|
mein firefox spinnt und microsoft office Code: Logfile of Trend Micro HijackThis v2.0.2Code: ComboScan v20070226.18 run by xxxxxxxxx on 2010-03-14 at 16:20:46Code: ComboScan v20070226.18 run by xxxxxxxxxxxx on 2010-03-14 at 16:20:46 |
Hi, Bitte folgende Files prüfen: Dateien Online überprüfen lassen:
Code: C:\Windows\SysWow64\udxllgjlildrw.dll
Dann gibt es noch das hier (neben ein paar anderen Sachen:) Zitat:
Malwarebytes Antimalware (MAM) Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html Falls der Download nicht klappt, bitte hierüber eine generische Version runterladen: http://filepony.de/download-chameleon/ Fullscan und alles bereinigen lassen! Log posten. OTL Lade Dir OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop * Doppelklick auf die OTL.exe * Vista/Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen * Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output * Unter Extra Registry, wähle bitte Use SafeList * Klicke nun auf Run Scan links oben * Wenn der Scan beendet wurde werden 2 Logfiles erstellt * Poste die Logfiles hier in den Thread. chris Für mich: ... O4 - HKLM\..\Run: [krrxttnyslqnji] C:\Windows\System32\regsvr32.exe /s "C:\Windows\SysWow64\udxllgjlildrw.dll" F2 - REG:system.ini: UserInit=userinit.exe,C:\Windows\system32\msytes32.exe,C:\Windows\system32\sdra64.exe, O2 - BHO: ezLife browser enhancer rdfvgsdu - {10134F49-AA57-444E-B1A4-9BC7488B87C3} - C:\Windows\SysWOW64\rdfvgsdu.dll O2 - BHO: gooochi browser enhancer - {3B97AB0B-9FF2-B93C-FB57-B6A9724436CA} - C:\Windows\SysWOW64\udxllgjlildrw.dll ... |
das geht mit dem button (durchsuchen) auf virustotal gibt es noch eine seite die das macht |
dauert einwenig ab grade denn die datei acedrv09.sys in den arch getretten |
Code: Logfile of Trend Micro HijackThis v2.0.2 |
jetzt hab ich das mit dem MAM nur das mit dem Virtustotal geht irgendwie nicht |
das ist von OTL [code]OTL Extras logfile created on: 15.03.2010 01:56:00 - Run 1 OTL by OldTimer - Version 3.1.37.1 Folder = D:\Download 64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18882) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 57,00% Memory free 8,00 Gb Paging File | 6,00 Gb Available in Paging File | 75,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 293,33 Gb Total Space | 156,71 Gb Free Space | 53,42% Space Free | Partition Type: NTFS Drive D: | 596,17 Gb Total Space | 594,03 Gb Free Space | 99,64% Space Free | Partition Type: NTFS Drive E: | 293,08 Gb Total Space | 275,74 Gb Free Space | 94,09% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded Drive H: | 1,82 Gb Total Space | 0,04 Gb Free Space | 2,10% Space Free | Partition Type: FAT32 I: Drive not present or media not loaded Computer Name: CHRISTINASPC Current User Name: cHrIsTiNaLiCiOuS Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* File not found cmdfile [open] -- "%1" %* File not found comfile [open] -- "%1" %* File not found exefile [open] -- "%1" %* File not found helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* File not found regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" File not found Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" File not found Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data] "VistaSp2" = 78 32 0A ED 0F 60 CA 01 [binary data] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "oobe_av" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe:*:Enabled:eDSfsu -- (Egis Incorporated.) "C:\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe:*:Enabled:encryption -- ( Egis Incorporated.) "C:\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe:*:Enabled:decryption -- ( Egis Incorporated.) "C:\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe:*:Enabled:eDSMgr -- File not found "C:\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe:*:Enabled:eDStbmngr -- (Egis Incorporated.) "C:\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe:*:Enabled:eDSfsu -- (Egis Incorporated.) "C:\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe:*:Enabled:encryption -- File not found "C:\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe:*:Enabled:decryption -- File not found "C:\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe:*:Enabled:eDSMgr -- File not found "C:\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe:*:Enabled:eDStbmngr -- (Egis Incorporated.) "C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE" = C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE:*:Enabled:ACER.EMPOWERING.FRAMEWORK.SUPERVISOR -- (Acer Inc.) "C:\Acer\Empowering Technology\eDataSecurity\x86\eDSrf.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\eDSrf.exe:*:Enabled:eDSrf -- (Egis Incorporated.) "C:\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe:*:Enabled:eDSfsu -- (Egis Incorporated.) "C:\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe:*:Enabled:encryption -- ( Egis Incorporated.) "C:\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe:*:Enabled:decryption -- ( Egis Incorporated.) "C:\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe:*:Enabled:eDSMgr -- File not found "C:\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe:*:Enabled:eDStbmngr -- (Egis Incorporated.) "C:\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe:*:Enabled:eDSfsu -- (Egis Incorporated.) "C:\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe:*:Enabled:encryption -- File not found "C:\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe:*:Enabled:decryption -- File not found "C:\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe:*:Enabled:eDSMgr -- File not found "C:\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe:*:Enabled:eDStbmngr -- (Egis Incorporated.) "C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE" = C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE:*:Enabled:ACER.EMPOWERING.FRAMEWORK.SUPERVISOR???1????????? -- (Acer Inc.) "C:\Acer\Empowering Technology\eDataSecurity\x86\eDSrf.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\eDSrf.exe:*:Enabled:eDSrf -- (Egis Incorporated.) ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0FA05792-FB7E-474F-AF07-0F9AA474C502}" = rport=138 | protocol=17 | dir=out | app=system | "{27B50138-A60C-4392-A74D-5ED1F03E4BE8}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{357A372F-2C3E-4758-A482-FD8078153941}" = lport=138 | protocol=17 | dir=in | app=system | "{521A456B-A43E-484B-941D-9E47571D39E2}" = lport=139 | protocol=6 | dir=in | app=system | "{56B1B21C-61AC-4574-8CDF-5C3F16549531}" = rport=137 | protocol=17 | dir=out | app=system | "{5780BE94-5B14-4133-8E1E-A27E59022A50}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{760000E7-7385-45C9-A2C0-3E5DBA5FEBAB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{76893480-5EA7-488D-8F95-1DC6B7C4CA25}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | "{7CB9D303-78F1-4968-A09D-D7305922779B}" = lport=445 | protocol=6 | dir=in | app=system | "{980C54B1-FC85-4969-93D1-ADD20E19A69A}" = rport=445 | protocol=6 | dir=out | app=system | "{C1994B60-60D8-4F8D-B5F5-4580A0798B73}" = rport=139 | protocol=6 | dir=out | app=system | "{D3D93E56-AB0A-48B9-8963-31AC4827ED57}" = lport=2869 | protocol=6 | dir=in | app=system | "{F632B6AC-3385-4C93-9742-61DCA92CC561}" = lport=137 | protocol=17 | dir=in | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{088641C2-EAB6-4E71-ACDC-C49E2AF6F3C0}" = dir=in | app=c:\program files (x86)\acer arcade live\acer dvdivine\acer dvdivine.exe | "{0E1AFC82-916C-4D85-A5B5-632BD2ADD679}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe | "{160EE90E-D237-4642-9514-35C802C89203}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{1C9FB18B-967D-430C-B169-14D1D93C58E9}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | "{20A5EC57-B14E-4A59-99D2-871FA0B1B762}" = dir=in | app=c:\program files (x86)\acer arcade live\acer homemedia connect\kernel\dms\clmsserver.exe | "{21683066-D4DA-4C18-AA4F-32767F8E4967}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | "{2BBE1537-0262-409D-95AF-BABAAD7AEF7E}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe | "{309564D5-7BF3-41C0-ABDE-F7DC3A8FE2A5}" = protocol=6 | dir=in | app=c:\windows\system32\hasplms.exe | "{39163BB1-8783-4623-93E2-7655EE030654}" = protocol=17 | dir=in | app=c:\users\christinalicious\appdata\local\temp\dologin.exe | "{453A6BAF-1BD1-4E18-B903-F47781A7F21C}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | "{4DD79626-2267-4990-9F8C-8386DB8F2DF2}" = protocol=6 | dir=in | app=c:\users\christinalicious\appdata\local\temp\dologin.exe | "{4EDD497D-1237-4341-8F1D-AA6824294602}" = protocol=6 | dir=in | app=c:\users\christinalicious\appdata\local\temp\jmstart.exe | "{5333F88A-77DF-4DCE-A29A-F73D802BE100}" = dir=in | app=c:\program files (x86)\acer arcade live\acer homemedia trial creator\acer homemedia trial creator.exe | "{5D1450C6-D3E4-4733-8122-ED307707AB86}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{5F25F558-C588-44F8-BE18-3B15B2EE9A97}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe | "{69CB0511-ED7D-4797-8A9D-4FCA1116000E}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | "{71725025-0AA5-4AFD-AD83-C67DCB177A71}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | "{742E9FFA-3E8C-4394-B3FC-7E1F884DFED0}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | "{7ED5E35B-21F2-4247-955D-6E4283DA082D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{86E0281D-9A12-48E3-AE14-41EAC4E604B9}" = dir=in | app=c:\program files (x86)\acer arcade live\acer homemedia\acer homemedia.exe | "{8E5962B0-C8EF-4E85-BA8B-4412EC7B15E9}" = protocol=17 | dir=in | app=c:\windows\system32\hasplms.exe | "{90A93270-2158-4CE8-AEE4-2A1EBB641CF1}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | "{91DAC26F-F35C-4190-B0F0-447FDC4F6CA6}" = protocol=17 | dir=in | app=c:\users\christinalicious\appdata\local\temp\jmstart.exe | "{98706121-A054-49AA-83F6-225848460864}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | "{A03E20C6-D02F-44C5-80D0-05CCA57E5F5A}" = protocol=17 | dir=in | app=e:\program files (x86)\thq\gas powered games\supreme commander - forged alliance\bin\forgedalliance.exe | "{A7CDF499-DC4C-478E-BEE4-825B195CA79E}" = dir=in | app=c:\program files (x86)\acer arcade live\acer dv magician\acer dv magician.exe | "{AA62440C-D6CA-4A8B-8C8B-4D32ED8DD6D3}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | "{C8439F3F-D823-43AC-88ED-C7A8DF7C9A3D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{D45A21FB-0D1A-48AA-B55D-681BD7AD758F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{D5984256-DFC7-4750-B0ED-4F6D249E279E}" = protocol=6 | dir=in | app=e:\program files (x86)\thq\gas powered games\supreme commander - forged alliance\bin\forgedalliance.exe | "{DC649DC1-89C5-49EA-AE0E-DF7959EF63DA}" = dir=in | app=c:\program files (x86)\acer arcade live\acer slideshow dvd\acer slideshow dvd.exe | "{E504C940-8C19-4E86-B448-C2464B06615F}" = dir=in | app=c:\program files (x86)\acer arcade live\acer videomagician\acer videomagician.exe | "{E8DCA116-67F8-4F69-9421-3F9A158FDB76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{EBAE139E-7E48-47E0-9F40-B0B2902E9AE5}" = dir=in | app=c:\program files (x86)\acer arcade live\acer homemedia connect\acer homemedia connect.exe | "{F10CFEE6-EFD6-4B6B-B6E3-C207C038C0C9}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | "{F5A5CD4B-CD70-4B8A-9FA3-B557704E7195}" = dir=in | app=c:\program files (x86)\acer arcade live\acer arcade live main page\acer arcade live.exe | "TCP Query User{0700D86C-CC6F-4D27-8C5D-AA7559CF1A22}C:\users\christinalicious\program files (x86)\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\christinalicious\program files (x86)\dna\btdna.exe | "TCP Query User{4811A943-234E-4483-99EB-B39C3D643C62}C:\users\christinalicious\downloads\keygen.cyberlink.power.producer.5.0.0314.exe" = protocol=6 | dir=in | app=c:\users\christinalicious\downloads\keygen.cyberlink.power.producer.5.0.0314.exe | "TCP Query User{5C9FDA12-707E-4D37-BAAE-D6CB915054A0}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | "TCP Query User{871283E4-7B6A-4597-973C-61F0F14E6999}C:\users\christinalicious\program files (x86)\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\christinalicious\program files (x86)\dna\btdna.exe | "TCP Query User{B1E2732D-B870-4E14-B786-A173ED1DA2F5}E:\program files (x86)\shareaza\shareaza.exe" = protocol=6 | dir=in | app=e:\program files (x86)\shareaza\shareaza.exe | "UDP Query User{217DBADB-A6B4-4D8A-BA5A-91A48B357F82}C:\users\christinalicious\program files (x86)\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\christinalicious\program files (x86)\dna\btdna.exe | "UDP Query User{504851D6-D827-4A10-AA2E-B3BA5DE5B7CB}C:\users\christinalicious\downloads\keygen.cyberlink.power.producer.5.0.0314.exe" = protocol=17 | dir=in | app=c:\users\christinalicious\downloads\keygen.cyberlink.power.producer.5.0.0314.exe | "UDP Query User{6855874B-CDEE-46A1-ADB7-A92BB8A6FBE6}C:\users\christinalicious\program files (x86)\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\christinalicious\program files (x86)\dna\btdna.exe | "UDP Query User{B1090DAD-FBE1-411E-B62A-18B13E69B6A3}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | "UDP Query User{CB8F309E-D5BC-4CBA-AE22-F9A270648D61}E:\program files (x86)\shareaza\shareaza.exe" = protocol=17 | dir=in | app=e:\program files (x86)\shareaza\shareaza.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu "{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64) "{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007 "{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007 "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{9EFE7D1F-B20F-4E81-B27C-B3C701702250}" = ATI Catalyst Install Manager "{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "NVIDIA Drivers" = NVIDIA Drivers "SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software "SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set "Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software "SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software "SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software "WinRAR archiver" = WinRAR [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect "{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter "{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker "{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7 "{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2 "{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate "{1FF12BFD-84AC-4E81-9A8F-496E5C2DDA79}_is1" = Didi V3 "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 17 "{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie "{31D95937-B237-405D-920C-A3EF4E482395}" = Supreme Commander - Forged Alliance "{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed "{342F5437-C87D-4BB5-89B9-B23E16C6A395}" = Microsoft VC80 Support DLLs "{359CFC0A-BEB1-440D-95BA-CF63A86DA34F}" = Nero Recode "{368BA326-73AD-4351-84ED-3C0A7A52CC53}" = Nero Rescue Agent "{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker "{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD "{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger "{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision "{4c96d036-3475-45bf-9ddc-81bc736b9f4b}" = Nero 9 Trial "{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works "{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053 "{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call "{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites "{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart "{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights "{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver "{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}" = Bonjour "{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007 "{98736A65-3C79-49EC-B7E9-A3C77774B0E6}" = Google SketchUp 6 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9E82B934-9A25-445B-B8DF-8012808074AC}" = Nero PhotoSnap "{A209525B-3377-43F4-B886-32F6B6E7356F}" = Nero WaveEditor "{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management "{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress "{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder "{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = Acer HomeMedia "{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter "{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology "{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.5 - Deutsch "{AC76BA86-7AD7-1031-7B44-A81300000003}_814" = KB408682 "{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder "{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter "{B145EC69-66F5-11D8-9D75-000129760D75}" = Acer DVDivine "{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles "{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center "{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}" = Google SketchUp 6 "{B580C409-E16F-44FF-904D-3AE94E113BE0}" = Acer HomeMedia Trial Creator "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player "{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit "{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter "{C194D333-B84A-4BB7-B35E-060732D98DC4}" = GPGNet "{C19BE821-89B1-4A96-AC7C-873810C0CB5F}" = ContentSAFER for Wizmax "{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3 "{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail "{C5A7CB6C-E76D-408F-BA0E-85605420FE9D}" = SoundTrax "{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser "{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1 "{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management "{D025A639-B9C9-417D-8531-208859000AF8}" = NeroBurningROM "{D3EC9E5A-27BA-4834-828E-5D7A77CDE964}" = Samsung PC Studio 3 "{D462BF9E-0C35-4705-BF9B-3DF9F3816643}" = Acer ePerformance Management "{D47087E7-AA15-4D1D-8C0A-60F7E446D597}" = PSP ISO Compressor "{D6373F2B-6B98-4C84-8C25-78EB41BA31B9}" = DesignPro 5 SE Goldedition "{D9DCF92E-72EB-412D-AC71-3B01276E5F8B}" = Nero ShowTime "{DF6F459C-8B89-4F88-B63F-A2E136BB6B79}" = SweetIM for Messenger 2.8 "{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update "{E498385E-1C51-459A-B45F-1721E37AA1A0}" = Movie Templates - Starter Kit "{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster 2010 "{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer "{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer "{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform "{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F1861F30-3419-44DB-B2A1-C274825698B3}" = Nero Disc Copy Gadget "{F5C63795-2708-4D15-BF18-5ABBFF7DFFC8}" = iTunes "{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician "{F79A208D-D929-11D9-9D77-000129760D75}" = Acer VideoMagician "{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials "{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "a-squared Anti-Malware_is1" = a-squared Anti-Malware 4.5 "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "AviSynth" = AviSynth 2.5 "CoreAAC" = CoreAAC "DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters "ENTERPRISE" = Microsoft Office Enterprise 2007 "EPSON Scanner" = EPSON Scan "ESET Online Scanner" = ESET Online Scanner v3 "Gehirnjogging - Der Trainer fürs Gedächtnis..." = Gehirnjogging - Der Trainer fürs Gedächtnis... "Gehirnjogging 2" = Gehirnjogging 2 "Gehirnjogging 3" = Gehirnjogging 3 "InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker "InstallShield_{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7 "InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2 "InstallShield_{D6373F2B-6B98-4C84-8C25-78EB41BA31B9}" = DesignPro 5 SE Goldedition "Messenger Plus! Live" = Messenger Plus! Live & Sponsor (CiD) "Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package "Mozilla Firefox (3.5.8)" = Mozilla Firefox (3.5.8) "PSPVC" = PSPVC :: PSP Video Converter v3.75 "Shareaza_is1" = Shareaza 2.5.2.0 "ShockwaveFlash" = Macromedia Flash Player 8 "Uninstall_is1" = Uninstall 1.0.0.1 "VirtualCloneDrive" = VirtualCloneDrive "VirusTotalUploader2.0" = VirusTotal Uploader 2.0 "VLC media player" = VLC media player 0.9.9 "WinLiveSuite_Wave3" = Windows Live Essentials ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Free Realms Installer" = Free Realms Installer ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 13.03.2010 10:30:37 | Computer Name = ChristinasPC | Source = WinMgmt | ID = 10 Description = Error - 13.03.2010 10:31:36 | Computer Name = ChristinasPC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung msnmsgr.exe, Version 14.0.8089.726, Zeitstempel 0x4a6ce533, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03824, Ausnahmecode 0xc0000022, Fehleroffset 0x0006f04e, Prozess-ID 0x1720, Anwendungsstartzeit 01cac2b9e05680df. Error - 13.03.2010 11:30:45 | Computer Name = ChristinasPC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung msnmsgr.exe, Version 14.0.8089.726, Zeitstempel 0x4a6ce533, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03824, Ausnahmecode 0xc0000022, Fehleroffset 0x0006f04e, Prozess-ID 0x17c8, Anwendungsstartzeit 01cac2c2256f090f. Error - 13.03.2010 12:13:20 | Computer Name = ChristinasPC | Source = WinMgmt | ID = 10 Description = Error - 13.03.2010 12:14:24 | Computer Name = ChristinasPC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung msnmsgr.exe, Version 14.0.8089.726, Zeitstempel 0x4a6ce533, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03824, Ausnahmecode 0xc0000022, Fehleroffset 0x0006f04e, Prozess-ID 0x6e0, Anwendungsstartzeit 01cac2c82da8e028. Error - 13.03.2010 12:14:25 | Computer Name = ChristinasPC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung msnmsgr.exe, Version 14.0.8089.726, Zeitstempel 0x4a6ce533, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03824, Ausnahmecode 0xc0000022, Fehleroffset 0x0006f04e, Prozess-ID 0x10ec, Anwendungsstartzeit 01cac2c82dbe4c88. Error - 13.03.2010 12:14:26 | Computer Name = ChristinasPC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung msnmsgr.exe, Version 14.0.8089.726, Zeitstempel 0x4a6ce533, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03824, Ausnahmecode 0xc0000022, Fehleroffset 0x0006f04e, Prozess-ID 0x11ec, Anwendungsstartzeit 01cac2c82e88ef88. Error - 13.03.2010 12:14:26 | Computer Name = ChristinasPC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung msnmsgr.exe, Version 14.0.8089.726, Zeitstempel 0x4a6ce533, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03824, Ausnahmecode 0xc0000022, Fehleroffset 0x0006f04e, Prozess-ID 0x10b4, Anwendungsstartzeit 01cac2c83d567c88. Error - 13.03.2010 12:18:41 | Computer Name = ChristinasPC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung rundll32.exe, Version 6.0.6000.16386, Zeitstempel 0x4549b0e1, fehlerhaftes Modul USER32.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03824, Ausnahmecode 0xc0000142, Fehleroffset 0x0006f04e, Prozess-ID 0xe78, Anwendungsstartzeit 01cac2c8d73dbf78. Error - 13.03.2010 12:19:32 | Computer Name = ChristinasPC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung msnmsgr.exe, Version 14.0.8089.726, Zeitstempel 0x4a6ce533, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03824, Ausnahmecode 0xc0000022, Fehleroffset 0x0006f04e, Prozess-ID 0xc68, Anwendungsstartzeit 01cac2c8f219a9d8. [ System Events ] Error - 14.03.2010 17:59:04 | Computer Name = ChristinasPC | Source = Service Control Manager | ID = 7026 Description = Error - 14.03.2010 18:52:21 | Computer Name = ChristinasPC | Source = Application Popup | ID = 1060 Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten. Error - 14.03.2010 18:52:32 | Computer Name = ChristinasPC | Source = EventLog | ID = 6008 Description = Das System wurde zuvor am 14.03.2010 um 23:50:36 unerwartet heruntergefahren. Error - 14.03.2010 18:52:38 | Computer Name = ChristinasPC | Source = Print | ID = 19 Description = Der Druckspooler konnte den Drucker Epson Stylus CX3600 (M) nicht unter dem Namen Epson Stylus CX3600 (M) freigeben. Fehler: 2114. Der Drucker kann nicht von anderen Benutzern im Netzwerk verwendet werden. Error - 14.03.2010 18:52:38 | Computer Name = ChristinasPC | Source = Print | ID = 19 Description = Der Druckspooler konnte den Drucker Canon Inkjet PIXMA iP4000 nicht unter dem Namen Canon Inkjet PIXMA iP4000 freigeben. Fehler: 2114. Der Drucker kann nicht von anderen Benutzern im Netzwerk verwendet werden. Error - 14.03.2010 18:53:10 | Computer Name = ChristinasPC | Source = Service Control Manager | ID = 7026 Description = Error - 14.03.2010 20:09:55 | Computer Name = ChristinasPC | Source = Application Popup | ID = 1060 Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten. Error - 14.03.2010 20:10:03 | Computer Name = ChristinasPC | Source = Print | ID = 19 Description = Der Druckspooler konnte den Drucker Epson Stylus CX3600 (M) nicht unter dem Namen Epson Stylus CX3600 (M) freigeben. Fehler: 2114. Der Drucker kann nicht von anderen Benutzern im Netzwerk verwendet werden. Error - 14.03.2010 20:10:03 | Computer Name = ChristinasPC | Source = Print | ID = 19 Description = Der Druckspooler konnte den Drucker Canon Inkjet PIXMA iP4000 nicht unter dem Namen Canon Inkjet PIXMA iP4000 freigeben. Fehler: 2114. Der Drucker kann nicht von anderen Benutzern im Netzwerk verwendet werden. Error - 14.03.2010 20:10:38 | Computer Name = ChristinasPC | Source = Service Control Manager | ID = 7026 Description = < End of report > |
Code: OTL logfile created on: 15.03.2010 01:56:00 - Run 1 |
Code: ComboScan v20070226.18 run by cHrIsTiNaLiCiOuS on 2010-03-15 at 01:56:19 |
Code: Logfile of Trend Micro HijackThis v2.0.2 |
Hi, poste das Log von MAM noch... Du hast sehr viel Filesharing-Sw am Laufen, Bearshare würde ich auf jeden Fall komplett entfernen: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.bearshare.com/ O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - E:\Program Files (x86)\Shareaza\RazaWebHook32.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.7.16.dll (file missing) Folgendes File suchen und bei virustotal.com prüfen lassen: O4 - Global Startup: ASETRES.EXE Ein Active-X das geladen wird (kennst Du das? Sonst mit HJ fixen lassen): O16 - DPF: {A21769F8-CEC5-4AFA-A6A4-CC921A15DF40} (ActiveXControl Object) - hxxp://62.146.191.133/atlas_activex.dll Fixen HJ: Hijackthis, fixen: Öffne das HijackThis -- Button "scan" -- vor den unten genannten Einträge(n) Häkchen setzen -- Button "Fix checked" -- PC neustarten Achtung: Alle Anwendungen bis auf HJ müssen geschlossen sein, ein eventuell aktiver Teatimer von Spybot muss unbedingt deaktiviert sein!) Code: O16 - DPF: {A21769F8-CEC5-4AFA-A6A4-CC921A15DF40} (ActiveXControl Object) - http://62.146.191.133/atlas_activex.dllhttp://www.trojaner-board.de/59299-a...eb-cureit.html Nach Beendigung des Scans findes Du das Log unter %USERPROFILE%\DoctorWeb\CureIt.log. Bevor du irgendwelche Aktionen unternimmst, kopiere bitte den Inhalt des Logs und poste ihn. Die Log Datei ist sehr groß, ca. über 5MB Text. Benutzt einfach die Suche nach "infiziert" und kopiert betreffende Teile heraus, bevor Du sie postet. chris |
Das mit dem Virustotal.com funktioniert nicht, da ich nichts hochladen kann. In dem weißen Feld kann ich nichtmal reinschreiben. Gibt es noch eine gleichwertige Seite, auf der man das überprüfen lassen kann? Ich habe auch das Programm Killbox runtergeladen, ist das empfehlenswert? Ich kann leider erstmal nicht weitermachen, da ich ein paar Tage über wegfahre. Am Donnerstag Abend komme ich wieder. Bist du am Donnerstag dann auch so gegen 21 Uhr hier im Forum online um das Thema weiterzuführen? Aber Danke schonmal für deine Hilfe bis jetzt! |
Hi, http://virusscan.jotti.org/de Bin heute den ganzen Tag unterwegs, werde den Notebook mitnehmen (Do)... Hast Du Cureit laufen lassen? Poste bitte das Log... (Falls die Log Datei ist sehr groß ist, benutzt einfach die Suche nach "infiziert" und kopiert betreffende Teile heraus, bevor Du sie postet.) chris |
Code: Logfile of Trend Micro HijackThis v2.0.2 |
Code: Malwarebytes' Anti-Malware 1.44 |
Code: 4b84d6d6.qua\data001;C:\Documents and Settings\All Users\Anwendungsdaten\Avira\AntiVir Desktop\INFECTED\4b84d6d6.qua;Trojan.MulDrop.39620;; |
das mit der datei (O4 - Global Startup: ASETRES.EXE) die ist von acer kann mich nicht mal mehr über firefox irgendwo anmelden selbst hier kann ich nicht mal was schreiben wie bei google so bald ich was schreibe wie den benutzernamen oder was suchen will stürzt mir firefox ab musste jetzt ins internetcafe gehen |
virustotal geht im internetcafe aber nicht zuhause |
Hi, das sieht nicht gut aus, wenn Dr. Web recht hat, dann hattest Du einen Backdoor, Keylogger etc. auf dem Rechner und dann ist Neuaufsetzen angesagt...! Ändere sofort von einem sauberen Rechner aus alle Passwörter! Weiterhin ist noch einiges an Malware zu sehen, die typisch für die Verwendung von gecrackten Versionen ist...und dann dürfen wir hier aus rechtlichen Gründen nicht weitermachen... Normalerweise käme jetzt Combofix zum Einsatz, Du hast aber ein 64Bit-System und da ist er nicht lauffähig...
Code: :Files
Arbeite alles was unter dem Link angegeben ist ab und berichte dann im Thread! Erstmal keine PlugIns installieren und das gemachte Backup von Firefox nicht einspielen. http://www.trojaner-board.de/411645-post19.html Prevx: http://www.prevx.com/freescan.asp Falls das Tool was findet, nicht das Log posten sondern einen Screenshot des dann angezeigten Fensters... chris |
wäre es klug das ganze zu plätten und windows 7 zu kaufen und drauf zu machen. denn ich hab jetzt grade vista drauf das war schon drauf doch ich habe ja keine cd dafür was würdest du mir raten |
Hi, Windows7 ist nicht schlecht, brauch etwas weniger Ressourcen wie Vista und ist auch etwas schneller... chris |
hab jetzt vista busniness 32bit sp1 aber ich komme nicht weiter er will das ich für NVIDIA nForce Serial ATA Controller einen treiber installiere das habe ich gemacht doch es geht trotztdem nicht was kann das sein vieleicht kannst du mir helfen oder mich weiter leiten dank dir noch mal für deine hilfe |
Hi, kommt darauf an, es gibt das Probleme mit Vista und nForce3: Zitat:
http://www.aoaforums.com/forum/os-software-firmware-and-bios/36856-definitive-guide-installing-vista-32-64bit-2.html chris |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 18:39 Uhr. |
Copyright ©2000-2025, Trojaner-Board