 Demo
"{C0FC1C14-4824-4A73-87A6-9E888C9C3102}" = ASUS Splendid Video Enhancement Technology
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE86A0E7-818D-43EC-A181-59BA9BD3EF2E}" = LightScribe  1.8.13.1
"{DB891739-2EB3-45A8-9CBD-941C255CECD4}" = ASUS Touch Pad Extra
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FC3D290D-79BE-44B7-ABF9-FDD110925930}" = PowerForPhone
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"Canon CanoScan Toolbox 4.0" = Canon CanoScan Toolbox 4.0
"CCleaner" = CCleaner (remove only)
"ElsterFormular 11.1.0 11.1.0.***unknown variable buildnummer***" = ElsterFormular 11.1.0
"f4" = f4 3.1.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"Samsung ML-2010 Series" = Samsung ML-2010 Series
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"USB2.0 1.3M WebCam" = USB2.0 1.3M WebCam
"WordToPDF_is1" = WordToPDF 2.4
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 19.03.2011 16:14:18 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 1064  Anfangszeit: 01cbe670a90e356c  Zeitpunkt
 der Beendigung: 31
 
Error - 19.03.2011 17:16:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 13d4  Anfangszeit: 01cbe67a9b328781  Zeitpunkt
 der Beendigung: 0
 
Error - 22.03.2011 12:02:51 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: bb0  Anfangszeit: 01cbe8a808dcae6d  Zeitpunkt
 der Beendigung: 172
 
Error - 22.03.2011 12:06:01 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: dc4  Anfangszeit: 01cbe8aad6369487  Zeitpunkt der
 Beendigung: 47
 
Error - 22.03.2011 12:15:39 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: d4  Anfangszeit: 01cbe8ab10e44570  Zeitpunkt der
Beendigung: 16
 
Error - 22.03.2011 12:18:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 7b4  Anfangszeit: 01cbe8aa9b8b8dc4  Zeitpunkt
 der Beendigung: 94
 
Error - 03.04.2011 11:47:29 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit
 Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 12d4  Anfangszeit: 01cbf2160a75b91f  Zeitpunkt
 der Beendigung: 31
 
Error - 03.04.2011 11:48:17 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit
 Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 17ac  Anfangszeit: 01cbf21676aa0a7d  Zeitpunkt
 der Beendigung: 125
 
Error - 03.04.2011 11:53:09 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 1244  Anfangszeit: 01cbf216944ba00f  Zeitpunkt der
 Beendigung: 47
 
Error - 04.04.2011 13:21:03 | Computer Name = janka-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 7.0.6001.18565, Zeitstempel
 0x4d0f5fa9, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x8e8a770b,  Prozess-ID 0xc10, Anwendungsstartzeit
 01cbf2e87d4acd67.
 
[ Cisco AnyConnect VPN Client Events ]
Error - 08.03.2012 12:03:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::genericNoticeHandler File: .\MainThread.cpp Line:
 5613 Invoked Function: CMainThread::applyHostConfigForNoVpn Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.03.2012 12:03:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::processNotice File: .\MainThread.cpp Line: 5353
Invoked
 Function: CMainThread::genericNoticeHandler Return Code: -33095647 (0xFE070021) Description:
 ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.03.2012 12:03:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::noticeHandler File: .\MainThread.cpp Line: 5315
Invoked
 Function: CMainThread::processNotice Return Code: -33095647 (0xFE070021) Description:
 ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.03.2012 12:03:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::internalCallbackHandler File: .\MainThread.cpp
Line:
 5077 Invoked Function: CMainThread::noticeHandler Return Code: -33095647 (0xFE070021)
Description:
 ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.03.2012 12:03:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::callbackHandler File: .\MainThread.cpp Line:
5003 Invoked Function: internalCallbackHandler Return Code: -33095647 (0xFE070021)
Description:
 ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.03.2012 12:03:35 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 08.03.2012 12:24:00 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 08.03.2012 17:38:02 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 09.03.2012 04:55:39 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 09.03.2012 12:16:28 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 7: The agent has been stopped.
 
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

--- --- ---

markusg 09.03.2012 19:29

hi


dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:

:OTL
O4 - HKCU..\Run: [{0E330D6F-EC24-11DD-9B90-806E6F6E6963}] C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe ()
 :Files
C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]



• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!




Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Trivandrum 11.03.2012 09:42

[spoiler]All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{0E330D6F-EC24-11DD-9B90-806E6F6E6963} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E330D6F-EC24-11DD-9B90-806E6F6E6963}\ not found.
C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe moved successfully.
========== FILES ==========
File\Folder C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: janka
->Flash cache emptied: 1540 bytes

User: klaus
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: janka
->Temp folder emptied: 27000658 bytes
->Temporary Internet Files folder emptied: 19438526 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 97679839 bytes
->Flash cache emptied: 0 bytes

User: klaus
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5747 bytes
RecycleBin emptied: 97598475 bytes

Total Files Cleaned = 231,00 mb


OTL by OldTimer - Version 3.2.36.1 log created on 03112012_093500

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
[/spoiler]

Trivandrum 11.03.2012 09:45

Hallo,
ich wollte den zip-Ordner erstellen, aber Antivir hat mir gemeldet, dass in dem Ordner ein Virus oder ein unerwünschtes Programm gefunden wurde.
Deswegen konnte ich den zip-Ordner nicht erstellen.
Fund: TR/Ransom.EJ.81
--> Ich habe ihn in Quarantäne verschieben lassen.
Danach konnte ich den Ordner erstellen und hochladen.

markusg 11.03.2012 19:40

ok, dann arbeite die ccleaner liste von seite 2 ab.

Trivandrum 12.03.2012 09:37

Ja, das habe ich getan.
PC läuft bisher.

markusg 12.03.2012 12:36

pc absichern:
als antimalware programm würde ich emsisoft empfehlen.
diese haben für mich den besten schutz kostet aber etwas.
http://www.trojaner-board.de/103809-...i-malware.html
testversion:
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren.
vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen.

kostenlos, aber eben nicht ganz so gut wäre avast zu empfehlen.
http://www.trojaner-board.de/110895-...antivirus.html
sag mir welches du nutzt, dann gebe ich konfigurationshinweise.
bitte dein bisheriges av deinstalieren
die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch!

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows Vista und Windows 7
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.
Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist.
aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen.
als browser rate ich dir zu chrome:
Installation von Google Chrome für mehrere Nutzerkonten - Google Chrome-Hilfe
anleitung lesen bitte
falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung


Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
http://filepony.de/download-sandboxie/
anleitung:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
Sandbox Einstellungen |

bitte folgende zusatz konfiguration machen:
sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen.
dort klicke auf sandbox einstellungen.
beschrenkungen, bei programm start und internet zugriff schreibe:
chrome.exe
dann gehe auf anwendungen, webbrowser, chrome.
dort aktiviere alles außer gesammten profil ordner freigeben.
Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
anmerkung zu file hippo.
in den settings zusätzlich auswählen:
Run updateChecker
when Windows starts

Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
Windows 7 Systemabbild erstellen (Backup)
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
bitte auch lesen, wie mache ich programme für alle sichtbar:
Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser

Trivandrum 12.03.2012 13:30

ich werde avast benutzen.

Trivandrum 12.03.2012 15:44

Hallo,
ich möchte gern mozilla firefox verwenden.
Außerdem weiß ich nicht, wie ich die datenausführungsverhinderung einstellen soll.

markusg 12.03.2012 15:45

hi,
schon mal chrome angesehen? er ist sicherer und sollte auch schneller sein.
datenausführungsverhinderung einfach, wie in der anleitung beschrieben, unter systemsteuerung, für alle prozesse, außer der ausgewählten, aktivieren, in die liste aber nichts eintragen.

Trivandrum 12.03.2012 18:38

Okay, benutze jetzt google chrome..
Habe soweit alles ausgeführt, glaub ich...
Manche Programme mussten aber schon beendet werden und es wurde nach der Lösung des Problems gesucht...
Auch bei chrome, das habe ich dann einfach nochmal deinstalliert und wieder neu installiert...
Leider kommt sehr oft die Meldung, dass die und die Programme nicht mehr richtig funktionieren.
Ist jetzt noch irgendwas nötig?

markusg 13.03.2012 10:46

öffne mal sandboxie kontrol, sandbox menü, sandbox, dort einstellungen, beschrenkung, hardware zugriff, programmen die enderung an firewall einstellung erlauben.
ok, browser in der sandbox neustarten.
treten die fehler noch auf?

Trivandrum 16.03.2012 10:46

ja, jetzt scheint es zu gehen!

markusg 16.03.2012 12:10

chrome konfig:

adblock für chrome:
http://filepony.de/download-adblock_chrome/
damit sollte das leben werbefreier von statten gehen.
ghostery um tracking zu verhindern:
http://filepony.de/download-ghostery_chrome/
sicher surfen mit chrome:
Sicher surfen mit Google Chrome | Verbraucher sicher online
ich möchte erst mal anhand einer checkliste prüfen ob du alles hast.
- instalieren von optionalen und wichtigen updates.
- konfigurieren von windows updates.
- dep für alle prozesse aktivieren.
- sehop aktivieren.
- chrome instalieren.
- sandboxie instalieren.
- autorun deaktivieren.
- panda vaccine instalieren.
- secunia instalieren.
- file hippo instalieren.
beachte:
secunia und file hippo bieten englische updates, überall wo du auf die nutzeroberfläche zugreifst, wie zb reader, browser, etc benötigst du deutsche updates, also hier die hersteller seiten in den favoriten deines browsers speichern und wenn ein update gezeigt wird, von dort hohlen, bei java, flash quicktime, ist es egal ob deutsch oder englisch.
- backup software instalieren, backup und rettungsdvd erstellen.
hier ne kurze anleitung:
Anleitung: Systemabbild mit Paragon Drive Backup - NETZWELT


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:37 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19