|
TR/Buzus.cjzh Hallo, ich habe ein Problem: Und zwar kann ich seit vorgestern kein Webbroser außer Internetexplorer mehr öffnen. Auch mehrfaches deinstallieren und aufspielen von Mozilla Firefox hat nichts gebracht. Darauf hin habe ich AntiVir drüberlaufen lassen, das brachte folgendes Ergbniss: Die Datei 'C:\Users\***\Downloads\qosdemo-ch.zip' enthielt einen Virus oder unerwünschtes Programm 'TR/Buzus.cjzh' [trojan]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4e472c59.qua' verschoben! Aus der Quarantäne habe ich den Trojaner dann gelöscht. Meine Browser funktioniern immer noch nicht. Ist der Trojaner noch auf dem Rechner? Ich habe Windows Vista. ICh habe mir vorhin Hijackthis heruntergeladen, weiß jedohc nicht ob mit das Programm etwas bringt.... Bitte helft mir!! Danke im Vorraus! |
kann mir keiner helfen? Bitte ich benötige dringend hilfe!!! |
wenn du dir selbst antwortest dauerts noch länger. und schau dich mal um, wie viele hilfesuchenden es gibt, und wie viele helfer. da kanns schon mal 1 2 tage dauern bis man ne antwort bekommt. Systemscan mit OTL download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL explorer.exe iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt beide posten. |
so... zuerst die Otl.Txt:OTL Logfile: Code: OTL logfile created on: 02.01.2011 12:06:13 - Run 1 |
und nun der Extras.Txt OTL Extras logfile created on: 02.01.2011 12:06:13 - Run 1 OTL by OldTimer - Version 3.2.20.0 Folder = C:\Users\Gross\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 40,00% Memory free 6,00 Gb Paging File | 4,00 Gb Available in Paging File | 70,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 275,41 Gb Total Space | 154,50 Gb Free Space | 56,10% Space Free | Partition Type: NTFS Drive D: | 22,66 Gb Total Space | 12,53 Gb Free Space | 55,28% Space Free | Partition Type: FAT32 Drive G: | 931,51 Gb Total Space | 781,82 Gb Free Space | 83,93% Space Free | Partition Type: NTFS Computer Name: GROSS-PC | User Name: Gross | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe File not found [HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe File not found ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) http [open] -- Reg Error: Value error. https [open] -- Reg Error: Value error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~4\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 1 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found "VistaSp2" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0AC2F297-5DA9-4A41-9004-60B32D1FDCFD}" = rport=137 | protocol=17 | dir=out | app=system | "{15CED677-3FC5-45BB-9A31-23733B1B7E37}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | "{4460B05D-BD7C-4F43-9327-CAB54157C776}" = lport=49160 | protocol=6 | dir=in | name=akamai netsession interface | "{4DAFCAF3-B5FE-4FA8-A3B3-D88A0B8463AB}" = lport=138 | protocol=17 | dir=in | app=system | "{5FA9BF9B-1E7D-4096-8242-BA7339D4E47F}" = rport=445 | protocol=6 | dir=out | app=system | "{651B29D9-3424-4EC6-97C2-069145561A3E}" = lport=2869 | protocol=6 | dir=in | app=system | "{7C1CE133-4C6D-465A-808B-7E8FD4540591}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | "{7D15ED71-D6C4-468C-8060-3E36AE15E919}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{8B6842E4-AB1C-4D00-9F11-6FFEE4641C35}" = lport=50719 | protocol=6 | dir=in | name=akamai netsession interface | "{918C1AE2-D1AE-4E1D-9DA0-46D723368A14}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{B37FC679-D656-44EC-B5BA-24A81B4504AA}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | "{C14ED166-F218-4E2A-B755-600B0E01416A}" = rport=138 | protocol=17 | dir=out | app=system | "{C82BCAAE-F572-46A8-A776-0608DA177F9F}" = lport=137 | protocol=17 | dir=in | app=system | "{DD2C30B5-54A7-4450-95A5-A3E47DB2F955}" = lport=139 | protocol=6 | dir=in | app=system | "{E187A010-7EE6-4896-BD7F-41E303AAF635}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{E337AA90-6B49-4507-821D-D5ED8824E4E7}" = lport=445 | protocol=6 | dir=in | app=system | "{EF126E78-012B-48D4-BCC7-E490EB4B2CA2}" = rport=139 | protocol=6 | dir=out | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0F47084A-C3E6-4524-8008-397409F71DFD}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | "{1667984A-C0C6-41E3-9DFF-78E1D2E22D43}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe | "{166EF1AF-16F2-4CFF-8A78-9CF06C3E8480}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | "{1E4B4109-28F9-428B-988F-F3354E8AF415}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "{2519480E-3659-41A0-825E-FE9DDF30C349}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{26E7A98D-9DE6-4724-9CED-F187651D1A26}" = dir=in | app=c:\program files\itunes\itunes.exe | "{289F4083-94FF-4FA0-964B-8AD17F302DA2}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{2ED6EC49-CDE0-4B41-A8BF-FC750FB625D2}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe | "{3239E8B9-270F-4CA8-9CFA-485F190D95A9}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | "{489AB371-E36D-4F46-AA87-5D2848A7786E}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{55570B96-1C9D-4369-AD8E-4DF7E8CE7BFF}" = protocol=6 | dir=in | app=c:\program files\2k games\firaxis games\sid meier's civilization 4 complete\civilization4.exe | "{5ADE21EC-C410-47AB-B693-C90B5D7FF2CC}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | "{6CE02981-A999-48A3-9FC7-4D5AC280B0AC}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{72508D1B-D434-4F04-BF6A-C394BE823D42}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{751C97F4-59A0-4FF7-BC92-287E4314CC1B}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{76AA2F8A-5176-4FEC-91F0-4E5DBC12A7DF}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | "{826F7892-1DF8-43A2-91DA-96B34345CC01}" = protocol=17 | dir=in | app=c:\program files\2k games\firaxis games\sid meier's civilization 4 complete\civilization4.exe | "{89123A18-F927-4700-8334-926539906B3C}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{91C1A3FE-C5A8-4EF6-B275-5FAB499843BC}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | "{92E39538-9A60-4B43-B23D-10A3FE6EAEA3}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{95A7C276-05C2-42B5-8BD8-1A1A4B32C361}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe | "{96EE7343-328E-460B-B372-2B36D01EE775}" = dir=in | app=c:\program files\homecinema\makedisc\makedisc.exe | "{9CC3C7EF-F2CA-4D14-AC98-1E1B6AAF8A54}" = dir=in | app=c:\program files\homecinema\powerdvd\powerdvd.exe | "{9D073A91-3FF4-4CCF-A22B-7512BA0229F4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{A260A4AC-C43D-4925-AA48-6C1142A84951}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{A3F28025-7604-40E5-A991-8A9930CBFE30}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{ADAB77E5-A4A7-448D-88A9-D68F95D71C1F}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | "{AE7F59D8-2E45-4F35-9CDF-79C9D84D16E9}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | "{C04D1C46-9DEE-403D-BA42-E2137DB8FE19}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "{C227D39D-0F66-475A-99BB-9EE6965DF638}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | "{C7502F25-D77E-45AC-A118-9FB6F5CFC59F}" = dir=in | app=c:\program files\homecinema\powerdirector\pdr.exe | "{C9B1122A-FC10-4DF2-8997-5AAAC8528EAE}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{C9E034A2-027C-40DD-AC30-331437011759}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | "{CCA2E593-FBD0-4A08-952B-2783C2A5B2AE}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | "{CCD43553-BDB4-431B-8F95-71A9CC0A23BD}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | "{D0C149E3-679F-4339-A35B-D19514EAFE85}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | "{D29FA71B-2968-4640-8D23-3008DE96F67B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{D9801DC9-A2F9-4A2F-BC97-307383E798A1}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe | "{DC73C1B5-FC81-49BE-9F0C-3B4FC1C508CD}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | "{E51D1F59-4CED-4925-8283-2E42565D2F15}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{EC69E0B8-2DBB-43E7-93DD-EEB91D5CB6FA}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | "TCP Query User{07F3FFB2-5F75-42C0-A587-89EB43236E20}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | "TCP Query User{4A4FAF70-B82A-435E-BED9-948C36D69B1B}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | "TCP Query User{4EB61411-17DB-4C36-B3FA-296D52969CBC}C:\program files\firefly studios\civcity rom\civcity rome.exe" = protocol=6 | dir=in | app=c:\program files\firefly studios\civcity rom\civcity rome.exe | "TCP Query User{5429EDB7-1860-4A0B-A3F8-9CD5B15BD6F6}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | "TCP Query User{5CA4F608-6328-4E8A-B50C-4DA63442AC53}C:\users\gross\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\gross\program files\dna\btdna.exe | "TCP Query User{5FAB2B90-8747-47AB-A0B5-7708255A4DD2}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | "TCP Query User{60EE8999-5A7C-4A4E-B596-F7BA1DEE296E}C:\users\gross\downloads\fogdownloader-rom_2_1_0_1871.exe" = protocol=6 | dir=in | app=c:\users\gross\downloads\fogdownloader-rom_2_1_0_1871.exe | "TCP Query User{6D597724-262F-47B5-99A4-DE654EAF3B7A}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | "TCP Query User{6E4FBD08-D28A-441A-A279-417294BA2482}C:\program files\icq7.0\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | "TCP Query User{73775B64-DFE3-4202-92B0-83D38B6D03DD}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | "TCP Query User{784F0FDE-49E5-4106-BFB2-C38D484C25BC}C:\program files\sixteen tons entertainment\emergency4\em4.exe" = protocol=6 | dir=in | app=c:\program files\sixteen tons entertainment\emergency4\em4.exe | "TCP Query User{7FBA2DFA-16CF-4EC4-8D35-EF732B2E749F}C:\games\paintball2\paintball2.exe" = protocol=6 | dir=in | app=c:\games\paintball2\paintball2.exe | "TCP Query User{8720084B-7B00-45AF-8B89-3CB8C30B446D}C:\program files\ea sports\fifa 09\fifa09.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa 09\fifa09.exe | "TCP Query User{A2C79EED-D20C-4E4B-8E21-36890AE22FFE}C:\users\gross\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\gross\program files\dna\btdna.exe | "TCP Query User{A52F70B8-405F-4EE5-8FE0-B1BE4DBD99C7}C:\program files\cabal online\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\cabal online\launcher\update\estdnheadless.exe | "TCP Query User{B6B3B337-93E2-4CD6-A850-E67F107D2291}C:\program files\ea sports\fifa 11 demo\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa 11 demo\game\fifa.exe | "TCP Query User{BBADE203-77D2-479D-A910-1581A8D72B70}C:\aeriagames\wolfteam-de\wolfteam.bin" = protocol=6 | dir=in | app=c:\aeriagames\wolfteam-de\wolfteam.bin | "TCP Query User{BBC87D89-8BE0-418E-85CC-506C4F9EB536}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | "TCP Query User{BDD37F86-9F04-4286-8DE4-D528854F71B6}C:\program files\poptop software\shattered union\shatteredunion.exe" = protocol=6 | dir=in | app=c:\program files\poptop software\shattered union\shatteredunion.exe | "TCP Query User{C1A217B0-10C7-4B8C-A6CF-240F698A18B9}C:\program files\sixteen tons entertainment\emergency4\em4.exe" = protocol=6 | dir=in | app=c:\program files\sixteen tons entertainment\emergency4\em4.exe | "TCP Query User{D176C001-A0ED-479E-9622-18EDA0098185}C:\program files\ea sports\fifa 09\fifa09.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa 09\fifa09.exe | "TCP Query User{D47364EA-306C-4B7B-971F-A97DEA43267A}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe | "TCP Query User{DCCA0F86-30BD-42F5-8B3C-D9EE972E3640}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | "TCP Query User{E86899AD-C985-48C3-A6F2-00DBD24D740F}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | "TCP Query User{FC1B01D5-E4D9-4EA7-9AA3-04D9E32FAA75}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | "TCP Query User{FF99CDA9-44F5-4EDF-9B19-DE31D7213BD4}C:\program files\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa 11\game\fifa.exe | "UDP Query User{042A1079-869F-4A0A-A3E6-25A6F17E1474}C:\games\paintball2\paintball2.exe" = protocol=17 | dir=in | app=c:\games\paintball2\paintball2.exe | "UDP Query User{05426C61-99E7-4384-837C-2EE0AB5AA71F}C:\aeriagames\wolfteam-de\wolfteam.bin" = protocol=17 | dir=in | app=c:\aeriagames\wolfteam-de\wolfteam.bin | "UDP Query User{1028C509-5E1F-4098-8A14-27828734F277}C:\users\gross\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\gross\program files\dna\btdna.exe | "UDP Query User{3B8FDD40-DECD-4EA2-B39E-7715C27E7835}C:\program files\sixteen tons entertainment\emergency4\em4.exe" = protocol=17 | dir=in | app=c:\program files\sixteen tons entertainment\emergency4\em4.exe | "UDP Query User{60DDF314-F806-4A6A-A5CD-AAD3C73B37CA}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | "UDP Query User{624C4FC5-FA17-40D9-A7FD-DC9841694DC3}C:\users\gross\downloads\fogdownloader-rom_2_1_0_1871.exe" = protocol=17 | dir=in | app=c:\users\gross\downloads\fogdownloader-rom_2_1_0_1871.exe | "UDP Query User{630E3F68-8974-44C6-8763-98888B72222D}C:\program files\sixteen tons entertainment\emergency4\em4.exe" = protocol=17 | dir=in | app=c:\program files\sixteen tons entertainment\emergency4\em4.exe | "UDP Query User{6703147A-C5C7-407D-90F3-07A8AFEAF9CD}C:\program files\ea sports\fifa 11 demo\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa 11 demo\game\fifa.exe | "UDP Query User{6D9F262A-5CFD-4F3B-8BA7-354DF45AC03A}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | "UDP Query User{6F36DD27-9A4F-4B4C-A6E7-0C448AD98DC1}C:\program files\ea sports\fifa 09\fifa09.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa 09\fifa09.exe | "UDP Query User{790C16EA-FE34-4403-AFE7-BE697920F460}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | "UDP Query User{7DA35949-1A31-451C-B3BD-67AA5DDF2DBD}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | "UDP Query User{81AB5603-4B86-4998-8054-955C669184B0}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | "UDP Query User{9BEDC2B1-69BF-4A82-8AF3-DA367D575E6E}C:\program files\cabal online\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\cabal online\launcher\update\estdnheadless.exe | "UDP Query User{A72A8B93-5B3B-4F78-875F-BB1CA59D7522}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | "UDP Query User{AF294144-ACBF-46AC-9424-D6A09F2BFB0D}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | "UDP Query User{B194AD43-69D4-4C68-8627-0A8E84193728}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | "UDP Query User{B348C33F-1B51-491B-A536-D0738C33BF2E}C:\program files\ea sports\fifa 09\fifa09.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa 09\fifa09.exe | "UDP Query User{BB514999-B119-411A-ADFF-13F3A5F186CD}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe | "UDP Query User{C19A8821-4A5E-4562-913C-60F9B4FF6C66}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | "UDP Query User{C84976A0-0809-4F6D-B42E-604FB4B03976}C:\program files\icq7.0\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | "UDP Query User{D0F11A6B-BE48-4DC1-9C92-846382470708}C:\users\gross\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\gross\program files\dna\btdna.exe | "UDP Query User{DC5F1031-369F-4199-9366-F98ECAD84128}C:\program files\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa 11\game\fifa.exe | "UDP Query User{F3695F60-BE2B-4A6A-93DE-5DB7D99BF322}C:\program files\poptop software\shattered union\shatteredunion.exe" = protocol=17 | dir=in | app=c:\program files\poptop software\shattered union\shatteredunion.exe | "UDP Query User{F9AA2576-6DAC-4B61-93DC-9D5555FB1F88}C:\program files\firefly studios\civcity rom\civcity rome.exe" = protocol=17 | dir=in | app=c:\program files\firefly studios\civcity rom\civcity rome.exe | "UDP Query User{FF00A183-1CB2-4254-ACF0-0DDBA789810D}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu "{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant "{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas "{11AFE21E-B193-430D-B57A-DFF7815BB962}" = Ulead PhotoImpact 12 "{18DC1F9A-15B9-4707-A9CD-C2F66239261E}" = COMPUTERBILD-Abzockschutz "{1AA7DDDB-A253-4E0F-867A-6E450E7F9022}" = A-Train8EU "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1FDA5A37-B22D-43FF-B582-B8964050DC13}" = Microsoft Games for Windows - LIVE Redistributable "{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder "{2315B23D-3E21-4920-837D-AE6460934ECB}" = FIFA 09 "{237CD223-1B9D-47E8-A76C-E478B83CCEA2}" = File Uploader "{255FC1CF-2620-4B64-BE02-79B9E609BB3D}" = Webzen Game Starter "{2B091530-69AA-442E-AB09-39ED06B58220}" = Windows Live Messenger "{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component "{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Suyin Webcam "{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11 "{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth "{47948554-90C6-4AAC-8CFA-D23CE11C1031}" = Nero 8 Essentials "{4EC8B911-98AB-4819-B5EE-D32E8A0A8AAA}_is1" = DVDx 2 "{56780980-C930-4775-88B8-85301EDBEBE6}_is1" = Transport Manager "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime "{5B5A6B3A-9DF7-4B81-9F29-5CC668406904}" = Pixia "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 "{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2 "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{781D316B-77BA-48C3-8310-42EAFB61ED31}" = Shattered Union "{7A7B0BF3-2F00-4F03-8A9B-6ABCC07B90C6}" = Windows Live installer "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{86A4C6D9-29EE-4719-AFA1-BA3341862B83}" = Microsoft Games for Windows - LIVE "{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility "{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista "{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2 "{89E0B0D4-DFC3-49B9-8E88-F1B801325C8A}" = Emergency 3 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007 "{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager "{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon 3 "{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German) "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9A4C534E-431F-4A17-97D4-D1682B19A054}" = Emergency4 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch "{B145EC69-66F5-11D8-9D75-000129760D75}" = MakeDisc "{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR "{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "{BD1587F7-B8D0-4111-8F1F-3327628AB02F}" = 3531-W-D "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.4.9 "{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center "{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow! "{D45E8C45-B601-4A80-AFD8-E16338744DE1}" = ArcSoft Panorama Maker 4 "{D5A9B7C0-8751-11D8-9D75-000129760D75}" = MediaShow "{D8D22773-14BF-4178-A683-3DBA515C2A26}" = WISO Mein Geld 2008 Professional "{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader "{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware "{E0091C29-DEE8-4B24-BF65-8C35B5940D77}" = Letstrade "{E08DE897-B6AF-4DFF-9E90-131E80C876B4}" = DIE SIEDLER - Das Erbe der Könige - Gold Edition "{E4A71A41-BCC8-480a-9E69-0DA29CBA7ECA}" = 1 "{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0 "{E815FB81-995F-4F33-8E25-F16712123AB7}" = AuthenTec Fingerprint Sensor Minimum Install "{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer "{EA926717-CE5A-4CB4-AB21-9E6E9565A458}" = RCT3 Soaked "{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer "{EBBB1DEF-8878-4CB8-BC0D-1196B30E7527}" = ANNO 1503 "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support "{F007CBCE-D714-4C0B-8CE9-9B0D78116468}" = ViewNX "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729) "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01 "{F4E57F49-84B4-4CF2-B0A1-8CA1752BDF7E}" = OmniPass 5.00.91 "{F916C6DF-2601-4385-9500-C45FF398D4CB}" = Install(GE) "{FEDE400D-3381-4087-ACCB-689DD8A56123}" = Inst5657 "{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour "3554AA4B-9B0B-451a-A269-2B5F53982209_is1" = ThreatFire "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites "Ad-Aware" = Ad-Aware "Adobe Acrobat 4.0" = Adobe Acrobat 4.0 "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 11.5 "Akamai" = Akamai NetSession Interface "Aktiv MP3 Recorder" = Aktiv MP3 Recorder "Art Mahjongg 1" = Art Mahjongg 1 "Audacity_is1" = Audacity 1.2.6 "AutoGK" = Auto Gordian Knot 2.55 "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "AviSynth" = AviSynth 2.5 "Bridge Construction Set Demo_is1" = Bridge Construction Set Demo 1.37 "CCleaner" = CCleaner "CloneDVD2" = CloneDVD2 "conduitEngine" = Conduit Engine "EADM" = EA Download Manager "EASEUS Todo Backup Home 2.0_is1" = EASEUS Todo Backup Home 2.0 "ENTERPRISE" = Microsoft Office Enterprise 2007 "Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4 "Free Audio Converter_is1" = Free Audio Converter version 1.4 "Free DVD Video Converter_is1" = Free DVD Video Converter version 1.5 "Free Sound Recorder" = Free Sound Recorder "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8 "Glary Utilities_is1" = Glary Utilities 2.29.0.1032 "Google Desktop" = Google Desktop "Google Updater" = Google Updater "GTK 2.0" = GTK+ Runtime 2.14.7 rev a (nur entfernen) "ImgBurn" = ImgBurn "InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "LetsTrade" = LetsTrade Komponenten "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Neffy" = Neffy 1,3,29,0 "NVIDIA Drivers" = NVIDIA Drivers "OpenAL" = OpenAL "OpenTTD" = OpenTTD 1.0.0 "pc-profi-Chart_de2010_is1" = pc-profi-Chart_de2010 "PhotoScape" = PhotoScape "Picasa 3" = Picasa 3 "ProtectDisc Driver 11" = ProtectDisc Driver, Version 11 "Samsung ML-2240 Series" = Samsung ML-2240 Series "SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set "Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software "ShapeCollage" = Shape Collage "softonic-de3 Toolbar" = softonic-de3 Toolbar "SopCast" = SopCast 3.2.4 "SynTPDeinstKey" = Synaptics Pointing Device Driver "Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2 "TeamViewer 5" = TeamViewer 5 "Train Simulator 1.0" = Microsoft Train Simulator "Uninstall_is1" = Uninstall 1.0.0.1 "VobSub" = VobSub v2.23 (Remove Only) "WinRAR archiver" = WinRAR "WolfTeam" = WolfTeam "WolfTeam-DE" = WolfTeam-DE "XviD MPEG4 Video Codec" = XviD MPEG4 Video Codec (remove only) "ZonerPhotoStudio12_DE_is1" = Zoner Photo Studio 12 "Zylom Games Player Plugin" = Zylom Games Player Plugin ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-3059421624-3991891353-2127967058-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "BitTorrent DNA" = DNA ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 01.01.2011 13:59:17 | Computer Name = Gross-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6002.18005, Zeitstempel 0x49e01da5, fehlerhaftes Modul mscms.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03790, Ausnahmecode 0xc0000096, Fehleroffset 0x00003c04, Prozess-ID 0xa58, Anwendungsstartzeit 01cba9da8060a935. Error - 01.01.2011 13:59:38 | Computer Name = Gross-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6002.18005, Zeitstempel 0x49e01da5, fehlerhaftes Modul mscms.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03790, Ausnahmecode 0xc0000005, Fehleroffset 0x00003c14, Prozess-ID 0x1520, Anwendungsstartzeit 01cba9dd9efbc6b5. Error - 01.01.2011 13:59:40 | Computer Name = Gross-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6002.18005, Zeitstempel 0x49e01da5, fehlerhaftes Modul mscms.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03790, Ausnahmecode 0xc0000005, Fehleroffset 0x00003d16, Prozess-ID 0x1520, Anwendungsstartzeit 01cba9dd9efbc6b5. Error - 01.01.2011 14:45:44 | Computer Name = Gross-PC | Source = WinMgmt | ID = 10 Description = Error - 01.01.2011 15:33:42 | Computer Name = Gross-PC | Source = Application Hang | ID = 1002 Description = Programm ImgBurn.exe, Version 2.5.4.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen. Prozess-ID: 1204 Anfangszeit: 01cba9e9de5b32d0 Zeitpunkt der Beendigung: 20 Error - 01.01.2011 18:01:29 | Computer Name = Gross-PC | Source = WinMgmt | ID = 10 Description = Error - 01.01.2011 20:32:27 | Computer Name = Gross-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung spoolsv.exe, Version 6.0.6002.18294, Zeitstempel 0x4c6a9898, fehlerhaftes Modul TFWAH.dll, Version 4.10.1.14, Zeitstempel 0x4b4fa0ac, Ausnahmecode 0xc0000005, Fehleroffset 0x0000439a, Prozess-ID 0x770, Anwendungsstartzeit 01cba9ff639aa459. Error - 02.01.2011 06:28:17 | Computer Name = Gross-PC | Source = WinMgmt | ID = 10 Description = Error - 02.01.2011 07:13:09 | Computer Name = Gross-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung GPhotos.scr, Version 3.6.105.67, Zeitstempel 0x4c071660, fehlerhaftes Modul mscms.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03790, Ausnahmecode 0xc0000005, Fehleroffset 0x00003d16, Prozess-ID 0x134, Anwendungsstartzeit 01cbaa6df866f281. Error - 02.01.2011 07:22:33 | Computer Name = Gross-PC | Source = Application Hang | ID = 1002 Description = Programm iexplore.exe, Version 7.0.6002.18005 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen. Prozess-ID: 1194 Anfangszeit: 01cbaa6bbe18deb1 Zeitpunkt der Beendigung: 63 [ OSession Events ] Error - 01.12.2009 15:59:47 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3 seconds with 0 seconds of active time. This session ended with a crash. Error - 29.03.2010 12:09:37 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 11 seconds with 0 seconds of active time. This session ended with a crash. Error - 03.04.2010 04:06:12 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 8 seconds with 0 seconds of active time. This session ended with a crash. Error - 05.05.2010 16:25:25 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 906 seconds with 0 seconds of active time. This session ended with a crash. Error - 06.07.2010 16:38:25 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 58 seconds with 0 seconds of active time. This session ended with a crash. Error - 23.07.2010 16:40:51 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 35 seconds with 0 seconds of active time. This session ended with a crash. Error - 23.07.2010 16:41:03 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time. This session ended with a crash. Error - 23.07.2010 16:41:11 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time. This session ended with a crash. Error - 26.07.2010 05:41:42 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 21 seconds with 0 seconds of active time. This session ended with a crash. Error - 26.07.2010 15:47:17 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 17 seconds with 0 seconds of active time. This session ended with a crash. [ System Events ] Error - 01.01.2011 20:20:26 | Computer Name = Gross-PC | Source = iaStor | ID = 262153 Description = Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet. Error - 01.01.2011 20:26:26 | Computer Name = Gross-PC | Source = iaStor | ID = 262153 Description = Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet. Error - 01.01.2011 20:32:26 | Computer Name = Gross-PC | Source = iaStor | ID = 262153 Description = Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet. Error - 01.01.2011 20:32:33 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7031 Description = Error - 01.01.2011 20:32:39 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7031 Description = Error - 02.01.2011 06:27:22 | Computer Name = Gross-PC | Source = Microsoft-Windows-TaskScheduler | ID = 412 Description = Error - 02.01.2011 06:28:18 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000 Description = Error - 02.01.2011 06:28:18 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000 Description = Error - 02.01.2011 06:33:23 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7022 Description = Error - 02.01.2011 06:59:01 | Computer Name = Gross-PC | Source = DCOM | ID = 10010 Description = Ich hoffe ihr könnt damit was anfangen... Ich habe kein Plan davon ;) Grüße Dagro |
bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 19:52 Uhr. |
Copyright ©2000-2025, Trojaner-Board