Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   GVU Trojaner auf Windows 7 Computer (https://www.trojaner-board.de/120174-gvu-trojaner-windows-7-computer.html)

JuliaNas 23.07.2012 08:47
GVU Trojaner auf Windows 7 Computer
 
Hallo,
ich habe seit gestern Abend das gleiche Problem, das hier schon öfters beschrieben wurde. Nämlich wenn ich meinen Computer im normalen Modus starte, erscheint auf dem gesamten Bildschirm, die Nachricht, dass mein PC gesperrt wurde und ich ihn durch Zahlung von 100 Euro wirder entsperren lassen kann. Oben rechts im Bild ist mein Webcam bild zu sehen.
Der abgesicherte Modus funktioniert noch.
Habe nun den Malwarebytes Quick Scan gemacht und das ist das Ergebnis:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.23.04

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Julia :: JULIA-PC [Administrator]

Schutz: Deaktiviert

23.07.2012 09:29:15
mbam-log-2012-07-23 (09-29-15).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 186249
Laufzeit: 4 Minute(n), 1 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Users\Julia\AppData\Local\Temp\fest0r_ot.exe (Spyware.Zbot.DG) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Julia\Downloads\SoftonicDownloader_fuer_winrar.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Habe die Infizierten Datein gelöscht und den PC neu gestartet.
Wie soll ich weiter vorgehen?

Schon mal DANKE für die Hilfe!

Julia

t'john 23.07.2012 10:15
:hallo:

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

2. Schritt
Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe
- Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
- Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
- Unter Extra Registry, wähle bitte Use SafeList
- Klicke nun auf Run Scan links oben
- Wenn der Scan beendet wurde werden 2 Logfiles erstellt
- Poste die Logfiles hier in den Thread.

JuliaNas 23.07.2012 11:37
Hallo t'john! Danke für die schnelle Antwort!
Ich hab mich an deine Anweisungen gehalten. Habe die Scans im abgesicherten Modus gemacht, hoffe das ist richtig.

Das Ergebnis vom Malwarebyte Vollscan:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.23.06

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Julia :: JULIA-PC [Administrator]

Schutz: Deaktiviert

23.07.2012 11:36:34
mbam-log-2012-07-23 (11-36-34).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 332820
Laufzeit: 37 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


Und vom OTL Scan:OTL Logfile:
Code:
OTL logfile created on: 23.07.2012 12:23:11 - Run 2
OTL by OldTimer - Version 3.2.54.0    Folder = C:\Users\Julia\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 2,15 Gb Available Physical Memory | 72,46% Memory free
5,93 Gb Paging File | 5,28 Gb Available in Paging File | 89,12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 420,55 Gb Total Space | 347,13 Gb Free Space | 82,54% Space Free | Partition Type: NTFS
Drive D: | 30,25 Gb Total Space | 0,01 Gb Free Space | 0,02% Space Free | Partition Type: NTFS
 
Computer Name: JULIA-PC | User Name: Julia | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Julia\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe (BullGuard Ltd.)
PRC - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardScanner.exe (BullGuard Ltd.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\BullGuard Ltd\BullGuard\zlib1.dll ()
MOD - C:\Program Files\BullGuard Ltd\BullGuard\res\de\BackupShellNamespaceRes.dll ()
MOD - C:\Program Files\BullGuard Ltd\BullGuard\LibXml2.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Windows\System32\IcnOvrly.dll ()
MOD - C:\Windows\System32\SimpleExt.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (BsMain) -- C:\Program Files\BullGuard Ltd\BullGuard\BsMain.dll (BullGuard Ltd.)
SRV - (BsFire) -- C:\Program Files\BullGuard Ltd\BullGuard\BsFire.dll (BullGuard Ltd.)
SRV - (BsMailProxy) -- C:\Program Files\BullGuard Ltd\BullGuard\BsMailProxy\BsMailProxy.dll (BullGuard Ltd.)
SRV - (BsUpdate) -- C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe (BullGuard Ltd.)
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (BsBackup) -- C:\Program Files\BullGuard Ltd\BullGuard\BsBackup.dll (BullGuard Ltd.)
SRV - (BsFileScan) -- C:\Program Files\BullGuard Ltd\BullGuard\BsFileScan.dll (BullGuard Ltd.)
SRV - (BsScanner) -- C:\Program Files\BullGuard Ltd\BullGuard\BullGuardScanner.exe (BullGuard Ltd.)
SRV - (BsBhvScan) -- C:\Program Files\BullGuard Ltd\BullGuard\BullGuardBhvScanner.exe (BullGuard Ltd.)
SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (BBUpdate) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (vpnagent) -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (Lenovo ReadyComm ConnSvc) -- C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe (Lenovo Group Limited)
SRV - (Lenovo ReadyComm AppSvc) -- C:\Program Files\Lenovo\ReadyComm\AppSvc.exe (Lenovo Group Limited)
SRV - (btwdins) -- C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV - (PS_MDP) -- C:\Program Files\Lenovo\ReadyComm\PS_MDP.dll (Lenovo Group Limited)
SRV - (IGRS) -- C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe (Lenovo Group Limited)
SRV - (ReadyComm.DirectRouter) -- C:\Program Files\Lenovo\ReadyComm\common\router.dll (Lenovo Group Limited)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (IAANTMON) Intel(R) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (BcmSqlStartupSvc) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WinRing0_1_2_0) -- D:\test\ECECECEC\WinRing0.sys File not found
DRV - (USBCCID) -- system32\DRIVERS\RtsUCcid.sys File not found
DRV - (RtsUIR) -- system32\DRIVERS\Rts516xIR.sys File not found
DRV - (beuds) -- System32\drivers\grrine.sys File not found
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (AFW) -- C:\Windows\System32\drivers\Afw.sys (Agnitum Ltd.)
DRV - (afwcore) -- C:\Windows\System32\drivers\AfwCore.sys (Agnitum Ltd.)
DRV - (NovaShieldTDIDriver) -- C:\Windows\System32\drivers\NSNetmon.sys (NovaShield, Inc.)
DRV - (NovaShieldFilterDriver) -- C:\Windows\System32\drivers\NSKernel.sys (NovaShield, Inc.)
DRV - (Trufos) -- C:\Windows\System32\drivers\Trufos.sys (BitDefender S.R.L.)
DRV - (BdSpy) -- C:\Windows\System32\drivers\BdSpy.sys (BullGuard Ltd.)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (Profos) -- C:\Program Files\BullGuard Ltd\BullGuard\Antirootkit\profos.sys (BitDefender S.R.L.)
DRV - (vpnva) -- C:\Windows\System32\drivers\vpnva.sys (Cisco Systems, Inc.)
DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (funfrm) -- C:\windows\System32\drivers\funfrm.sys ()
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (RSUSBSTOR) -- C:\Windows\System32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV - (Bridge0) -- C:\Windows\System32\drivers\wdbridge.sys (Lenovo)
DRV - (wsvd) -- C:\Windows\System32\drivers\wsvd.sys (CyberLink)
DRV - (wdmirror) -- C:\Windows\System32\drivers\WDMirror.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (k57nd60x) Broadcom NetLink (TM) -- C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation)
DRV - (usbsmi) -- C:\Windows\System32\drivers\SMIksdrv.sys (SMI)
DRV - (CnxtHdAudService) -- C:\Windows\System32\drivers\CHDRT32.sys (Conexant Systems Inc.)
DRV - (ACPIVPC) -- C:\Windows\System32\drivers\AcpiVpc.sys (Lenovo Corporation)
DRV - (netw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = about:Tabs [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://freemailng1802.web.de/canvaspage/startseite_navigator/?si=ABp40xnKnnJpf3ZC9gX*037&goto=/online/startseite/%253Fsi%253DABp40xnKnnJpf3ZC9gX*037%2526showall%253D1
IE - HKCU\..\SearchScopes,DefaultScope = {4388CE1D-6DF9-42BE-8D13-A6E72C4481C9}
IE - HKCU\..\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}: "URL" = hxxp://vshare.toolbarhome.com/search.aspx?q={searchTerms}&srch=dsp
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{4388CE1D-6DF9-42BE-8D13-A6E72C4481C9}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledItems: antiphishing@bullguard:1.1
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.2
FF - prefs.js..network.proxy.http: "202.171.253.99 "
FF - prefs.js..network.proxy.http_port: 80
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011.07.23 11:44:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.19 20:10:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.19 20:10:45 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{380AE6CB-09B9-4373-B360-D01C2462A6E7}: C:\Program Files\BullGuard Ltd\BullGuard\backup\thunderbirdbkplugin [2012.03.21 11:43:53 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{0E810812-F4BB-4309-942A-755587587A5E}: C:\Program Files\BullGuard Ltd\BullGuard\Spamfilter\TbSpamfilter [2012.06.06 08:20:50 | 000,000,000 | ---D | M]
 
[2011.02.07 22:48:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julia\AppData\Roaming\mozilla\Extensions
[2012.07.02 14:19:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julia\AppData\Roaming\mozilla\Firefox\Profiles\8p8fa579.default\extensions
[2012.03.27 22:26:41 | 000,000,000 | ---D | M] (vShare) -- C:\Users\Julia\AppData\Roaming\mozilla\Firefox\Profiles\8p8fa579.default\extensions\vshare@toolbar
[2012.02.01 19:49:20 | 000,000,933 | ---- | M] () -- C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\8p8fa579.default\searchplugins\11-suche.xml
[2012.02.01 19:49:21 | 000,002,419 | ---- | M] () -- C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\8p8fa579.default\searchplugins\englische-ergebnisse.xml
[2012.02.01 19:49:20 | 000,010,525 | ---- | M] () -- C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\8p8fa579.default\searchplugins\gmx-suche.xml
[2012.02.01 19:49:21 | 000,002,457 | ---- | M] () -- C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\8p8fa579.default\searchplugins\lastminute.xml
[2012.02.01 19:49:20 | 000,005,508 | ---- | M] () -- C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\8p8fa579.default\searchplugins\webde-suche.xml
[2012.04.26 21:57:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012.06.19 20:10:45 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.06.19 20:10:42 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.19 20:10:42 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.19 20:10:42 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.19 20:10:42 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.19 20:10:42 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.19 20:10:42 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (vShare Toolbar) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (vShare Toolbar) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BullGuard] C:\Program Files\BullGuard Ltd\BullGuard\BullGuard.exe (BullGuard Ltd.)
O4 - HKLM..\Run: [Energy Management] C:\Program Files\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4 - HKLM..\Run: [EnergyUtility] C:\Program Files\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [VeriFaceManager] C:\Program Files\Lenovo\VeriFace\PManage.exe (Lenovo)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Julia\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - HKCU..\Run: [SugarSync] C:\Program Files\SugarSync\SugarSyncManager.exe (SugarSync, Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: BullGuard - {27FD17FB-CF63-486b-B2BE-8D8781CBEA01} - C:\Program Files\BullGuard Ltd\BullGuard\Antiphishing\IE\BgAntiphishingIE.dll (BullGuard Ltd.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files\Lenovo\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\Lenovo\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\windows\System32\BGLsp.dll (BullGuard Ltd.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B8B8B91F-5663-4E64-856E-683ED7DF9378}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - C:\Program Files\vShare\vshare_toolbar.dll ()
O20 - AppInit_DLLs: (BgGamingMonitor.dll) - C:\windows\System32\BgGamingMonitor.dll (BullGuard Ltd.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{7b38ca46-a0bb-11df-83a5-002622db633d}\Shell - "" = AutoRun
O33 - MountPoints2\{7b38ca46-a0bb-11df-83a5-002622db633d}\Shell\AutoRun\command - "" = F:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.23 12:15:30 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe
[2012.07.23 09:28:06 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\Malwarebytes
[2012.07.23 09:27:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.23 09:27:51 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2012.07.23 09:27:51 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.07.23 09:27:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.23 00:29:19 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012.07.22 21:00:13 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\ElevatedDiagnostics
[2012.07.12 12:30:30 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtml.tlb
[2012.07.12 12:30:28 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieui.dll
[2012.07.12 12:30:28 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieUnatt.exe
[2012.07.12 12:30:28 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jsproxy.dll
[2012.07.12 12:30:27 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jscript9.dll
[2012.07.12 12:30:26 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\url.dll
[2012.07.12 12:30:25 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inetcpl.cpl
[2012.07.12 12:29:42 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.07.12 12:24:29 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\win32k.sys
[2012.07.11 09:27:22 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ncrypt.dll
[2012.07.11 09:27:20 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msxml3r.dll
[2012.07.11 09:27:18 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\cdosys.dll
[2012.07.05 23:34:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Gibraltar
[2012.07.05 21:50:27 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\assembly
[2012.06.28 22:02:44 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\Spotify
[2012.06.28 22:02:12 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\Spotify
[2012.06.27 12:32:20 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\Macromedia
[3 C:\Users\Julia\Desktop\*.tmp files -> C:\Users\Julia\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.23 12:16:50 | 000,700,858 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012.07.23 12:16:50 | 000,662,740 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012.07.23 12:16:50 | 000,147,544 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012.07.23 12:16:50 | 000,123,934 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012.07.23 12:15:40 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe
[2012.07.23 10:02:00 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.07.23 10:01:48 | 2388,078,592 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.23 09:27:52 | 000,001,027 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.23 08:56:05 | 004,503,728 | ---- | M] () -- C:\ProgramData\to_r0tsef.pad
[2012.07.22 21:50:01 | 210,292,736 | ---- | M] () -- C:\Users\Julia\Desktop\KWU_1.0.3.upd.iso
[2012.07.22 20:47:45 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.22 20:47:45 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.14 14:25:55 | 000,019,174 | ---- | M] () -- C:\Users\Julia\Desktop\Lebenslauf.pdf
[2012.07.13 17:22:02 | 000,247,979 | ---- | M] () -- C:\Users\Julia\Desktop\HH-2012-07-13-20.pdf
[2012.07.13 13:50:56 | 000,438,816 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012.07.05 22:43:46 | 001,530,957 | ---- | M] () -- C:\Users\Julia\Desktop\img005.jpg
[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2012.06.28 22:02:43 | 000,001,767 | ---- | M] () -- C:\Users\Julia\Desktop\Spotify.lnk
[2012.06.28 13:28:42 | 000,001,944 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012.06.27 12:31:30 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerApp.exe
[2012.06.27 12:31:30 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerCPLApp.cpl
[3 C:\Users\Julia\Desktop\*.tmp files -> C:\Users\Julia\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.23 09:27:52 | 000,001,027 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.22 21:47:11 | 210,292,736 | ---- | C] () -- C:\Users\Julia\Desktop\KWU_1.0.3.upd.iso
[2012.07.14 12:19:00 | 004,503,728 | ---- | C] () -- C:\ProgramData\to_r0tsef.pad
[2012.07.13 17:22:02 | 000,247,979 | ---- | C] () -- C:\Users\Julia\Desktop\HH-2012-07-13-20.pdf
[2012.07.13 16:46:30 | 000,019,174 | ---- | C] () -- C:\Users\Julia\Desktop\Lebenslauf.pdf
[2012.07.05 22:42:15 | 001,530,957 | ---- | C] () -- C:\Users\Julia\Desktop\img005.jpg
[2012.06.28 22:02:43 | 000,001,767 | ---- | C] () -- C:\Users\Julia\Desktop\Spotify.lnk
[2012.06.28 22:02:43 | 000,001,753 | ---- | C] () -- C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
[2010.12.11 19:14:12 | 000,183,040 | ---- | C] () -- C:\windows\PI.EXE
[2010.07.03 11:40:29 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.05.15 22:05:12 | 000,000,088 | ---- | C] () -- C:\ProgramData\profile.xml
 
========== LOP Check ==========
 
[2012.03.21 11:47:27 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\BullGuard
[2010.12.01 18:29:47 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1
[2011.05.04 09:23:04 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Design Science
[2010.05.24 01:13:36 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Dev-Cpp
[2010.05.15 22:17:43 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\EasyCapture
[2011.03.23 13:51:45 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\EPSON
[2011.01.28 19:46:00 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Software Inspection Library
[2012.07.12 22:35:53 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Spotify
[2012.07.05 23:34:39 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Swiss Academic Software
[2012.06.04 19:52:12 | 000,032,640 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---

und als zweitesOTL Logfile:
Code:
OTL Extras logfile created on: 23.07.2012 12:23:11 - Run 2
OTL by OldTimer - Version 3.2.54.0    Folder = C:\Users\Julia\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 2,15 Gb Available Physical Memory | 72,46% Memory free
5,93 Gb Paging File | 5,28 Gb Available in Paging File | 89,12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 420,55 Gb Total Space | 347,13 Gb Free Space | 82,54% Space Free | Partition Type: NTFS
Drive D: | 30,25 Gb Total Space | 0,01 Gb Free Space | 0,02% Space Free | Partition Type: NTFS
 
Computer Name: JULIA-PC | User Name: Julia | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{133DF113-4029-4F82-83F1-E674FADDF4A5}" = rport=139 | protocol=6 | dir=out | app=system |
"{24A9AFCA-8389-4914-8FC1-7D600D0404AD}" = lport=2869 | protocol=6 | dir=in | app=system |
"{2CF4E9DD-73BC-416E-B021-37B461F8A8E3}" = rport=138 | protocol=17 | dir=out | app=system |
"{3D594E47-C87E-47FC-A070-9E000CF0649E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{63ABDF70-BB3C-4D1F-BA10-43E92E173B8F}" = lport=138 | protocol=17 | dir=in | app=system |
"{77B3AD8B-3D65-4EAF-8EC9-8AA573670D75}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{A4DFC739-8059-4374-A9CD-908E10C6AC44}" = lport=137 | protocol=17 | dir=in | app=system |
"{B300309D-EA7B-4340-AD0E-BDFD344D8732}" = lport=445 | protocol=6 | dir=in | app=system |
"{B47DAB84-F75E-4B4B-B40E-6AFD231281EB}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BF288F80-DF91-4A65-A0D8-8B87AAD397FC}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{CC8F2ACF-6B67-48D6-AFD3-0697EEEC9C17}" = rport=445 | protocol=6 | dir=out | app=system |
"{D3B253B5-3FC3-419D-B3D2-8BD70686D68F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{D8F1B7F5-0CE5-4EB9-B335-78B749DB2307}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DFA35FE4-29D6-4B7F-8A5A-A9E0203478DD}" = rport=137 | protocol=17 | dir=out | app=system |
"{F21D6BE6-2525-4AED-BEB5-B640E3494C54}" = lport=139 | protocol=6 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08CE3A80-F65E-41CE-8DD4-BE7EF608E4F3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1057C318-91CB-47FC-A8F3-B754CAD7952B}" = dir=in | app=c:\program files\lenovo\readycomm\projectionist.exe |
"{11B3579F-3BD4-4FDC-BC6C-54A90C21095A}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{3A9A537A-E0FB-4D98-8353-D2269750A9D9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{478479C5-448F-4069-B5D3-12D01397BCEC}" = dir=in | app=c:\program files\lenovo\readycomm\connsvc.exe |
"{4BF916A7-8860-4B75-A624-5FC60B34D6AC}" = dir=out | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{5A68FF7C-5566-4BE1-BCC8-A92B29B0D6ED}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{5BE332CB-78D6-4BCF-BB15-066539B96EF3}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{61DE60AA-B04F-44CE-93BC-479340E8FDE2}" = dir=in | app=c:\windows\system32\igrssvcs.exe |
"{68CF0CA5-6AE0-4893-88D9-4AD7E0CF6F88}" = dir=in | app=c:\program files\lenovo\readycomm\readycom.exe |
"{6CEDF3B7-9A3D-4B8C-B577-3B0388465D31}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{89CB83CA-1410-49E2-BAF5-370D640FFBE8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{8DD8543B-2701-4454-A366-A5E1782EBC64}" = dir=out | app=c:\program files\lenovo\readycomm\projectionist.exe |
"{93884A1B-2D89-462E-B984-187BEF769BB0}" = dir=in | app=c:\program files\lenovo\readycomm\appsvc.exe |
"{96D9F09F-B2AF-450A-8D89-E279A2B224E8}" = dir=in | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{9AB5A4D7-9532-4530-BB33-6A865AD06705}" = dir=out | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{BA6DF80C-7EF8-4BF8-8C06-392B3FFFE1B0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{C88CA6AE-703D-4BCF-A019-AC196ACE52E6}" = dir=in | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{CBE98ECA-20C7-40B8-BC5E-BF86388FE8E2}" = dir=out | app=c:\program files\lenovo\readycomm\readycomm.exe |
"{D0907FFD-3A70-4BDD-A979-7B85D277F234}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{D7D1D6C2-5EC3-442F-A602-F9D6604684CC}" = dir=out | app=c:\program files\lenovo\readycomm\appsvc.exe |
"{E8A8C951-FF4A-480A-A66E-AEC2B0FF3FB7}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F24E1074-E72D-4A9C-AF50-8452CE72FD4C}" = dir=out | app=c:\program files\lenovo\readycomm\connsvc.exe |
"{F832A8CB-E3D2-4A93-9688-1D1E446E7966}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{F8E232A2-8BDB-42CF-839C-DBDC78E36FCC}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{FA142BA0-FE3B-473A-890C-55D29053F262}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{FFEF8F3D-09B2-4682-8116-527B39783515}" = dir=out | app=c:\windows\system32\igrssvcs.exe |
"TCP Query User{ACF798AB-4188-4033-8D08-E440563A0BF3}C:\users\julia\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\julia\appdata\roaming\spotify\spotify.exe |
"UDP Query User{C7B36A63-E037-43B6-AB03-290A85793085}C:\users\julia\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\julia\appdata\roaming\spotify\spotify.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{17542DBF-E17C-4562-BC4D-FA3EF3076C45}" = Lenovo ReadyComm 5
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{441C8911-CEC0-19E6-6CAC-694553E06A28}" = myphotobook.de
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{49F3D04B-B849-4C89-AB31-2366A004EA28}" = Broadcom Gigabit Integrated Controller
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{76C66170-C538-4E77-B54D-48E136B5B533}" = Lenovo ReadyComm 5.0 Service
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = Lenovo Bluetooth with Enhanced Data Rate Software
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.0 - Deutsch
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AE1E24C2-E720-42D5-B8E1-48F71A97B4DB}" = Energy Management
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}" = Cisco Systems VPN Client 5.0.07.0290
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D437FFB6-5C49-4DAC-ABAE-33FF065FE7CC}" = Graphviz 2.28
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E12C6653-1FF0-4686-ADB8-589C13AE761F}" = Citavi
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4C6DD02-8ACA-4354-BA36-9FFC3B767E73}" = Cisco AnyConnect VPN Client
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}" = Lenovo EasyCamera
"A6A8668C0A13640CA28FE2A7D9654BE4AE478B13" = Windows Driver Package - Broadcom Bluetooth  (07/30/2009 6.2.0.9405)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.9
"B7541EC5F72AA713F557569278EB6273725F5607" = Windows Driver Package - Broadcom Bluetooth  (06/15/2009 6.2.0.9000)
"BF20603967CFDCB2BBF91950E8A56DFBC5C833FE" = Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800)
"BullGuard" = BullGuard
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"CNXT_AUDIO_HDA" = Conexant HD Audio
"de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1" = myphotobook.de
"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2)
"DSMT5" = MathType 5
"EasyCapture4.0" = EasyCapture
"Enterprise Dynamics 8 Developer edition - v8.2.5.1153" = Enterprise Dynamics Developer 8.2.5.1153 1940
"EPSON Scanner" = EPSON Scan
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"Lenovo EasyCamera" = Lenovo EasyCamera
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"MiKTeX 2.9" = MiKTeX 2.9
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"PC-Doctor for Windows" = PC-Doctor für Windows
"PROHYBRIDR" = 2007 Microsoft Office system
"SugarSync" = SugarSync Manager
"TeXnicCenter_is1" = TeXnicCenter Version 1.0 Stable RC1
"TKKG16" = TKKG16
"VeriFace" = VeriFace
"VLC media player" = VLC media player 1.1.7
"vShare" = vShare Plugin
"WinLiveSuite_Wave3" = Windows Live Essentials
"Winmail Opener" = Winmail Opener 1.4
"WinRAR archiver" = WinRAR 4.00 (32-bit)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Spotify" = Spotify
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 27.11.2011 14:51:50 | Computer Name = Julia-PC | Source = Windows Backup | ID = 4104
Description =
 
Error - 30.11.2011 07:13:33 | Computer Name = Julia-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Graphviz
 2.28\bin\smyrna.exe".  Die abhängige Assemblierung "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 30.11.2011 07:13:49 | Computer Name = Julia-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Graphviz
 2.28\bin\testapp.exe".  Die abhängige Assemblierung "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 30.11.2011 07:18:04 | Computer Name = Julia-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\silicon
 motion\lenovo easycamera\driverpackage\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 30.11.2011 08:20:41 | Computer Name = Julia-PC | Source = VSS | ID = 13
Description =
 
Error - 05.12.2011 17:03:11 | Computer Name = Julia-PC | Source = Windows Backup | ID = 4104
Description =
 
Error - 11.12.2011 16:44:37 | Computer Name = Julia-PC | Source = Windows Backup | ID = 4104
Description =
 
Error - 14.12.2011 09:29:00 | Computer Name = Julia-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Graphviz
 2.28\bin\smyrna.exe".  Die abhängige Assemblierung "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 14.12.2011 09:29:17 | Computer Name = Julia-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Graphviz
 2.28\bin\testapp.exe".  Die abhängige Assemblierung "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 14.12.2011 09:33:41 | Computer Name = Julia-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\silicon
 motion\lenovo easycamera\driverpackage\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
[ Cisco AnyConnect VPN Client Events ]
Error - 23.07.2012 02:55:29 | Computer Name = JULIA-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp
Line:
 1020 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28901363
 (0xFE47000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could
 not contact target
 
Error - 23.07.2012 02:55:29 | Computer Name = JULIA-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 856 Invoked Function: CNetEnvironment::IsSGAccessible Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target
 
Error - 23.07.2012 02:55:29 | Computer Name = JULIA-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:
 190 Invoked Function: CNetEnvironment::testNetwork Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target
 
Error - 23.07.2012 02:55:57 | Computer Name = JULIA-PC | Source = vpnagent | ID = 67108866
Description = Function: CTlsTransport::OnTransportInitiateComplete File: .\IP\TlsTransport.cpp
Line:
 344 Invoked Function: ISocketTransportCB::OnTransportInitiateComplete Return Code:
 -31522780 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT
 
Error - 23.07.2012 02:55:57 | Computer Name = JULIA-PC | Source = vpnagent | ID = 67108866
Description = Function: CHttpSessionAsync::OnTransportInitiateComplete File: .\IP\HttpSessionAsync.cpp
Line:
 1002 Invoked Function: ISocketTransportCB::OnTransportInitiateComplete Return Code:
 -31522780 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT
 
Error - 23.07.2012 02:55:57 | Computer Name = JULIA-PC | Source = vpnagent | ID = 67108866
Description = Function: CHttpProbeAsync::OnOpenRequestComplete File: .\IP\HttpProbeAsync.cpp
Line:
 254 Invoked Function: CHttpSessionAsync::OnOpenRequestComplete Return Code: -31522780
 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT
 
Error - 23.07.2012 02:55:57 | Computer Name = JULIA-PC | Source = vpnagent | ID = 67108866
Description = Function: CSocketTransport::OnTimerExpired File: .\IPC\SocketTransport.cpp
Line:
 1175 Invoked Function: CSocketTransport::postConnectProcessing Return Code: -31522780
 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT
 
Error - 23.07.2012 02:56:09 | Computer Name = JULIA-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp
Line:
 1020 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28901363
 (0xFE47000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could
 not contact target
 
Error - 23.07.2012 02:56:09 | Computer Name = JULIA-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 856 Invoked Function: CNetEnvironment::IsSGAccessible Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target
 
Error - 23.07.2012 02:56:09 | Computer Name = JULIA-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:
 190 Invoked Function: CNetEnvironment::testNetwork Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target
 
[ OSession Events ]
Error - 25.05.2011 17:02:29 | Computer Name = Julia-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 173505
 seconds with 9120 seconds of active time.  This session ended with a crash.
 
Error - 10.05.2012 08:25:49 | Computer Name = Julia-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 7505
 seconds with 120 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 23.07.2012 06:19:51 | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 23.07.2012 06:19:51 | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 23.07.2012 06:19:51 | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 23.07.2012 06:20:59 | Computer Name = Julia-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "\Device\HarddiskVolume2" den Befehl "chkdsk" aus.
 
Error - 23.07.2012 06:21:24 | Computer Name = Julia-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "\Device\HarddiskVolume2" den Befehl "chkdsk" aus.
 
Error - 23.07.2012 06:23:59 | Computer Name = Julia-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "\Device\HarddiskVolume2" den Befehl "chkdsk" aus.
 
Error - 23.07.2012 06:24:06 | Computer Name = Julia-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "\Device\HarddiskVolume2" den Befehl "chkdsk" aus.
 
Error - 23.07.2012 06:24:51 | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 23.07.2012 06:24:51 | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 23.07.2012 06:24:51 | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
 
< End of report >
--- --- ---


Wie geht es nun weiter?

t'john 23.07.2012 17:47
Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
:OTL
DRV - (WinRing0_1_2_0) -- D:\test\ECECECEC\WinRing0.sys File not found
DRV - (USBCCID) -- system32\DRIVERS\RtsUCcid.sys File not found
DRV - (RtsUIR) -- system32\DRIVERS\Rts516xIR.sys File not found
DRV - (beuds) -- System32\drivers\grrine.sys File not found
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes,DefaultScope = {4388CE1D-6DF9-42BE-8D13-A6E72C4481C9}
IE - HKCU\..\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}: "URL" = http://vshare.toolbarhome.com/search.aspx?q={searchTerms}&srch=dsp
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{4388CE1D-6DF9-42BE-8D13-A6E72C4481C9}: "URL" = http://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledItems: antiphishing@bullguard:1.1
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.2
FF - prefs.js..network.proxy.http: "202.171.253.99 "
FF - prefs.js..network.proxy.http_port: 80
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Julia\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab (Reg Error: Key error.)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{7b38ca46-a0bb-11df-83a5-002622db633d}\Shell - "" = AutoRun
O33 - MountPoints2\{7b38ca46-a0bb-11df-83a5-002622db633d}\Shell\AutoRun\command - "" = F:\Startme.exe

[2012.07.23 08:56:05 | 004,503,728 | ---- | M] () -- C:\ProgramData\to_r0tsef.pad

 
:Files

C:\Users\Julia\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

F:\Startme.exe

C:\ProgramData\to_r0tsef.pad
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

JuliaNas 23.07.2012 18:16
Log File von OTL:

All processes killed
========== OTL ==========
Service WinRing0_1_2_0 stopped successfully!
Service WinRing0_1_2_0 deleted successfully!
File D:\test\ECECECEC\WinRing0.sys File not found not found.
Service USBCCID stopped successfully!
Service USBCCID deleted successfully!
File system32\DRIVERS\RtsUCcid.sys File not found not found.
Service RtsUIR stopped successfully!
Service RtsUIR deleted successfully!
File system32\DRIVERS\Rts516xIR.sys File not found not found.
Service beuds stopped successfully!
Service beuds deleted successfully!
File System32\drivers\grrine.sys File not found not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4388CE1D-6DF9-42BE-8D13-A6E72C4481C9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4388CE1D-6DF9-42BE-8D13-A6E72C4481C9}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "about:home" removed from browser.startup.homepage
Prefs.js: antiphishing@bullguard:1.1 removed from extensions.enabledItems
Prefs.js: vshare@toolbar:1.0.2 removed from extensions.enabledItems
Prefs.js: "202.171.253.99 " removed from network.proxy.http
Prefs.js: 80 removed from network.proxy.http_port
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Spotify Web Helper deleted successfully.
C:\Users\Julia\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Starting removal of ActiveX control 55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7b38ca46-a0bb-11df-83a5-002622db633d}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b38ca46-a0bb-11df-83a5-002622db633d}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7b38ca46-a0bb-11df-83a5-002622db633d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b38ca46-a0bb-11df-83a5-002622db633d}\ not found.
File F:\Startme.exe not found.
C:\ProgramData\to_r0tsef.pad moved successfully.
========== FILES ==========
File\Folder C:\Users\Julia\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe not found.
File\Folder F:\Startme.exe not found.
File\Folder C:\ProgramData\to_r0tsef.pad not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Julia\Desktop\cmd.bat deleted successfully.
C:\Users\Julia\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56468 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Julia
->Temp folder emptied: 178744573 bytes
->Temporary Internet Files folder emptied: 27323380 bytes
->Java cache emptied: 17180059 bytes
->FireFox cache emptied: 612132693 bytes
->Flash cache emptied: 229397 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2801332 bytes
RecycleBin emptied: 32407537 bytes

Total Files Cleaned = 831,00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Julia
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.54.0 log created on 07232012_190739

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

t'john 23.07.2012 18:26
Sehr gut! :daumenhoc

Wie laeuft der Rechner?

1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

JuliaNas 24.07.2012 07:46
Läuft ganz ok. Vielleicht etwas langsamer als vorher, kann aber auch sein, dass mir das nur so vorkommt.

Malwarebyte hat nichts gefunden:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.23.11

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Julia :: JULIA-PC [Administrator]

Schutz: Aktiviert

24.07.2012 00:10:35
mbam-log-2012-07-24 (00-10-35).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 329159
Laufzeit: 1 Stunde(n), 47 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


und die log datei von adwcleaner:

# AdwCleaner v1.703 - Logfile created 07/24/2012 at 02:32:21
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (32 bits)
# User : Julia - JULIA-PC
# Running from : C:\Users\Julia\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Julia\AppData\Local\TempDir
Folder Found : C:\Users\Julia\AppData\LocalLow\vShare
Folder Found : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\8p8fa579.default\extensions\vshare@toolbar
Folder Found : C:\Program Files\vShare

***** [Registry] *****

Key Found : HKCU\Software\Softonic
Key Found : HKCU\Software\vShare
Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\vsharechrome
Key Found : HKLM\SOFTWARE\Classes\vShare.IMedixProtocol
Key Found : HKLM\SOFTWARE\Classes\vShare.IMedixProtocol.1
Key Found : HKLM\SOFTWARE\Classes\vShare.PugiObj
Key Found : HKLM\SOFTWARE\Classes\vShare.PugiObj.1
Key Found : HKLM\SOFTWARE\Classes\vShare.ScriptHelpers
Key Found : HKLM\SOFTWARE\Classes\vShare.ScriptHelpers.1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vShare

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484}
Key Found : HKLM\SOFTWARE\Classes\Interface\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{3E315C81-442B-431C-AEC8-ED189699EC24}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{043C5167-00BB-4324-AF7E-62013FAEDACF}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default
File : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\8p8fa579.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [2641 octets] - [24/07/2012 02:32:21]

########## EOF - C:\AdwCleaner[R1].txt - [2769 octets] ##########

t'john 25.07.2012 00:48
Sehr gut! :daumenhoc


  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.




danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

JuliaNas 25.07.2012 10:21
adwcleaner:

# AdwCleaner v1.703 - Logfile created 07/25/2012 at 09:31:53
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (32 bits)
# User : Julia - JULIA-PC
# Running from : C:\Users\Julia\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\Julia\AppData\Local\TempDir
Folder Deleted : C:\Users\Julia\AppData\LocalLow\vShare
Folder Deleted : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\8p8fa579.default\extensions\vshare@toolbar
Folder Deleted : C:\Program Files\vShare

***** [Registry] *****

Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\vShare
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\vsharechrome
Key Deleted : HKLM\SOFTWARE\Classes\vShare.IMedixProtocol
Key Deleted : HKLM\SOFTWARE\Classes\vShare.IMedixProtocol.1
Key Deleted : HKLM\SOFTWARE\Classes\vShare.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\vShare.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\vShare.ScriptHelpers
Key Deleted : HKLM\SOFTWARE\Classes\vShare.ScriptHelpers.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vShare

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3E315C81-442B-431C-AEC8-ED189699EC24}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{043C5167-00BB-4324-AF7E-62013FAEDACF}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default
File : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\8p8fa579.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [2770 octets] - [24/07/2012 02:32:21]
AdwCleaner[S1].txt - [2751 octets] - [25/07/2012 09:31:53]

########## EOF - C:\AdwCleaner[S1].txt - [2879 octets] ##########

Emsisoft:

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 25.07.2012 09:42:37

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An

Scan Beginn: 25.07.2012 09:43:26

C:\Users\Julia\Documents\Uni\C++\hausaufgabe1.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\Übung\matrix.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\start.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_201-206\ab_201b_fibonacci.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_201-206\ab_201a_moins_versetzt.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_201-206\ab_201_schleifen_alle.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_01_progr_101-109\000_start.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\Weitere Aufgaben\ws0708_cpp_anwendungen_13-17.zip -> ws0708_16b_buchst_sort_ca.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\Weitere Aufgaben\ws0708_cpp_anwendungen_13-17\ws0708_16b_buchst_sort_ca (2).exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\Weitere Aufgaben\ws0708_cpp_anwendungen_13-17\ws0708_16b_buchst_sort_ca.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\test\namestreppe.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\test\primzahlencheck.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\test\test.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\test\Unbenannt1.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\C++Übung\Übung 5\oop.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\C++Übung\Übung 4\namestreppe.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\C++Übung\Übung 3\312_hipp.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\C++Übung\Übung 2\203_a_hallo.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\ab_termin_3\ab_302_schachbrett.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\Termin3\200_start.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\Termin3\202_if.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\Termin3\204_while_do.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\Termin3\205 do while.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\Termin3\208_halloooo.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\Termin 3neu\Termin 3\306_schach.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Weitere Aufgaben\ws0708_cpp_anwendungen_13-17.zip -> ws0708_16b_buchst_sort_ca.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben_11\Primzahlcheck.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben_11\Treppenbau.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\alpahbet_ich++.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Alfred- Busse.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Namenaufstellen.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Zahlengitter gross.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z Folder.1\Alfred- Busse.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z -> Alfred- Busse.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z Folder\alpahbet_ich++.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z Folder\Alfred- Busse.exe gefunden: Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\5.Termin\namentreppe.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2011-01-24 125642\Backup Files 2011-01-24 125642\Backup files 6.zip -> C\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z -> Alfred- Busse.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2011-01-24 125642\Backup Files 2011-01-24 125642\Backup files 6.zip -> C\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-12-19 203537\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\ab_termin_3\ab_302_schachbrett.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-12-19 203537\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\test\Unbenannt1.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2011-01-24 125642\Backup Files 2011-01-24 125642\Backup files 6.zip -> C\Users\Julia\Documents\Uni\C++\C++ Testat\Weitere Aufgaben\ws0708_cpp_anwendungen_13-17.zip -> ws0708_16b_buchst_sort_ca.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2011-01-24 125642\Backup Files 2011-01-24 125642\Backup files 6.zip -> C\Users\Julia\Documents\Uni\C++\C++ Testat\Weitere Aufgaben\ws0708_cpp_anwendungen_13-17.zip gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-28 212259\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\Termin 3neu\Termin 3\306_schach.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-28 212259\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\ab_termin_3\ab_302_schachbrett.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-21 190003\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\namestreppe.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-21 190003\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\test.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-28 212259\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\C++šbung\šbung 2\203_a_hallo.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-28 212259\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\test\namestreppe.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-28 212259\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\test\test.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-15 171851\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z Folder\alpahbet_ich++.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-15 171851\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_01_progr_101-109\000_start.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-15 171851\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_201-206\ab_201a_moins_versetzt.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-15 171851\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_201-206\ab_201b_fibonacci.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-15 171851\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_201-206\ab_201_schleifen_alle.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-06-15 225201\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\C++ Testat\5.Termin\namentreppe.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-06-15 225201\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z Folder\Alfred- Busse.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-06-15 225201\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z Folder.1\Alfred- Busse.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-06-15 225201\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\Termin3\200_start.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-06-15 225201\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\Termin3\202_if.exe gefunden: Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-06-15 225201\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\Termin3\204_while_do.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-06-15 225201\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\Termin3\205 do while.exe gefunden: Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-06-15 225201\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\Termin3\208_halloooo.exe gefunden: Trojan.Win32.Shutdowner!E2

Gescannt 594106
Gefunden 63

Scan Ende: 25.07.2012 11:13:34
Scan Zeit: 1:30:08

C:\Users\Julia\Documents\Uni\C++\Übung\matrix.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_201-206\ab_201b_fibonacci.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_201-206\ab_201_schleifen_alle.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\Weitere Aufgaben\ws0708_cpp_anwendungen_13-17.zip -> ws0708_16b_buchst_sort_ca.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\Weitere Aufgaben\ws0708_cpp_anwendungen_13-17\ws0708_16b_buchst_sort_ca (2).exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\Weitere Aufgaben\ws0708_cpp_anwendungen_13-17\ws0708_16b_buchst_sort_ca.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\test\Unbenannt1.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\C++Übung\Übung 4\namestreppe.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\C++Übung\Übung 3\312_hipp.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\ab_termin_3\ab_302_schachbrett.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\Termin3\202_if.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\Termin 3neu\Termin 3\306_schach.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Weitere Aufgaben\ws0708_cpp_anwendungen_13-17.zip -> ws0708_16b_buchst_sort_ca.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben_11\Primzahlcheck.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben_11\Treppenbau.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Namenaufstellen.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-12-19 203537\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\ab_termin_3\ab_302_schachbrett.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2011-01-24 125642\Backup Files 2011-01-24 125642\Backup files 6.zip -> C\Users\Julia\Documents\Uni\C++\C++ Testat\Weitere Aufgaben\ws0708_cpp_anwendungen_13-17.zip -> ws0708_16b_buchst_sort_ca.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-28 212259\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\Termin 3neu\Termin 3\306_schach.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-15 171851\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_201-206\ab_201b_fibonacci.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-06-15 225201\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\Termin3\202_if.exe Quarantäne Hoax.Win32.BadJoke.MovingMouse!E2
C:\Users\Julia\Documents\Uni\C++\hausaufgabe1.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\start.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_201-206\ab_201a_moins_versetzt.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\ws10_cpp_ab_01_progr_101-109\000_start.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\test\namestreppe.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\test\primzahlencheck.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\test\test.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\C++Übung\Übung 5\oop.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\WS 10_11\C++Übung\Übung 2\203_a_hallo.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\Termin3\200_start.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\Termin3\204_while_do.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\Termin3\205 do while.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\Termin3\208_halloooo.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\alpahbet_ich++.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Alfred- Busse.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Zahlengitter gross.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z Folder.1\Alfred- Busse.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z -> Alfred- Busse.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z Folder\alpahbet_ich++.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\Testataufgaben12\Testataufgaben12.7z Folder\Alfred- Busse.exe Quarantäne Trojan.Win32.Shutdowner!E2
C:\Users\Julia\Documents\Uni\C++\C++ Testat\5.Termin\namentreppe.exe Quarantäne Trojan.Win32.Shutdowner!E2
D:\JULIA-PC\Backup Set 2010-05-24 221517\Backup Files 2010-11-21 190003\Backup files 1.zip -> C\Users\Julia\Documents\Uni\C++\WS 10_11\namestreppe.exe Quarantäne Trojan.Win32.Shutdowner!E2

Quarantäne 43

t'john 25.07.2012 14:05
Hi Julia,

studierst du Informatik?
die Sachen die du kennst und sicher bist, dass sie sauber sind, kannst du wieder aus der Quarantaene holen.


Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden.


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

JuliaNas 25.07.2012 20:45
Nee, studiere Wirtschaftsingenieurwesen. Hatte bloß C++ in nem techn. Informatikkurs.

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=6baf9437d6b0e047a14837e0935ddf38
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-25 05:54:53
# local_time=2012-07-25 07:54:53 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=4609 16776573 60 61 821 64630170 0 0
# compatibility_mode=5893 16776573 100 94 577 94858969 0 0
# compatibility_mode=8192 67108863 100 0 265 265 0 0
# scanned=188206
# found=1
# cleaned=0
# scan_time=11136
C:\Users\Julia\Downloads\vlc-1.1.7-win32.exe        Win32/StartPage.OIE trojan (unable to clean)        00000000000000000000000000000000        I

t'john 25.07.2012 20:54
Sehr gut! :daumenhoc

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 5 ) herunter laden.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.


Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

JuliaNas 25.07.2012 22:12
Hab ich jetzt auch erledigt :)
Noch irgendwas?

t'john 26.07.2012 11:36
Sehr gut! :daumenhoc

damit bist Du sauber und entlassen! :)


Tool-Bereinigung mit OTL


Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
  • Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
  • Speichere es auf Deinem Desktop.
  • Doppelklick auf OTL.exe um das Programm auszuführen.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Klicke auf den Button "Bereinigung"
  • OTL fragt eventuell nach einem Neustart.
    Sollte es dies tun, so lasse dies bitte zu.
Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.


Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html


Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

  • Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
  • temporäre Dateien löschen.




Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html

JuliaNas 26.07.2012 12:03
Vielen, vielen Dank! Du hast mir echt die Woche gerettet. Brauchte den Rechner nämlich dringend um eine Seminararbeit zu schreiben, die morgen Abgabe hat.


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:32 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19