| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche SeitenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
07.11.2011, 08:08
| #1 | ||||
| /// Helfer-Team    |  Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche Seiten die Schritte 4. 5. bitte noch ausführen:-> http://www.trojaner-board.de/104822-...tml#post717729 1. deinstalliere: Zitat:
2. Hast Du absichtlich die IP 204.15.149.58 als Proxy eingestellt? Wenn ja, warum? Wenn nein: wenn du keinen Proxyserver lokal installiert hast, nimm die Proxyeinstellungen aus den Interneteinstellungen raus im Internet Explorer: Extras => Internetoptionen => Verbindungen => Lan-Einstellungen Haken bei Proxyserver für LAN verwenden und Proxyserver für lokale Adressen umgehen entfernen. Zitat:
Extras => Einstellungen => Erweitert => Netzwerk => Einstellungen. Dort unter Verbindungs-Einstellungen => Kein Proxy anhaken. Zitat:
Fixen mit OTL
Code:
ATTFilter :OTL
IE - HKCU\..\URLSearchHook: - No CLSID value found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
[2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.03.22 16:17:27 | 000,000,175 | R--- | M] () - E:\autorun.inf -- [ UDF1.50 ]
O32 - AutoRun File - [2008.06.10 17:32:46 | 000,000,049 | -HS- | M] () - Q:\AUTORUN.INF -- [ NTFS ]
O32 - AutoRun File - [2008.06.02 23:46:54 | 000,000,049 | -HS- | M] () - S:\AUTORUN.INF -- [ NTFS ]
O33 - MountPoints2\{2905ca6c-f1a2-11e0-8e76-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{2905ca6c-f1a2-11e0-8e76-806e6f6e6963}\Shell\AutoRun\command - "" = Q:\LenovoQDrive.exe -- [2008.07.21 17:09:40 | 000,262,144 | -HS- | M] (Lenovo Group Limited)
O33 - MountPoints2\{2905ca72-f1a2-11e0-8e76-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{2905ca72-f1a2-11e0-8e76-806e6f6e6963}\Shell\AutoRun\command - "" = E:\setup.exe -- [2010.03.12 13:43:46 | 000,464,248 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{2905ca72-f1a2-11e0-8e76-806e6f6e6963}\Shell\configure\command - "" = E:\setup.exe -- [2010.03.12 13:43:46 | 000,464,248 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{2905ca72-f1a2-11e0-8e76-806e6f6e6963}\Shell\install\command - "" = E:\setup.exe -- [2010.03.12 13:43:46 | 000,464,248 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{37d9ca60-f1a6-11e0-a634-92428d05692e}\Shell - "" = AutoRun
O33 - MountPoints2\{37d9ca60-f1a6-11e0-a634-92428d05692e}\Shell\AutoRun\command - "" = S:\LenovoSDrive.exe -- [2008.07.29 23:37:58 | 000,180,224 | -HS- | M] ()
[2011.11.04 11:57:08 | 000,000,392 | ---- | C] () -- C:\Windows\tasks\At2.job
[2011.10.18 21:05:10 | 000,000,390 | ---- | C] () -- C:\Windows\tasks\At1.job
:Commands
[purity]
[emptytemp]
4. erneut einen Scan mit OTL:
Zitat:
__________________ Warnung!: Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein! Anhang nicht öffnen, in unserem Forum erst nachfragen! Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten! Bitte diese Warnung weitergeben, wo Du nur kannst! Geändert von kira (07.11.2011 um 08:19 Uhr) |
|
07.11.2011, 18:53
| #2 | |
 | Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche Seiten Den letzten Schritt hab ich genau so ausgeführt wie du es beschrieben hast:
__________________Zitat:
Code:
ATTFilter OTL Extras logfile created on: 07.11.2011 18:33:25 - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = c:\Users\Vanessa\Downloads
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19154)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,97 Gb Total Physical Memory | 0,51 Gb Available Physical Memory | 26,04% Memory free
4,16 Gb Paging File | 2,27 Gb Available in Paging File | 54,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 137,82 Gb Total Space | 67,44 Gb Free Space | 48,93% Space Free | Partition Type: NTFS
Drive E: | 1,33 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF1.50
Drive Q: | 9,77 Gb Total Space | 2,54 Gb Free Space | 25,97% Space Free | Partition Type: NTFS
Drive S: | 1,46 Gb Total Space | 0,67 Gb Free Space | 46,00% Space Free | Partition Type: NTFS
Computer Name: VANESSAS-LAPTOP | User Name: Vanessa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09A09E0D-9A15-4CCE-8331-F1DD30AB504C}" = rport=139 | protocol=6 | dir=out | app=system |
"{3F3E98EB-3415-42AD-83BF-32FB7A8B7841}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4675FE0D-B2B6-476F-AF75-5C2B5FBF09CD}" = rport=138 | protocol=17 | dir=out | app=system |
"{6E7EB384-2709-4459-A40F-33848B76A711}" = rport=445 | protocol=6 | dir=out | app=system |
"{70EFD100-29C5-44BB-8B02-DBBE7A83EF25}" = rport=137 | protocol=17 | dir=out | app=system |
"{7E70A9B9-D16E-45D4-9626-B2B835719A9F}" = lport=137 | protocol=17 | dir=in | app=system |
"{92BB5A3D-A0F4-4AE7-B30A-6D795E092F7C}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{A56FD662-5DB3-4DD7-B744-12C36190959A}" = lport=138 | protocol=17 | dir=in | app=system |
"{BEFA3E62-93A0-4495-863E-C5F8F77639B1}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{CE9FA5C3-3865-4227-8EA4-18F0FF7F9ED0}" = lport=445 | protocol=6 | dir=in | app=system |
"{D6ABFE06-D458-48EE-B96C-204657DBC09E}" = lport=139 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0372A025-C6F2-41EC-B918-B8628F78314F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{0B903C40-2C3B-43E6-9DE4-AD17F582E472}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{220DE4D4-4E4D-49D2-9262-BB8866850A9E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{28D6B046-2CA8-455F-95A3-5A21A2B1B0F6}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{2BA277B8-BAA3-4233-9E90-99AA50B16EA3}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{2E60803E-43D5-480E-97B7-317440C1B731}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3707853B-35F1-4FFD-B13F-2F52C48FEF7F}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{3D547D15-8F10-4EB9-850B-A63F43B62BEF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{42866980-A412-4326-811B-FFDFC94A8640}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{479C703E-A3E3-4197-B520-42BF27D2A7FE}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{55A31779-3B7F-422F-8CC6-EE65EEFC2A02}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5D02A2C0-8B85-4DE3-B55C-A85BDFA89957}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe |
"{66C080D6-2E0A-4A17-BB31-EBED362BAA7E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7370A286-18D7-45C6-92AE-0F9B74C097DA}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{73E4C4D7-1DFA-498C-A447-D33183AAA4FF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{74891EB0-AFAD-48F7-8AD3-2354A27C04AD}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{767DADD6-F6BD-4C4C-BC4C-3E0E95F2F457}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{79CFEF6D-3799-45BD-9D98-F0D4158D3DDC}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{7DF52391-44AC-447A-B9D6-87453651C140}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{850F9F08-7D2C-4A63-8191-473E1A0B88E7}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{88D53692-F964-4CF1-9DE9-C44B7AF1CB1D}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe |
"{9C7A5CEF-192C-4A63-B514-67DB5DA93151}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{B651EA50-6BD0-4D7B-8945-B700A83AEEAE}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{D16A3CBD-09D9-436D-A628-3D5BB38F2C46}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{DA745680-61C3-4336-889A-193F0732688F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{DB5ED0A3-2FD8-4188-934C-716E6BFE0BB6}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe |
"{DD069386-7789-40EB-B973-8397FCF05D46}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{EA2E295F-9A92-48F9-8CF8-8DB70AE84CEB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"TCP Query User{11E185BD-BE1A-472C-8D8A-7B70FB34E702}C:\program files\icq7.6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"UDP Query User{B86A65BB-2DA8-4B0D-BF95-9DD4B5EA1202}C:\program files\icq7.6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = ThinkPad Bluetooth with Enhanced Data Rate Software 6.1.0.4500
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{055B9AD2-48E1-462E-9992-814123063C46}" = Lenovo_ATK_Package
"{05860BD6-2B3C-4B16-A300-964403ACF13C}" = ThinkVantage GPS
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = MSN Toolbar
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Central Data
"{098122AB-C605-4853-B441-C0A4EB359B75}" = DirectXInstallService
"{0C7DE40E-7C89-4AFB-B744-846F1B582B71}" = SBITS
"{1007F41F-7D69-468E-8017-3849A5A973C2}" = ThinkVantage Technologies Welcome Message
"{10DDCDDD-9A59-4496-9371-C17F1668D433}" = Windows Live Toolbar
"{1297C681-92D7-40EF-93BF-03F66EC5105C}" = ThinkPad-Dienstprogramm 'EasyEject'
"{17CBC505-D1AE-459D-B445-3D2000A85842}" = Dienstprogramm "ThinkPad UltraNav"
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Central Tools
"{29ED20C9-5E15-4969-9279-25BF3727A3DA}" = iTunes
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Drag-to-Disc
"{2FAAD1C5-2D9D-4EDB-BCD1-FF6573986439}" = Mobile Broadband Connect
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Integrated Camera
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F963A06-7C18-4039-9789-9644B3266AE7}" = Verizon Wireless BroadbandAccess Self Activation
"{44E9D4C2-946C-4378-9354-558803C47A68}" = Client Security - Password Manager
"{461A4763-28B5-425A-AE3D-B9B54EDF0F21}" = CIB pdf brewer
"{46A84694-59EC-48F0-964C-7E76E9F8A2ED}" = ThinkVantage System für aktiven Festplattenschutz
"{4AB5764A-3894-49A2-BAA8-C4665F74CD4C}" = Registry patch to improve USB device detection on resume from sleep for Windows Vista
"{4BD295B9-0190-4C54-B08E-33A6ECA922DF}" = ThinkVantage Access Connections
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{537BF16E-7412-448C-95D8-846E85A1D817}" = Roxio Creator Small Business Edition
"{58E65E96-6649-4CBE-9382-35326D694E6F}" = MSN Toolbar Platform
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.55.01
"{61BEA823-ECAF-49F1-8378-A59B3B8AD247}" = Microsoft Default Manager
"{6280149E-EFF3-4F1B-BD43-5B7EDD6F620A}" = Ergänzung zu Lenovo Care
"{64211D43-D195-413C-A7E7-666C10B53E1F}" = Ericsson Wireless Module Core
"{65706020-7B6F-41F2-8047-FC69579E386A}" = Präsentationsdirektor
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{668ACF05-E455-4932-A2D2-5822A8206FEB}" = Camera Center
"{69333A04-5134-40A5-A055-9166A7AA1EC8}" =
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Central Audio
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{7821C7B2-7E21-4CF3-925B-58B6A8BC6311}" = LibreOffice 3.4
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7E4C16B8-8F76-4940-8505-98E93C00BF19}" = Rescue and Recovery
"{852AFD2D-07CC-46FD-A159-671102782771}" = Intel(R) PROSet/Wireless WiFi-Software
"{8675339C-128C-44DD-83BF-0A5D6ABD8297}" = System Update
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{90FABD40-E741-446F-839D-CEAE905D63BE}" = ThinkPad Mobility Center Customization
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{986F64DC-FF15-449D-998F-EE3BCEC6666A}" = Help Center
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CECB23C-F4BC-4FDA-A306-E544A216176A}" = ThinkVantage Status Gadget
"{9F98C9F8-9B49-411C-AFB9-AF633249FA7C}" = ThinkVantage Fingerprint Software 5.8
"{A00B9A50-3090-4CFF-9CDA-82DA0BEDAA21}" = Apple Mobile Device Support
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B334D9AE-1393-423E-97C0-3BDC3360E692}" = Sonic Icons for Lenovo
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Central Copy
"{C1940CF0-E2DD-11E0-BB25-B8AC6F97B88E}" = Google Earth
"{C6FA39A7-26B1-480A-BC74-6D17531AC222}" = Access Help
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF52099A-3BEA-4C41-AEA8-1E190F04D737}" = Lenovo Care
"{D36B4583-E804-406B-9D56-F97931286C5B}" = 32 Bit HP CIO Components Installer
"{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}" = ThinkPad Energie-Manager
"{DB71210F-8314-4AE3-B7A7-EBAF85BD30E9}" = Wallpapers
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E755160F-E930-11E0-8B86-F04DA23A5C58}" = Vegas Pro 11.0
"{E7E836B8-4BDD-454F-82E6-5FEA17C83AD4}" = Message Center
"{E8A54984-9776-4283-ACE2-782BA850A1C0}" = Roxio Creator Small Business Edition
"{E9627240-E930-11E0-8690-F04DA23A5C58}" = MSVCRT Redists
"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Central Core
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F18DB86D-BC16-4E01-BCCE-63F62B931D82}" = InterVideo Register Manager
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FA62B4C2-6CFD-462F-9B59-68A730001AB3}" = Product Recovery Disc Burning Utility
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"{FE163F11-1919-4257-A280-FF5AF8DAEECB}" = ICQ Sparberater
"414DA9DB2E84AAFAD2D2715FD9BABFAB2D209FFD" = Windows Driver Package - Lenovo 1.44 (05/14/2008 1.44)
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"avast" = avast! Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"Dipmon" = Registry Patch of Enabling Device Initiated Power Management(DIPM) on SATA for Windows Vista
"FPIRPOn" = Registry patch of Changing Timing of IDLE IRP by Finger Print Driver for Windows Vista
"Free Studio_is1" = Free Studio version 5.2.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.11.923
"G'MIC for GIMP_is1" = G'MIC for GIMP Version 1.5.0.4
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ICQToolbar" = ICQ Toolbar
"IrfanView" = IrfanView (remove only)
"Lenovo Registration" = Lenovo Registration
"Lenovo Welcome_is1" = Lenovo Welcome v1.0.24.3
"LENOVO.SMIIF" = Lenovo System Interface Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 7.0.1 (x86 de)" = Mozilla Firefox 7.0.1 (x86 de)
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"OnScreenDisplay" = Anzeige am Bildschirm
"PC-Doctor 5 for Windows" = PC-Doctor 5 für Windows
"PhotoScape" = PhotoScape
"Power Management Driver" = ThinkPad Power Management Driver for SL Series
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = ThinkPad UltraNav Driver
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"USBPMon" = Registry patch for Windows Vista USB S3 PM Enablement
"VLC media player" = VLC media player 1.1.11
"Winamp" = Winamp
"Windows Live Toolbar" = Windows Live Toolbar
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 07.11.2011 11:17:59 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 07.11.2011 11:17:59 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 56448634
Error - 07.11.2011 11:17:59 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 56448634
Error - 07.11.2011 11:18:00 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 07.11.2011 11:18:00 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 56449789
Error - 07.11.2011 11:18:00 | Computer Name = Vanessas-Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 56449789
Error - 07.11.2011 11:21:17 | Computer Name = Vanessas-Laptop | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung AvastSvc.exe, Version 6.0.1289.0, Zeitstempel
0x4e6684a2, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18327, Zeitstempel 0x4cb73436,
Ausnahmecode 0xc0000005, Fehleroffset 0x000665d6, Prozess-ID 0x1e8, Anwendungsstartzeit
01cc9cd7f241cc6a.
Error - 07.11.2011 11:40:09 | Computer Name = Vanessas-Laptop | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Users\Vanessa\Downloads\vegaspro11.0.371_64bit.exe".
Die
abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 07.11.2011 11:51:35 | Computer Name = Vanessas-Laptop | Source = Perflib | ID = 1010
Description =
Error - 07.11.2011 13:21:24 | Computer Name = Vanessas-Laptop | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 13.10.2011 07:11:53 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7026
Description =
Error - 13.10.2011 07:13:48 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description =
Error - 13.10.2011 07:14:21 | Computer Name = Vanessas-Laptop | Source = DCOM | ID = 10010
Description =
Error - 13.10.2011 07:14:22 | Computer Name = Vanessas-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1000
Description =
Error - 13.10.2011 07:14:23 | Computer Name = Vanessas-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
Error - 13.10.2011 07:14:27 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description =
Error - 13.10.2011 07:14:57 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description =
Error - 13.10.2011 07:15:27 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description =
Error - 13.10.2011 07:16:32 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description =
Error - 13.10.2011 07:17:02 | Computer Name = Vanessas-Laptop | Source = Service Control Manager | ID = 7011
Description =
< End of report >
|
|
| Themen zu Weiterleitung von Google-Links auf z.B. "vuwl directory" oder ähnliche Seiten |
| .dll, anti-malware, antivir, appdata, automatisch, backdoor.bot, backdoor.cycbot, dateien, explorer, google, iexplore.exe, lvvm.exe, malware, malware.packer, malwarebytes, microsoft, neue, problem, proxy-server, roaming, seite, seiten, software, systemwiederherstellung, temp, troaner, trojan.agent, trojan.fakealert, vuwl web directory weiterleitung von google suchergebnissen, weiterleitung, winlogon, wpbt0.dll |
.
Hybrid-Darstellung
