| |
| |||||||
Log-Analyse und Auswertung: GVU 2.07 mit otl und malewarebytes logsWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
13.07.2012, 20:27
| #1 |
| |  GVU 2.07 mit otl und malewarebytes logs Hallo Forum, leider hat mich jetzt auch ein Trojaner erwischt. Durch googlen habe ich herausgefunden, dass es wohl der Polizeitrojaner 2.07 ist... mit der webcam. Wenn ich den Wlan-Stick herausziehe funktioniert alles soweit bis auf der Taskmanager. Wenn ich aber eine Internetverbindung aufbaue kommt das Sperrfenster. Habe schon Malwarebytes drüber laufen lassen, leider kein Erfolg. Ich poste einfach mal die Logs in der Hoffnung, dass ihr mir helfen könnt. viele Grüße! Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.03.05 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 Matthias :: MATTHIAS-ZIMMER [Administrator] Schutz: Aktiviert 13.07.2012 18:19:56 mbam-log-2012-07-13 (18-19-56).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 559888 Laufzeit: 1 Stunde(n), 17 Minute(n), 12 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 8 HKCR\CLSID\{C689C99E-3A8C-4c87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{EFF39A40-C163-4d5d-B073-52FBB55C646A} (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EFF39A40-C163-4D5D-B073-52FBB55C646A} (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\8DDYX0ZBPZ (Trojan.FakeAlert.SA) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\ZU6RKI1ONY (Trojan.FakeAlert.SA) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|8DDYX0ZBPZ (Trojan.FakeAlert.SA) -> Daten: C:\Users\Matthias\AppData\Local\Temp\Nq1.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Userinit (Trojan.Agent) -> Daten: C:\Users\Matthias\AppData\Roaming\appconf32.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job (Trojan.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job (Trojan.FraudPack) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter OTL logfile created on: 13.07.2012 21:00:16 - Run 2 OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Matthias\Desktop 64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,55 Gb Available Physical Memory | 63,85% Memory free 8,00 Gb Paging File | 6,39 Gb Available in Paging File | 79,90% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,66 Gb Total Space | 336,49 Gb Free Space | 72,26% Space Free | Partition Type: NTFS Computer Name: MATTHIAS-ZIMMER | User Name: Matthias | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Matthias\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Users\Matthias\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd) PRC - C:\Users\Matthias\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe () PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\Hama\Common\RaUI.exe (Hama GmbH & Co KG) PRC - C:\Program Files (x86)\UGS\UGSLicensing\ugslmd.exe () PRC - C:\Program Files (x86)\UGS\UGSLicensing\lmgrd.exe (Macrovision Corporation) ========== Modules (No Company Name) ========== MOD - C:\Users\Matthias\AppData\Local\Temp\glom0_og.exe () MOD - C:\Users\Matthias\AppData\Roaming\Spotify\Data\libcef.dll () MOD - C:\Users\Matthias\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\199683f6e79076b634ee6cc0a82c0654\PresentationFramework.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e7dc084827f8df2dbdc819db5c633a0d\PresentationCore.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\3971e166cf827b6726e142f344061dc9\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\21f37f9f5162af7efb52169012bd111e\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\8c40f40ef36622109793788049fbe9ab\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\0c2b0d52156447592f33edf4116b7e7d\System.Management.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\65f0d70169a0e73b45307dddbd86f92b\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d234eceae699d070b5a5712ce776c01f\System.Xaml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a5fa2a1cfc6e9fdc39d9a8f2baa57bc9\PresentationFramework.Aero.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll () MOD - C:\Users\Matthias\AppData\Local\Temp\ae201572-4813-4010-9ed2-ee29ddec066a\CliSecureRT.dll () MOD - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll () ========== Win32 Services (SafeList) ========== SRV:64bit: - (FLEXnet Licensing Service 64) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Acresso Software Inc.) SRV:64bit: - (CoordinatorServiceHost) -- C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe (Dassault Systèmes SolidWorks Corp.) SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV:64bit: - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (SolidWorks Licensing Service) -- C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe (SolidWorks) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (OpenVPNService) -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe () SRV - (getPlusHelper) @C:\Program Files (x86) -- C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (UGS License Server (ugslmd)) UGS License Server (ugslmd) -- C:\Program Files (x86)\UGS\UGSLicensing\lmgrd.exe (Macrovision Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (tbhsd) -- C:\Windows\SysNative\drivers\tbhsd.sys (RapidSolution Software AG) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation) DRV:64bit: - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation) DRV:64bit: - (ssadmdfl) SAMSUNG Android USB Modem (Filter) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys () DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys () DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (msloop) -- C:\Windows\SysNative\drivers\loop.sys (Microsoft Corporation) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation ) DRV:64bit: - (netr7364) -- C:\Windows\SysNative\drivers\netr7364.sys (Ralink Technology, Corp.) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG) DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D7 96 47 B7 51 60 CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.update: false FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1 FF - prefs.js..extensions.enabledItems: 6 FF - prefs.js..extensions.enabledItems: 2 FF - prefs.js..extensions.enabledItems: 48 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004 FF - prefs.js..extensions.enabledItems: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.4\extensions\\Components: C:\Program Files\components [2012.07.13 20:48:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.4\extensions\\Plugins: C:\Program Files\plugins [2010.04.17 15:02:44 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Matthias\AppData\Roaming\5064 [2011.12.24 16:16:53 | 000,000,000 | ---D | M] [2009.10.30 21:17:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Matthias\AppData\Roaming\mozilla\Extensions [2012.07.11 12:20:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Matthias\AppData\Roaming\mozilla\Firefox\Profiles\yewuhnjg.default\extensions [2009.10.30 21:43:24 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\Matthias\AppData\Roaming\mozilla\Firefox\Profiles\yewuhnjg.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7} [2009.11.15 17:19:00 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\Matthias\AppData\Roaming\mozilla\Firefox\Profiles\yewuhnjg.default\extensions\moveplayer@movenetworks.com [2009.11.02 20:57:53 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\EXTENSIONS\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [2009.12.04 16:21:14 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [2010.04.03 14:21:28 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} [2010.04.17 15:02:45 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.10.27 17:08:21 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.12.24 16:16:53 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\MATTHIAS\APPDATA\ROAMING\5064 O1 HOSTS File: ([2012.04.01 15:27:22 | 000,000,903 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 10.254.254.253 AFS O1 - Hosts: 127.0.0.1 userstats.audials.com O1 - Hosts: 127.0.0.1 shop.audials.com O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung) O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () O4 - HKCU..\Run: [Spotify] C:\Users\Matthias\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Matthias\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe () O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) O4 - Startup: C:\Users\Matthias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{60410B98-FF84-475C-B5D0-34CBB76DC034}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A1E01D94-4A4F-4084-927B-A6995E7749A0}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AB402BA4-F8B2-4F58-B132-CB46E33085DF}: DhcpNameServer = 131.234.137.24 131.234.137.23 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FAFD6418-4A15-4C0C-A987-37510685A674}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - Winlogon\Notify\AfsLogon: DllName - (C:\Program Files (x86)\OpenAFS\Client\Program\afslogon.dll) - File not found O20 - Winlogon\Notify\MIT_KFW: DllName - (C:\Windows\SysWOW64\kfwlogon.dll) - C:\Windows\SysWOW64\kfwlogon.dll (Massachusetts Institute of Technology.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{c1d5d4e8-f08e-11de-95ee-c327d06c57a3}\Shell - "" = AutoRun O33 - MountPoints2\{c1d5d4e8-f08e-11de-95ee-c327d06c57a3}\Shell\AutoRun\command - "" = E:\setup.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.13 20:49:29 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Matthias\Desktop\OTL.exe [2012.07.13 18:14:02 | 000,000,000 | ---D | C] -- C:\Users\Matthias\AppData\Roaming\Malwarebytes [2012.07.13 18:13:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.07.13 18:13:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.07.13 18:13:53 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.07.13 18:13:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.07.13 18:12:34 | 010,063,000 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Matthias\Desktop\malwarebytes_antimalware_1.61.exe [2012.07.12 14:50:49 | 000,000,000 | ---D | C] -- C:\Users\Matthias\AppData\Roaming\UAs [2012.07.11 19:52:28 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.07.11 19:52:28 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.07.11 19:52:27 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.07.11 19:52:27 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.07.11 19:52:26 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.07.11 19:52:26 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.07.11 19:52:26 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.07.11 19:52:26 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.07.11 19:52:25 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.07.11 19:52:25 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.07.11 19:52:25 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.07.11 19:52:25 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.07.11 19:52:25 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.07.11 12:14:27 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll [2012.06.21 10:19:21 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll [2012.06.21 10:19:21 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe [2012.06.21 10:19:21 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll [2012.06.21 10:19:17 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll [2012.06.21 10:19:17 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll [2012.06.21 10:19:17 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll [2012.06.21 10:19:13 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll [2012.06.21 10:19:13 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe [2012.06.20 14:39:03 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll [2012.06.20 14:39:03 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll [2012.06.20 14:39:03 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe [2012.06.20 14:39:01 | 005,505,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2012.06.20 14:39:00 | 003,958,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2012.06.20 14:39:00 | 003,902,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2012.06.20 14:38:51 | 001,460,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2012.06.20 14:38:51 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2012.06.20 14:38:46 | 003,213,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll [2009.10.30 21:17:30 | 010,795,000 | ---- | C] (Mozilla Foundation) -- C:\Program Files\xul.dll [2009.10.30 21:17:30 | 000,919,544 | ---- | C] (Netscape Communications Corporation) -- C:\Program Files\js3250.dll [2009.10.30 21:17:30 | 000,908,280 | ---- | C] (Mozilla Corporation) -- C:\Program Files\firefox.exe [2009.10.30 21:17:30 | 000,722,424 | ---- | C] (Mozilla Foundation) -- C:\Program Files\mozcrt19.dll [2009.10.30 21:17:30 | 000,636,408 | ---- | C] (Mozilla Foundation) -- C:\Program Files\nss3.dll [2009.10.30 21:17:30 | 000,457,720 | ---- | C] (sqlite.org) -- C:\Program Files\sqlite3.dll [2009.10.30 21:17:30 | 000,316,920 | ---- | C] (Mozilla Foundation) -- C:\Program Files\nssckbi.dll [2009.10.30 21:17:30 | 000,249,856 | ---- | C] (Mozilla Foundation) -- C:\Program Files\freebl3.dll [2009.10.30 21:17:30 | 000,244,728 | ---- | C] (Mozilla Foundation) -- C:\Program Files\updater.exe [2009.10.30 21:17:30 | 000,169,464 | ---- | C] (Mozilla Foundation) -- C:\Program Files\nspr4.dll [2009.10.30 21:17:30 | 000,155,648 | ---- | C] (Mozilla Foundation) -- C:\Program Files\softokn3.dll [2009.10.30 21:17:30 | 000,136,696 | ---- | C] (Mozilla Foundation) -- C:\Program Files\ssl3.dll [2009.10.30 21:17:30 | 000,120,312 | ---- | C] (Mozilla Foundation) -- C:\Program Files\crashreporter.exe [2009.10.30 21:17:30 | 000,103,928 | ---- | C] (Mozilla Foundation) -- C:\Program Files\smime3.dll [2009.10.30 21:17:30 | 000,098,304 | ---- | C] (Mozilla Foundation) -- C:\Program Files\nssdbm3.dll [2009.10.30 21:17:30 | 000,087,544 | ---- | C] (Mozilla Foundation) -- C:\Program Files\nssutil3.dll [2009.10.30 21:17:30 | 000,020,472 | ---- | C] (Mozilla Foundation) -- C:\Program Files\plc4.dll [2009.10.30 21:17:30 | 000,017,912 | ---- | C] (Mozilla Foundation) -- C:\Program Files\xpcom.dll [2009.10.30 21:17:30 | 000,017,912 | ---- | C] (Mozilla Foundation) -- C:\Program Files\AccessibleMarshal.dll [2009.10.30 21:17:30 | 000,017,400 | ---- | C] (Mozilla Foundation) -- C:\Program Files\plds4.dll [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\Matthias\AppData\Roaming\*.tmp files -> C:\Users\Matthias\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.13 20:50:42 | 000,001,274 | ---- | M] () -- C:\Program Files\active-update.xml [2012.07.13 20:50:42 | 000,000,057 | ---- | M] () -- C:\Program Files\updates.xml [2012.07.13 20:49:31 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Matthias\Desktop\OTL.exe [2012.07.13 20:48:19 | 000,000,000 | ---- | M] () -- C:\Windows\nsreg.dat [2012.07.13 20:23:26 | 004,503,728 | ---- | M] () -- C:\ProgramData\go_0molg.pad [2012.07.13 20:19:20 | 000,013,440 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.13 20:19:20 | 000,013,440 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.13 20:11:50 | 000,000,314 | -HS- | M] () -- C:\Windows\tasks\FJCKGB.job [2012.07.13 20:11:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.13 20:11:42 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys [2012.07.13 19:18:34 | 000,000,204 | ---- | M] () -- C:\Windows\SysWow64\t6k0sx3.dll [2012.07.13 19:18:34 | 000,000,100 | ---- | M] () -- C:\Windows\SysWow64\prsgrc.dll [2012.07.13 18:15:50 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.13 18:10:58 | 010,063,000 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Matthias\Desktop\malwarebytes_antimalware_1.61.exe [2012.07.13 14:20:07 | 000,000,337 | ---- | M] () -- C:\Users\Matthias\AppData\Local\Perfmon.PerfmonCfg [2012.07.12 19:13:42 | 000,001,891 | ---- | M] () -- C:\Users\Matthias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.07.12 14:28:43 | 000,326,160 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.06.21 13:40:04 | 001,422,860 | ---- | M] () -- C:\Users\Matthias\Documents\Latex Anleitung.pdf [2012.06.21 13:04:24 | 000,000,584 | ---- | M] () -- C:\Users\Matthias\Documents\grstyles.stl [2012.06.20 19:26:38 | 001,519,798 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.06.20 19:26:38 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.06.20 19:26:38 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.06.20 19:26:38 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.06.20 19:26:38 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\Matthias\AppData\Roaming\*.tmp files -> C:\Users\Matthias\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.13 20:50:42 | 000,001,274 | ---- | C] () -- C:\Program Files\active-update.xml [2012.07.13 20:50:42 | 000,000,057 | ---- | C] () -- C:\Program Files\updates.xml [2012.07.13 20:48:19 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2012.07.13 18:13:54 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.12 19:13:42 | 004,503,728 | ---- | C] () -- C:\ProgramData\go_0molg.pad [2012.07.12 19:13:42 | 000,001,891 | ---- | C] () -- C:\Users\Matthias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.06.21 13:40:04 | 001,422,860 | ---- | C] () -- C:\Users\Matthias\Documents\Latex Anleitung.pdf [2012.06.02 16:59:18 | 000,000,889 | ---- | C] () -- C:\Users\Matthias\.recently-used.xbel [2012.05.22 12:42:49 | 000,000,337 | ---- | C] () -- C:\Users\Matthias\AppData\Local\Perfmon.PerfmonCfg [2011.12.12 17:07:38 | 000,000,018 | ---- | C] () -- C:\Users\Matthias\AppData\Roaming\urhtps.dat [2011.12.07 23:39:16 | 000,000,036 | ---- | C] () -- C:\Users\Matthias\AppData\Roaming\blckdom.res [2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2011.05.25 19:43:58 | 000,000,008 | ---- | C] () -- C:\Windows\SysWow64\mcni.ini [2010.06.08 22:40:29 | 000,000,000 | ---- | C] () -- C:\Users\Matthias\AppData\Local\Temptable.xml [2009.10.30 21:17:31 | 000,000,701 | ---- | C] () -- C:\Program Files\updater.ini [2009.10.30 21:17:31 | 000,000,220 | ---- | C] () -- C:\Program Files\browserconfig.properties [2009.10.30 21:17:31 | 000,000,106 | ---- | C] () -- C:\Program Files\old-homepage-default.properties [2009.10.30 21:17:31 | 000,000,003 | ---- | C] () -- C:\Program Files\update.locale [2009.10.30 21:17:30 | 000,031,393 | ---- | C] () -- C:\Program Files\LICENSE [2009.10.30 21:17:30 | 000,004,296 | ---- | C] () -- C:\Program Files\crashreporter.ini [2009.10.30 21:17:30 | 000,002,126 | ---- | C] () -- C:\Program Files\application.ini [2009.10.30 21:17:30 | 000,002,067 | ---- | C] () -- C:\Program Files\blocklist.xml [2009.10.30 21:17:30 | 000,000,705 | ---- | C] () -- C:\Program Files\crashreporter-override.ini [2009.10.30 21:17:30 | 000,000,478 | ---- | C] () -- C:\Program Files\softokn3.chk [2009.10.30 21:17:30 | 000,000,478 | ---- | C] () -- C:\Program Files\nssdbm3.chk [2009.10.30 21:17:30 | 000,000,478 | ---- | C] () -- C:\Program Files\freebl3.chk [2009.10.30 21:17:30 | 000,000,141 | ---- | C] () -- C:\Program Files\platform.ini [2009.10.30 18:45:13 | 000,000,848 | ---- | C] () -- C:\Users\Matthias\AppData\Local\RT73_{350F657D-192B-49FC-AF73-04EE88A07D89}_prof [2009.10.30 17:31:12 | 000,000,832 | ---- | C] () -- C:\Users\Matthias\AppData\Local\RT73_{60410B98-FF84-475C-B5D0-34CBB76DC034}_sta [2009.10.30 17:31:03 | 000,000,835 | ---- | C] () -- C:\Users\Matthias\AppData\Local\RT73_{60410B98-FF84-475C-B5D0-34CBB76DC034}_prof ========== LOP Check ========== [2011.12.07 23:39:29 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\5053 [2011.12.12 16:43:03 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\5056 [2011.12.20 17:22:41 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\5062 [2011.12.24 16:16:53 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\5064 [2012.06.07 14:58:13 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Advanced Chemistry Development [2012.04.01 13:37:59 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Audacity [2010.05.30 18:53:36 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\DassaultSystemes [2010.06.10 13:05:50 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\EDrawings [2011.05.25 19:44:01 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\FileMaker [2012.06.02 17:00:16 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\gtk-2.0 [2011.12.24 16:42:52 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\ICQ [2009.12.24 16:29:18 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\ImgBurn [2011.12.07 23:39:08 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\kock [2011.05.25 19:44:03 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\net.dacons.menucontrol [2011.04.12 17:16:06 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\OpenOffice.org [2011.10.24 18:00:08 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Samsung [2011.07.22 18:21:29 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Scilab [2012.07.12 18:07:01 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\SigmaPlot 11.0 [2012.07.13 20:56:04 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Spotify [2012.07.12 19:13:54 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\UAs [2010.12.20 15:37:30 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Ubisoft [2012.07.12 19:13:54 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\xmldm [2012.07.13 20:11:50 | 000,000,314 | -HS- | M] () -- C:\Windows\Tasks\FJCKGB.job [2012.03.28 15:29:11 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 13.07.2012 21:00:16 - Run 2
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Matthias\Desktop
64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,55 Gb Available Physical Memory | 63,85% Memory free
8,00 Gb Paging File | 6,39 Gb Available in Paging File | 79,90% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 336,49 Gb Free Space | 72,26% Space Free | Partition Type: NTFS
Computer Name: MATTHIAS-ZIMMER | User Name: Matthias | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0758E8D5-9D31-4E9D-A5D5-D7ACD051938E}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{0D9694B7-28BF-48D0-85D6-BE23FBEAB6D4}" = lport=138 | protocol=17 | dir=in | app=system |
"{0E52E62D-D595-4C93-A205-16C2F359ABD2}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{12AF3568-FE8B-4098-92AD-78B650AB41C9}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{20CAE17D-8CF9-4AAE-9030-45315900A45A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{237CDF43-C1F4-4AA9-9E26-DF0491D8A3F1}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{29E2CB67-0EFD-4794-8AE0-6F00D1A5F7D9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2C3EE5EC-7282-4827-AB62-0AA0AF0F82D2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2DB4E503-0A28-45C4-B979-5D94B285D584}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{31D89CB8-8FAE-46B1-A1D1-F9B349D7BF7C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{39DBBC75-F332-4CB4-B1B4-C49F95BD7E3C}" = lport=31931 | protocol=6 | dir=in | name=audials localhttpserver 31931 |
"{426B404E-693F-4F34-921D-5414CF2824D2}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{48FE8FE2-8D01-4F70-AE67-365243DC5608}" = lport=139 | protocol=6 | dir=in | app=system |
"{61FB0B03-9428-493C-8812-76B27D763EF0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{62949BCA-2729-44F8-89BE-AA6AC88F6133}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6D236254-D134-4A95-B27F-2E9261DCA938}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{7B8BA513-F430-4680-8EE6-417FB9F816CD}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{7E55EDCB-E243-4F31-A096-D014CCD83F35}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8BB12EAA-BD2F-4FDF-9676-D4BBF5DB8A70}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{A01E6BF8-531C-4637-B34E-C085DE7CE633}" = lport=445 | protocol=6 | dir=in | app=system |
"{A425A1CA-B247-4BDE-8696-66FB9697543D}" = rport=138 | protocol=17 | dir=out | app=system |
"{A45E48DA-0881-4918-B611-F69967C4F767}" = lport=10243 | protocol=6 | dir=in | app=system |
"{AC58BBD7-AE9A-4232-9581-94FD7CE6CCF3}" = rport=139 | protocol=6 | dir=out | app=system |
"{ADB2F17F-FE28-4703-BC48-25BCCC225739}" = lport=7001 | protocol=17 | dir=in | name=afs cachemanager callback (udp) |
"{BFCAD1E4-42B9-4FDD-9B79-FA9B188230EC}" = rport=137 | protocol=17 | dir=out | app=system |
"{C4857720-9CA4-4C6E-88F3-9D5CA2C8E7C1}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C5B8485E-D2F3-4DB6-9E72-444C4B9C1D1C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CAF737C5-9104-4D7D-911E-B1EB8B1D0F50}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DE4A26E9-CD72-4127-8167-2FDA0B4E5316}" = lport=14714 | protocol=6 | dir=in | name=audials localhttpserver 14714 |
"{ECA20B57-12E3-4679-92CA-234394EC44EC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EF53832E-113D-4F61-B479-F7E193884427}" = lport=12972 | protocol=6 | dir=in | name=audials localhttpserver 12972 |
"{F2B6A7DC-2605-4F62-A8C6-3E9E6EAECE21}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F34E1723-A727-4D80-8642-2FEF24FEC6D9}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F39A119E-A5E7-4E26-A528-80C0937523BD}" = lport=137 | protocol=17 | dir=in | app=system |
"{F5584428-94C0-48AB-B081-9EA6CC7D4595}" = rport=445 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04AF6793-F6E7-4DEB-B87F-762F424D0D96}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\89matt\counter-strike\hl.exe |
"{09230840-2EF1-47FA-9C8C-C828065B3834}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{0AAE6C1C-304D-4934-BE62-A92228D428F3}" = protocol=17 | dir=in | app=c:\program files (x86)\wings of prey demo\aces.exe |
"{0B189DF5-72FB-49A1-A480-0DACB83BDA6A}" = protocol=17 | dir=in | app=c:\program files\solidworks corp\solidworks\swscheduler\dtscoordinatorservice.exe |
"{127DF6AD-1715-4E2F-9F8E-6CDA79201B49}" = protocol=17 | dir=in | app=c:\users\matthias\appdata\roaming\spotify\spotify.exe |
"{1A2B43DE-5D58-4FEE-ADFF-AF7F723219C6}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{1A770CEB-D54B-4865-BB24-46CB72F374BD}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\89matt\counter-strike\hl.exe |
"{215C2CA5-FE8B-47D9-A6FE-0BDE0AC4C26F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{27AB5817-2D55-45A6-A202-35CB4C58B5B5}" = protocol=17 | dir=in | app=c:\program files (x86)\activision\call of duty 4 - modern warfare\iw3mp.exe |
"{2C6D11D2-5AC7-44A3-AFA7-53B01D9AF5F1}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{2F7D5B50-60E4-4A91-85D2-EDAC038E126C}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\anno4.exe |
"{311393A7-093E-4BF3-85C8-7F5F56D8B5B6}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{31B4E88B-0DAA-423B-A66B-FE195895C9F5}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"{31E55A4F-62EB-4407-8D5C-972408ED945F}" = protocol=6 | dir=in | app=c:\program files (x86)\wings of prey demo\aces.exe |
"{3956F1CD-9600-40EC-A693-A57D34B5CCFC}" = protocol=6 | dir=in | app=c:\program files (x86)\activision\call of duty 4 - modern warfare\iw3mp.exe |
"{3EA3F6DB-B849-4DAE-8D11-8F19CEA59D48}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{413D5FD8-1B02-4673-8717-5D64DBF96FE2}" = protocol=6 | dir=out | app=system |
"{421E22F2-B552-45B2-9D79-8D31ECAF6D74}" = protocol=6 | dir=in | app=c:\program files\solidworks corp\solidworks\swscheduler\dtscoordinatorservice.exe |
"{45337FCC-95E2-43F8-AEFB-0FD94C947607}" = dir=in | app=c:\program files (x86)\rapidsolution\audials 9\audials.exe |
"{4CBFF602-A522-4560-896F-66B18B53F2BA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{5031ADF8-1FD2-4DB9-A268-A1A40FA64C41}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{54BAD585-6AF4-48F8-A2BB-0401F69B2363}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{57E2FCAF-85DF-4CDE-B5DD-8D1FA2A083B9}" = protocol=6 | dir=in | app=c:\program files (x86)\wings of prey demo\launcher.exe |
"{60847664-B065-4845-910B-EFEC268E2ADF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6676F17F-2759-4A11-A91C-1E5C27722E44}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{67142EAB-77C4-47C8-BEB3-0CE30E2C5C4F}" = protocol=6 | dir=in | app=c:\program files (x86)\codemasters\of dragon rising\ofdr.exe |
"{72EF2663-B4BC-4F33-916A-83526892E350}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{964D39C1-7EC7-4EFA-92DB-EE04F099F7C5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{96BC370C-B40E-45D2-9E36-F9558AA924D2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{9D7BE809-A0CE-48E5-B18D-F045D9AA62CB}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{AB52BD91-A5AF-4C28-AF90-789F4EDCBB2A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B75EB192-C620-4E74-B8EA-841F465D2098}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{B8232377-7BBC-457F-8E39-B80EA249B596}" = protocol=17 | dir=in | app=c:\program files (x86)\wings of prey demo\launcher.exe |
"{D5947055-7D09-45A1-88F7-6D81ED052B34}" = protocol=6 | dir=in | app=c:\users\matthias\appdata\roaming\spotify\spotify.exe |
"{D6B746A1-F8F6-42A3-BD77-68F79DDB81E5}" = protocol=17 | dir=in | app=c:\program files (x86)\codemasters\of dragon rising\ofdr.exe |
"{DBE714A5-CB2B-425C-B8BA-9E6672AE6372}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E32DE36D-2755-4BC1-8A4B-03C5FC37EE36}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{E52C0B76-992A-493E-B5A5-B3C5FB10EAE3}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\anno4.exe |
"{EE9A65E7-45B5-4F1C-A664-73AB7A868F9C}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"{F6161173-D33F-43DD-88EE-46348E01F659}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{F61DAF70-FB6D-4D17-B15C-C73E79B6542A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7FABFEB-24EC-442E-A07D-E18905F475B7}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{FC6AF29F-BF51-4B74-BD98-0DFAE1C25DC0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"TCP Query User{3593C77A-24BA-4C1A-B7C6-9D1CDCB046E3}C:\program files (x86)\jägerprüfungni\jägerprüfung-ni.exe" = protocol=6 | dir=in | app=c:\program files (x86)\jägerprüfungni\jägerprüfung-ni.exe |
"TCP Query User{666B082D-3128-47FC-A59D-70457A98A31F}C:\program files (x86)\ugs\nx 5.0\ugii\ugraf.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ugs\nx 5.0\ugii\ugraf.exe |
"TCP Query User{672114A2-7417-4761-B123-8FB510CFAA28}C:\program files (x86)\usarmy\america's army 3\binaries\aa3game.exe" = protocol=6 | dir=in | app=c:\program files (x86)\usarmy\america's army 3\binaries\aa3game.exe |
"TCP Query User{99FB24C1-B013-4B85-98FA-A3D94A74E4E5}C:\program files (x86)\openafs\client\program\afsd_service.exe" = protocol=6 | dir=in | app=c:\program files (x86)\openafs\client\program\afsd_service.exe |
"TCP Query User{AB648DE0-FA14-445B-A4E8-7F5086A85C67}C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"TCP Query User{AB889EFE-6DA6-46DD-801A-02AB4656E714}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{BD96F628-EF3D-4A8C-836F-42C67196CC13}C:\program files (x86)\jägerprüfungni\jägerprüfung-ni.exe" = protocol=6 | dir=in | app=c:\program files (x86)\jägerprüfungni\jägerprüfung-ni.exe |
"TCP Query User{E35CC3D5-02FE-4938-A5B9-C31331A1034F}C:\program files (x86)\openvpn\bin\openvpn.exe" = protocol=6 | dir=in | app=c:\program files (x86)\openvpn\bin\openvpn.exe |
"TCP Query User{EA718DA1-0BD6-4655-9443-B3980F675A87}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"TCP Query User{FC3E9F98-0EB4-4963-B08D-154D1A18E198}C:\users\matthias\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\matthias\appdata\roaming\spotify\spotify.exe |
"TCP Query User{FFF00828-B769-4A7E-8970-490AD8FD6D51}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{13C3BBBA-B8DC-4AE6-AAB1-F77B53ED74FB}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{15D18FB3-450D-4D71-A8E2-0C97A43200A3}C:\program files (x86)\openafs\client\program\afsd_service.exe" = protocol=17 | dir=in | app=c:\program files (x86)\openafs\client\program\afsd_service.exe |
"UDP Query User{1753533A-DC73-4B66-8AC4-D1E4EDF5FAD8}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{320014A2-3EB1-474F-9B7E-2B3D4E4A252B}C:\users\matthias\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\matthias\appdata\roaming\spotify\spotify.exe |
"UDP Query User{496BBA47-F3F9-490C-808F-B9FB68275EA4}C:\program files (x86)\ugs\nx 5.0\ugii\ugraf.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ugs\nx 5.0\ugii\ugraf.exe |
"UDP Query User{4FA216B4-9956-4E27-8BA6-892BB698E77E}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"UDP Query User{81A81295-0AE9-4E2E-812A-50FF10BB1748}C:\program files (x86)\jägerprüfungni\jägerprüfung-ni.exe" = protocol=17 | dir=in | app=c:\program files (x86)\jägerprüfungni\jägerprüfung-ni.exe |
"UDP Query User{83118686-2CBD-4C56-8A57-6D1F7CE39C02}C:\program files (x86)\openvpn\bin\openvpn.exe" = protocol=17 | dir=in | app=c:\program files (x86)\openvpn\bin\openvpn.exe |
"UDP Query User{C49CD038-8F65-4598-A189-D9AC5B759104}C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"UDP Query User{D279D510-4FA6-4BE5-ADD0-613671F52C2B}C:\program files (x86)\usarmy\america's army 3\binaries\aa3game.exe" = protocol=17 | dir=in | app=c:\program files (x86)\usarmy\america's army 3\binaries\aa3game.exe |
"UDP Query User{DC4F968F-F565-4C68-9AD7-7325BBB8527F}C:\program files (x86)\jägerprüfungni\jägerprüfung-ni.exe" = protocol=17 | dir=in | app=c:\program files (x86)\jägerprüfungni\jägerprüfung-ni.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{542DDF04-9F91-4F36-B2F4-2638B788A4C8}" = Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{E9173A5F-22A6-4152-848E-45851DB99162}" = SolidWorks 2010 x64 Edition SP02.1
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"MatlabR2011a" = MATLAB R2011a
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU" = Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinRAR archiver" = WinRAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A4052AB-BA77-44F7-8EE7-9F9131BFD7A6}" = OF Dragon Rising
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 22
"{289338AE-2213-4509-AED2-450414C1260C}_is1" = ICQ Update Patch 1.9
"{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}" = Hama Wireless LAN Adapter
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4E765B16-84C0-40FD-A33D-D58CC7C75603}" = UGS NX 5.0
"{5ACD451F-AE53-4375-9AF5-3CF0801362DA}" = UGSLicensing
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7108738A-F48C-4FC9-80A1-4B70254270DF}" = Audials
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-00A4-0409-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B1A88375-BAB9-4081-B58F-A137FC6ED2A4}" = SigmaPlot 11.1.0
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{C9F47930-F257-4C6E-B7E8-6BF2B0586B2C}" = Visual Studio 8.0 Retail (Intel) Runtime
"{D481EA96-2313-4A7C-98EE-710D1AF884AC}" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"{DA703982C580418795BF4001AA9D7061}" = DivX Plus Media Foundation Components
"{DB9BF2D3-8B19-413D-AA03-B8AEB724C4AB}" = SolidWorks eDrawings 2010
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E4278936-73B8-4250-AF88-21E26249D5F8}" = REFPROP
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{f045ec64-ed96-11de-bb6e-56f655d89593}}_is1" = "Wings of Prey Demo" (Unistall)
"ACDLabs in C__ACDFREE12_" = ACD/Labs Software in C:\ACDFREE12\
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Audacity_is1" = Audacity 2.0
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"Derive 6 Trial Edition" = Derive 6 Trial Edition
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"ImgBurn" = ImgBurn
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"Jägerprüfung-NI 2.0_is1" = manfrin it Jägerprüfung-NI 2.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft Visual Studio 2005 Tools for Applications - ENU" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"MiKTeX 2.9" = MiKTeX 2.9
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox (3.5.4)" = Mozilla Firefox (3.5.4)
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"OpenAFS" = OpenAFS for Windows
"OpenVPN" = OpenVPN 2.1_rc21
"PhotoStitch" = Canon Utilities PhotoStitch
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"RI-CAD_is1" = RI-CAD Version 2.0.3
"scilab-5.3.3_is1" = scilab-5.3.3
"SolidWorks Installation Manager 20100-40201-1100-100" = SolidWorks 2010 x64 Edition SP02.1
"Steam App 10" = Counter-Strike
"TeXnicCenter_is1" = TeXnicCenter Version 1.0 Stable RC1
"Trophy Hunter 2003 Demo_is1" = Trophy Hunter 2003 Demo - Rocky Mountain Adventures
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 1.0.3
"WinRAR archiver" = WinRAR
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"2a4f70b48f669acd" = AA3Deploy
"Spotify" = Spotify
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 22.05.2012 09:40:41 | Computer Name = Matthias-Zimmer | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 22.05.2012 09:40:42 | Computer Name = Matthias-Zimmer | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 20.06.2012 13:26:10 | Computer Name = Matthias-Zimmer | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 21.06.2012 12:48:20 | Computer Name = Matthias-Zimmer | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: TEXCNTR.EXE, Version: 1.0.0.0, Zeitstempel:
0x493c1915 Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7600.16930, Zeitstempel:
0x4eeaf834 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000c2ea ID des fehlerhaften Prozesses:
0x1388 Startzeit der fehlerhaften Anwendung: 0x01cd4fae8fdb9b21 Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\TeXnicCenter\TEXCNTR.EXE Pfad des fehlerhaften
Moduls: C:\Windows\syswow64\msvcrt.dll Berichtskennung: e800aa02-bbc0-11e1-b8a1-00241dd49069
Error - 21.06.2012 13:00:46 | Computer Name = Matthias-Zimmer | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Spw.exe, Version: 11.1.0.102, Zeitstempel:
0x490b0fa0 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16915, Zeitstempel:
0x4ec49d10 Ausnahmecode: 0xc015000f Fehleroffset: 0x000843f9 ID des fehlerhaften Prozesses:
0x11f8 Startzeit der fehlerhaften Anwendung: 0x01cd4fb29bbd109a Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\SigmaPlot\SPW11\Spw.exe Pfad des fehlerhaften
Moduls: C:\Windows\SysWOW64\ntdll.dll Berichtskennung: a49de474-bbc2-11e1-b8a1-00241dd49069
Error - 11.07.2012 09:43:46 | Computer Name = Matthias-Zimmer | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Spw.exe, Version: 11.1.0.102, Zeitstempel:
0x490b0fa0 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16915, Zeitstempel:
0x4ec49d10 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002e3c6 ID des fehlerhaften Prozesses:
0x12c0 Startzeit der fehlerhaften Anwendung: 0x01cd5f599e645726 Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\SigmaPlot\SPW11\Spw.exe Pfad des fehlerhaften
Moduls: C:\Windows\SysWOW64\ntdll.dll Berichtskennung: 6fa7db77-cb5e-11e1-949e-00241dd49069
Error - 11.07.2012 13:50:26 | Computer Name = Matthias-Zimmer | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Spw.exe, Version: 11.1.0.102, Zeitstempel:
0x490b0fa0 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16915, Zeitstempel:
0x4ec49d10 Ausnahmecode: 0xc015000f Fehleroffset: 0x000843f9 ID des fehlerhaften Prozesses:
0x1320 Startzeit der fehlerhaften Anwendung: 0x01cd5f6b74e7d89d Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\SigmaPlot\SPW11\Spw.exe Pfad des fehlerhaften
Moduls: C:\Windows\SysWOW64\ntdll.dll Berichtskennung: e4fb1355-cb80-11e1-949e-00241dd49069
Error - 11.07.2012 13:50:49 | Computer Name = Matthias-Zimmer | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Spw.exe, Version: 11.1.0.102, Zeitstempel:
0x490b0fa0 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16915, Zeitstempel:
0x4ec49d10 Ausnahmecode: 0xc0150010 Fehleroffset: 0x000845b3 ID des fehlerhaften Prozesses:
0x1320 Startzeit der fehlerhaften Anwendung: 0x01cd5f6b74e7d89d Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\SigmaPlot\SPW11\Spw.exe Pfad des fehlerhaften
Moduls: C:\Windows\SysWOW64\ntdll.dll Berichtskennung: f2b491d7-cb80-11e1-949e-00241dd49069
Error - 12.07.2012 09:46:23 | Computer Name = Matthias-Zimmer | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: soffice.exe, Version: 3.3.9556.500,
Zeitstempel: 0x4d061f05 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000ce7c6 ID des fehlerhaften
Prozesses: 0xda8 Startzeit der fehlerhaften Anwendung: 0x01cd6034b906fd3b Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
Pfad
des fehlerhaften Moduls: unknown Berichtskennung: f79e4614-cc27-11e1-8ced-00241dd49069
Error - 12.07.2012 12:19:40 | Computer Name = Matthias-Zimmer | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 1.9.1.3576,
Zeitstempel: 0x4ad8b0e7 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16915,
Zeitstempel: 0x4ec49d10 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0001fa68 ID des fehlerhaften
Prozesses: 0x1090 Startzeit der fehlerhaften Anwendung: 0x01cd604a223ca369 Pfad der
fehlerhaften Anwendung: C:\Program Files\firefox.exe Pfad des fehlerhaften Moduls:
C:\Windows\SysWOW64\ntdll.dll Berichtskennung: 6175aa85-cc3d-11e1-8ced-00241dd49069
[ System Events ]
Error - 24.03.2012 07:18:48 | Computer Name = Matthias-Zimmer | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
Error - 24.03.2012 07:18:48 | Computer Name = Matthias-Zimmer | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 25.03.2012 04:43:21 | Computer Name = Matthias-Zimmer | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
Error - 25.03.2012 04:43:21 | Computer Name = Matthias-Zimmer | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 27.03.2012 10:56:41 | Computer Name = Matthias-Zimmer | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
Error - 27.03.2012 10:56:41 | Computer Name = Matthias-Zimmer | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 28.03.2012 09:29:05 | Computer Name = Matthias-Zimmer | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
Error - 28.03.2012 09:29:05 | Computer Name = Matthias-Zimmer | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 29.03.2012 03:54:39 | Computer Name = Matthias-Zimmer | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
Error - 29.03.2012 03:54:39 | Computer Name = Matthias-Zimmer | Source = atikmdag | ID = 43029
Description = Display is not active
< End of report >
Geändert von Matthias93 (13.07.2012 um 21:17 Uhr) Grund: Anhänge vergessen |
|
14.07.2012, 10:29
| #2 |
| /// Helfer-Team  | GVU 2.07 mit otl und malewarebytes logs Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
MOD - C:\Users\Matthias\AppData\Local\Temp\glom0_og.exe ()
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.update: false
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [Spotify] C:\Users\Matthias\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Matthias\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{c1d5d4e8-f08e-11de-95ee-c327d06c57a3}\Shell - "" = AutoRun
O33 - MountPoints2\{c1d5d4e8-f08e-11de-95ee-c327d06c57a3}\Shell\AutoRun\command - "" = E:\setup.exe
[2012.07.13 20:23:26 | 004,503,728 | ---- | M] () -- C:\ProgramData\go_0molg.pad
[2012.07.12 19:13:42 | 000,001,891 | ---- | M] () -- C:\Users\Matthias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.12 19:13:42 | 004,503,728 | ---- | C] () -- C:\ProgramData\go_0molg.pad
[2012.07.12 19:13:42 | 000,001,891 | ---- | C] () -- C:\Users\Matthias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.07.13 20:11:50 | 000,000,314 | -HS- | M] () -- C:\Windows\Tasks\FJCKGB.job
:Files
C:\Users\Matthias\AppData\Local\Temp\glom0_og.exe
C:\ProgramData\go_0molg.pad
:Commands
ipconfig /flushdns /c
[emptytemp]
[emptyflash]
[resethosts]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ |
|
14.07.2012, 15:08
| #3 |
| | GVU 2.07 mit otl und malewarebytes logs Hi,
__________________suuuper. Kann jetzt schon mal wieder eine Internetverbindung herstellen   . Task Manager geht auch wieder. Eigentlich alles wie gehabt  , außer einer Fehlermeldung "RunDLL Probleme beim Starten von glom0_og.exe"Hier dann der Code: Code:
ATTFilter All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: false removed from browser.search.update
Prefs.js: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1 removed from extensions.enabledItems
Prefs.js: 6 removed from extensions.enabledItems
Prefs.js: 2 removed from extensions.enabledItems
Prefs.js: 48 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 removed from extensions.enabledItems
Prefs.js: moveplayer@movenetworks.com:1.0.0.071303000004 removed from extensions.enabledItems
Prefs.js: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0 removed from extensions.enabledItems
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\KiesPDLR deleted successfully.
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Spotify deleted successfully.
C:\Users\Matthias\AppData\Roaming\Spotify\Spotify.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Spotify Web Helper deleted successfully.
C:\Users\Matthias\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c1d5d4e8-f08e-11de-95ee-c327d06c57a3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c1d5d4e8-f08e-11de-95ee-c327d06c57a3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c1d5d4e8-f08e-11de-95ee-c327d06c57a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c1d5d4e8-f08e-11de-95ee-c327d06c57a3}\ not found.
File E:\setup.exe not found.
C:\ProgramData\go_0molg.pad moved successfully.
C:\Users\Matthias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
File C:\ProgramData\go_0molg.pad not found.
File C:\Users\Matthias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
C:\Windows\MusiccityDownload.exe moved successfully.
C:\Windows\Tasks\FJCKGB.job moved successfully.
========== FILES ==========
C:\Users\Matthias\AppData\Local\Temp\glom0_og.exe moved successfully.
File\Folder C:\ProgramData\go_0molg.pad not found.
========== COMMANDS ==========
Error: Unable to interpret <ipconfig /flushdns /c> in the current context!
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 55862 bytes
->Temporary Internet Files folder emptied: 33882 bytes
->FireFox cache emptied: 19033391 bytes
->Flash cache emptied: 586 bytes
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Matthias
->Temp folder emptied: 760729080 bytes
->Temporary Internet Files folder emptied: 6192351 bytes
->Java cache emptied: 54617846 bytes
->FireFox cache emptied: 52805725 bytes
->Flash cache emptied: 487 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 435313751 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36030013 bytes
RecycleBin emptied: 6630940907 bytes
Total Files Cleaned = 7.625,00 mb
[EMPTYFLASH]
User: Administrator
->Flash cache emptied: 0 bytes
User: All Users
User: Default
User: Default User
User: Matthias
->Flash cache emptied: 0 bytes
User: Public
Total Flash Files Cleaned = 0,00 mb
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.54.0 log created on 07142012_155934
Files\Folders moved on Reboot...
C:\Users\Matthias\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
PendingFileRenameOperations files...
File C:\Users\Matthias\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
Registry entries deleted on Reboot...
|
|
14.07.2012, 19:50
| #4 |
| /// Helfer-Team | GVU 2.07 mit otl und malewarebytes logs Sehr gut!  1. Schritt Neue Version! Bitte neu runterladen! Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten. danach: Downloade Dir bitte AdwCleaner auf deinen Desktop.
|
|
15.07.2012, 13:12
| #5 |
| | GVU 2.07 mit otl und malewarebytes logs hi, hier die logs: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.15.07 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 Matthias :: MATTHIAS-ZIMMER [Administrator] Schutz: Deaktiviert 15.07.2012 12:58:17 mbam-log-2012-07-15 (12-58-17).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 549064 Laufzeit: 1 Stunde(n), 10 Minute(n), 39 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 1 C:\Program Files\mozjs.dll (Spyware.OnlineGames) -> Löschen bei Neustart. Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Program Files\mozjs.dll (Spyware.OnlineGames) -> Löschen bei Neustart. C:\Users\Matthias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v1.702 - Logfile created 07/15/2012 at 14:10:35
# Updated 13/07/2012 by Xplode
# Operating system : Windows 7 Professional (64 bits)
# User : Matthias - MATTHIAS-ZIMMER
# Running from : C:\Users\Matthias\Desktop\adwcleaner.exe
# Option [Search]
***** [Services] *****
***** [Files / Folders] *****
***** [Registry] *****
***** [Registre - GUID] *****
Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v13.0.1 (de)
Profile name : default
File : C:\Users\Matthias\AppData\Roaming\Mozilla\Firefox\Profiles\yewuhnjg.default\prefs.js
[OK] File is clean.
Profile name : default
File : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\akg7lb1o.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [1362 octets] - [15/07/2012 14:10:35]
########## EOF - C:\AdwCleaner[R1].txt - [1490 octets] ##########
Matthias |
|
15.07.2012, 15:56
| #6 |
| /// Helfer-Team | GVU 2.07 mit otl und malewarebytes logs Sehr gut! Wie laeuft der Rechner?
danach: Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden. ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ --> GVU 2.07 mit otl und malewarebytes logs |
|
15.07.2012, 19:56
| #7 |
| | GVU 2.07 mit otl und malewarebytes logs hi, also ich habe das Gefühl als würde schon noch etwas auf den Rechner zugreifen. Firefox ließ sich zB eben nicht mehr starten und forderte eine Neuinstallation. Avira hatte heute auch schon wieder eine Meldung. Aber hier erstmal die Logs: Code:
ATTFilter # AdwCleaner v1.702 - Logfile created 07/15/2012 at 18:30:52
# Updated 13/07/2012 by Xplode
# Operating system : Windows 7 Professional (64 bits)
# User : Matthias - MATTHIAS-ZIMMER
# Running from : C:\Users\Matthias\Desktop\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
***** [Registry] *****
***** [Registre - GUID] *****
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v13.0.1 (de)
Profile name : default
File : C:\Users\Matthias\AppData\Roaming\Mozilla\Firefox\Profiles\ert3y3q3.default\prefs.js
[OK] File is clean.
Profile name : default
File : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\akg7lb1o.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [1487 octets] - [15/07/2012 14:10:35]
AdwCleaner[S1].txt - [1342 octets] - [15/07/2012 18:30:52]
########## EOF - C:\AdwCleaner[S1].txt - [1470 octets] ##########
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=b4588093455e464a91d2261233a8f312
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-15 06:29:58
# local_time=2012-07-15 08:29:58 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1797 16775165 100 100 72011 117881936 0 0
# compatibility_mode=5893 16776573 100 94 10376 94775900 0 0
# compatibility_mode=8192 67108863 100 0 102 102 0 0
# scanned=333080
# found=0
# cleaned=0
# scan_time=6769
viele Grüße und besten Dank nochmal für Deine Mühe! |
|
15.07.2012, 21:19
| #8 |
| /// Helfer-Team | GVU 2.07 mit otl und malewarebytes logs Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html |
|
17.07.2012, 17:19
| #9 |
| | GVU 2.07 mit otl und malewarebytes logs Hi, sorry für die späte Antwort. Leider lässt sich das Programm nicht installieren. Ich bekomme die Meldung "Für den Betrieb auf Windows 7 oder Windows Server 2008 R2 ist das Service Pack 1 erforderlich". viele Grüße |
|
17.07.2012, 19:35
| #10 |
| /// Helfer-Team | GVU 2.07 mit otl und malewarebytes logs Spiele Alle Updates für Windows ein! Inklusive Service Pack 1! Warum wurden diese nicht sofort bei erscheinen eingespielt? |
|
18.07.2012, 14:52
| #11 |
| | GVU 2.07 mit otl und malewarebytes logs hi, ja, ich weiß auch nicht warum er das nicht hatte. Eigentlich sind die automatischen Updates eingeschaltet und werden auch des öfteren durchgeführt. Hier nun der Bericht von Emsisoft: Code:
ATTFilter Emsisoft Anti-Malware - Version 6.6
Letztes Update: 18.07.2012 13:34:00
Scan Einstellungen:
Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
Archiv Scan: An
ADS Scan: An
Scan Beginn: 18.07.2012 13:58:54
Gescannt 770962
Gefunden 0
Scan Ende: 18.07.2012 14:58:05
Scan Zeit: 0:59:11
|
|
18.07.2012, 16:02
| #12 |
| /// Helfer-Team | GVU 2.07 mit otl und malewarebytes logs Sehr gut! Wie laeuft der Rechner? Deinstalliere: Emsisoft Anti-Malware dann: Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden. ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
|
|
20.07.2012, 18:03
| #13 |
| | GVU 2.07 mit otl und malewarebytes logs Hi, also ich denke, dass wieder alles im Lot ist. Vielen Dank nochmal dafür!!! hier noch das log Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=b4588093455e464a91d2261233a8f312
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-20 03:32:38
# local_time=2012-07-20 05:32:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 100 387 118303699 0 0
# compatibility_mode=5893 16776573 100 94 536 94421842 0 0
# compatibility_mode=8192 67108863 100 0 75 75 0 0
# scanned=337261
# found=0
# cleaned=0
# scan_time=6365
|
|
20.07.2012, 20:01
| #14 |
| /// Helfer-Team | GVU 2.07 mit otl und malewarebytes logs Sehr gut! damit bist Du sauber und entlassen! Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html |
|
| Themen zu GVU 2.07 mit otl und malewarebytes logs |
| autorun, avira, browser, call of duty, defender, device driver, error, firefox, flash player, format, glom0, google, gvu 2.07, helper, heuristiks/extra, heuristiks/shuriken, install.exe, installation, langs, logfile, microsoft office 2003, ntdll.dll, plug-in, realtek, registry, rundll, rundll probleme beim starten von glom0_og.exe, searchscopes, security, server, software, spotify web helper, svchost.exe, temp, trojan.fakealert.sa, trojaner, usb, visual studio, wlan-stick |
Linear-Darstellung
