| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Nach Google Suche umleitung über Rocketnews zu safeseeking.comWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
21.06.2012, 17:54
| #1 |
| |  Nach Google Suche umleitung über Rocketnews zu safeseeking.com Hallo, mein Kumpel hat auf seinem Laptop folgendes Problem. Wenn er in seinem Standard Browser suchen über Google oder allgemein eingibt wird er von der gewünschten Seiten weggeleitet und landet über die Seite von Rocketnews.com auf safeseeking.com. Das Problem betrifft anscheinend einige hier worauf ich gleich den OTL runtergeladen hab um ein Scan zu starten. Hoffe ihr könnt mir mit einem passenen Script helfen. Danke Code:
ATTFilter OTL logfile created on: 21.06.2012 19:07:02 - Run 1 OTL by OldTimer - Version 3.2.50.0 Folder = F:\ Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,94 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 66,47% Memory free 3,87 Gb Paging File | 2,98 Gb Available in Paging File | 76,82% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 141,56 Gb Total Space | 24,40 Gb Free Space | 17,24% Space Free | Partition Type: NTFS Drive D: | 7,39 Gb Total Space | 2,23 Gb Free Space | 30,12% Space Free | Partition Type: NTFS Drive E: | 66,88 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive F: | 1367,19 Gb Total Space | 108,97 Gb Free Space | 7,97% Space Free | Partition Type: NTFS Drive I: | 30,07 Gb Total Space | 24,35 Gb Free Space | 80,95% Space Free | Partition Type: NTFS Computer Name: FLO-PC | User Name: Flo | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - F:\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (TuneUp Software) PRC - C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe (TuneUp Software) PRC - C:\Program Files\T-Mobile\InternetManager_H\bmop.exe (Bytemobile, Inc.) PRC - C:\Program Files\T-Mobile\InternetManager_H\Internet Manager.exe () PRC - C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe () PRC - C:\Program Files\T-Mobile\InternetManager_H\bmsdk.exe () PRC - C:\Program Files\T-Mobile\InternetManager_H\bmctl.exe (Bytemobile, Inc.) PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation) PRC - C:\ProgramData\DatacardService\HWDeviceService.exe () PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.) PRC - C:\Program Files\Canon\IJPLM\ijplmsvc.exe () PRC - C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE () PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG) ========== Modules (No Company Name) ========== MOD - C:\Program Files\T-Mobile\InternetManager_H\SMSUIPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\SmsAppPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\USSDUIPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\StatusBarMgrPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\XFramePlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\sdk.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\SmsSrvPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\XCodec.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\USSDSrvPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\Trace.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\ServiceUIPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\Win7Support.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\rdiff.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\QtGui4.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\QtCore4.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\QtNetwork4.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\NDISAPI.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\MiniFramePlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\PluginContainer.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\NetInfoUIExPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\NetSettingPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\QtXml4.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\Proxy.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\NetConnectPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\NetInfoRecordUIPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\NetInfoSrvPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\MenuMgrPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\NetSrvPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\NDISPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\NetConnectSrvPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\OSDialup.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\OSNDIS.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\OSAdapt.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\NotifyServicePlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\plugins\imageformats\qgif4.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\plugins\imageformats\qico4.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\OSPowerMgr.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\mingwm10.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\DeviceMgrUIPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\DialupUIPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\core.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\DeviceAppPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\DeviceSrvPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\LiveUpdateInterface.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\Common.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\DialUpPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\DataServicePlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\HelpUIPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\LayoutPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\CompressRatePlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\libgcc_s_dw2-1.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\AddrBookPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\AddrBookUIPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\Internet Manager.exe () MOD - C:\Program Files\T-Mobile\InternetManager_H\AddrBookSrvPlugin.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\AtCodec.dll () MOD - C:\Program Files\T-Mobile\InternetManager_H\bmsdk.exe () MOD - C:\Program Files\T-Mobile\InternetManager_H\ATR2SMgr.dll () MOD - C:\Program Files\WinRAR\RarExt.dll () MOD - C:\Program Files\Common Files\Nero\Lib\log4cxx.dll () ========== Win32 Services (SafeList) ========== SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (TuneUp Software) SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (Internet Manager. RunOuc) -- C:\Program Files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe () SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (HWDeviceService.exe) -- C:\ProgramData\DatacardService\HWDeviceService.exe () SRV - (IJPLMSVC) -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe () SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (SMR300) -- C:\Windows\System32\drivers\SMR300.SYS (Symantec Corporation) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (ewusbmbb) -- C:\Windows\System32\drivers\ewusbwwan.sys (Huawei Technologies Co., Ltd.) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (huawei_wwanecm) -- C:\Windows\System32\drivers\ew_juwwanecm.sys (Huawei Technologies Co., Ltd.) DRV - (ew_hwusbdev) -- C:\Windows\System32\drivers\ew_hwusbdev.sys (Huawei Technologies Co., Ltd.) DRV - (huawei_cdcacm) -- C:\Windows\System32\drivers\ew_jucdcacm.sys (Huawei Technologies Co., Ltd.) DRV - (huawei_enumerator) -- C:\Windows\System32\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.) DRV - (huawei_ext_ctrl) -- C:\Windows\System32\drivers\ew_juextctrl.sys (Huawei Technologies Co., Ltd.) DRV - (tcpipBM) -- C:\Windows\System32\drivers\tcpipBM.sys (Bytemobile, Inc.) DRV - (ew_usbenumfilter) -- C:\Windows\System32\drivers\ew_usbenumfilter.sys (Huawei Technologies Co., Ltd.) DRV - (BMLoad) -- C:\Windows\System32\drivers\BMLoad.sys (Bytemobile, Inc.) DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd) DRV - (TuneUpUtilitiesDrv) -- C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys (TuneUp Software) DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH) DRV - (HBtnKey) -- C:\Windows\System32\drivers\CPQBTTN.sys (Hewlett-Packard Company) DRV - (ATSwpWDF) -- C:\Windows\System32\drivers\ATSwpWDF.sys (AuthenTec, Inc.) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation) DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation) DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC) DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC) DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC) DRV - (HpqKbFiltr) -- C:\Windows\System32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation) DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?AF=109958&babsrc=HP_ss&mntrId=706feed6000000000000582c80139263 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 22 D8 49 DE 18 CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=109958&babsrc=SP_ss&mntrId=706feed6000000000000582c80139263 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile\InternetManager_H\OCx32\addon [2012.02.20 12:17:46 | 000,000,000 | ---D | M] [2012.06.21 17:19:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2012.06.19 18:54:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012.04.18 18:38:39 | 000,002,310 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO) O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG) O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{053CF95D-444B-4D97-BCD6-6827006F6E13}: NameServer = 10.74.210.210 10.74.210.211 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0DB34FEC-0DEC-4F5D-B477-8CB0231FE7F1}: NameServer = 10.129.32.1 10.111.81.129 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4FFF8887-91F5-42E3-A7F2-6F278D7DDDE2}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F06EC670-4838-4825-A00E-F173CE4E650F}: NameServer = 10.74.210.210 10.74.210.211 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2005.09.11 17:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ] O32 - AutoRun File - [2010.12.30 21:56:05 | 000,147,808 | R--- | M] () - E:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2009.09.25 12:46:52 | 000,000,045 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{375d1d17-9845-11e1-92f9-001b246b9834}\Shell - "" = AutoRun O33 - MountPoints2\{375d1d17-9845-11e1-92f9-001b246b9834}\Shell\AutoRun\command - "" = I:\AutoRun.exe O33 - MountPoints2\{7c1f39aa-5d9c-11e1-9164-001b246b9834}\Shell - "" = AutoRun O33 - MountPoints2\{7c1f39aa-5d9c-11e1-9164-001b246b9834}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{888e0ec4-5bab-11e1-9c15-001a6bad344a}\Shell - "" = AutoRun O33 - MountPoints2\{888e0ec4-5bab-11e1-9c15-001a6bad344a}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{888e0eea-5bab-11e1-9c15-001a6bad344a}\Shell - "" = AutoRun O33 - MountPoints2\{888e0eea-5bab-11e1-9c15-001a6bad344a}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2010.12.30 21:56:05 | 000,147,808 | R--- | M] () O33 - MountPoints2\{888e0f1c-5bab-11e1-9c15-001b246b9834}\Shell - "" = AutoRun O33 - MountPoints2\{888e0f1c-5bab-11e1-9c15-001b246b9834}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2010.12.30 21:56:05 | 000,147,808 | R--- | M] () O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2010.12.30 21:56:05 | 000,147,808 | R--- | M] () O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.06.21 18:40:39 | 000,083,064 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\SMR300.SYS [2012.06.21 18:40:29 | 000,000,000 | ---D | C] -- C:\Users\Flo\AppData\Local\NPE [2012.06.21 18:40:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton [2012.06.19 18:53:57 | 000,476,936 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\npdeployJava1.dll [2012.06.19 18:53:56 | 000,157,448 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2012.06.19 18:53:56 | 000,149,256 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2012.06.19 18:53:56 | 000,149,256 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2012.06.19 18:53:46 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2012.05.29 21:16:04 | 000,000,000 | ---D | C] -- C:\Users\Flo\AppData\Roaming\ReiseGenial [2012.05.29 21:16:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ReiseGenial [2012.05.29 21:16:04 | 000,000,000 | ---D | C] -- C:\Program Files\ReiseGenial ========== Files - Modified Within 30 Days ========== [2012.06.21 19:07:44 | 000,643,866 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.06.21 19:07:44 | 000,607,190 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.06.21 19:07:44 | 000,126,394 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.06.21 19:07:44 | 000,103,568 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.06.21 19:06:32 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.06.21 19:06:32 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.06.21 19:01:26 | 000,000,300 | ---- | M] () -- C:\Windows\tasks\KOYNZA.job [2012.06.21 19:01:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.06.21 19:01:10 | 1559,433,216 | -HS- | M] () -- C:\hiberfil.sys [2012.06.21 18:41:36 | 013,466,490 | ---- | M] () -- C:\ProgramData\SMRBackup300.dat [2012.06.21 18:40:39 | 000,083,064 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SMR300.SYS [2012.06.21 18:33:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.06.19 18:53:47 | 000,476,936 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\npdeployJava1.dll [2012.06.19 18:53:47 | 000,472,840 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll [2012.06.19 18:53:47 | 000,157,448 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2012.06.19 18:53:47 | 000,149,256 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2012.06.19 18:53:47 | 000,149,256 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2012.06.11 20:01:54 | 000,159,744 | RHS- | M] () -- C:\Windows\System32\spwizengp.dll [2012.06.06 21:17:03 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2012.06.06 21:17:03 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2012.05.29 13:09:54 | 000,031,584 | ---- | M] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe [2012.05.29 13:09:50 | 000,029,024 | ---- | M] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll [2012.05.29 13:09:50 | 000,021,344 | ---- | M] (TuneUp Software) -- C:\Windows\System32\authuitu.dll ========== Files Created - No Company Name ========== [2012.06.21 18:40:57 | 013,466,490 | ---- | C] () -- C:\ProgramData\SMRBackup300.dat [2012.06.11 20:01:54 | 000,159,744 | RHS- | C] () -- C:\Windows\System32\spwizengp.dll [2012.06.11 20:01:54 | 000,000,300 | ---- | C] () -- C:\Windows\tasks\KOYNZA.job [2012.02.14 21:57:30 | 000,001,732 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin < End of report > Code:
ATTFilter OTL Extras logfile created on: 21.06.2012 19:07:02 - Run 1
OTL by OldTimer - Version 3.2.50.0 Folder = F:\
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,94 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 66,47% Memory free
3,87 Gb Paging File | 2,98 Gb Available in Paging File | 76,82% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141,56 Gb Total Space | 24,40 Gb Free Space | 17,24% Space Free | Partition Type: NTFS
Drive D: | 7,39 Gb Total Space | 2,23 Gb Free Space | 30,12% Space Free | Partition Type: NTFS
Drive E: | 66,88 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 1367,19 Gb Total Space | 108,97 Gb Free Space | 7,97% Space Free | Partition Type: NTFS
Drive I: | 30,07 Gb Total Space | 24,35 Gb Free Space | 80,95% Space Free | Partition Type: NTFS
Computer Name: FLO-PC | User Name: Flo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] -- Reg Error: Value error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [open] -- Reg Error: Value error.
htmlfile [opennew] -- Reg Error: Value error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1190BB9B-606D-4EF1-8F21-ABF36DA63F8C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1CCFD6DA-FF8C-417C-BD22-E9ACE5A9D275}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2E5F4BFE-F6F5-41BE-8F72-612EF862ED3D}" = rport=445 | protocol=6 | dir=out | app=system |
"{2F331CEE-929B-4664-97E6-5CC175C52401}" = lport=1900 | protocol=17 | dir=in | name=udp 1900 |
"{33EF73B1-E902-484E-BFA1-2F75CD9C122F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{354289DC-F850-4B7B-A69B-FBED82E21AB6}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{36F8D272-878A-4E7F-80E9-7E6325EF1DD2}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{3DA1A1F0-CB04-4A2D-964D-C359935DD834}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{46C0B3CB-8C52-4BB7-AD63-113AEEFE5ECF}" = lport=139 | protocol=6 | dir=in | app=system |
"{59F254AE-2DB5-43FA-B1D9-8FA7442C00F3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{661E283A-C52A-40F6-8BF2-14D1F44FCF4A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{6BFC2280-972C-4FED-AB7F-4EB57E38ABC9}" = lport=2869 | protocol=6 | dir=in | name=tcp 2869 |
"{6D74C026-4FFD-4419-9B1B-15C63D3C4E2C}" = rport=139 | protocol=6 | dir=out | app=system |
"{6D7C2023-FBC6-4951-ABF1-471DC7F678D9}" = lport=10243 | protocol=6 | dir=in | app=system |
"{97E9BD87-60AB-43DE-A304-3FB9AA171997}" = lport=138 | protocol=17 | dir=in | app=system |
"{AABF92C7-288C-43E9-BA09-2375B9CA101E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{AB6A1B3A-955C-493C-98E5-E7C26C193CCC}" = lport=56787 | protocol=6 | dir=in | name=windows core service |
"{ACB05DDE-92E7-4082-9946-0B700298FF2E}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AD503196-6AD2-488D-B2A8-E143E0161981}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BED63295-B1FD-4CBB-96B2-AAB81118351C}" = lport=445 | protocol=6 | dir=in | app=system |
"{C98589F5-2D27-4F3A-A2C1-0D708AEB1253}" = rport=137 | protocol=17 | dir=out | app=system |
"{CB661BED-BA14-49E9-AEC5-38C9B6C1C05D}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CCD3315D-91F6-4F50-9025-5CD557CC6A82}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{F61BD7F8-33BB-4DE3-846A-FD955DE69DF6}" = rport=138 | protocol=17 | dir=out | app=system |
"{FA6533B1-372B-47E4-8E44-31684AF70BEC}" = lport=137 | protocol=17 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04A699F7-689B-46CD-A4AA-B197DEBADEE4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{06D28004-0B8D-41C0-9556-340C7D0B320C}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{160B4DF5-49A4-46EC-951C-E72E17785B97}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{1675BBEE-67A8-4029-A91D-EF1576A0B975}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{1B060A61-7604-4085-AA85-AAA823D9A744}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1E205403-64DA-44FB-8A13-4742F8302F52}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2B57DD95-2484-4324-94B0-FFF9BF3CD57E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{30A7CD3A-0524-44FA-B261-F37A4F82CC4F}" = protocol=6 | dir=out | app=system |
"{377C2549-5AD9-419E-A218-58CE654D690D}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{3E6E5F45-C09C-4EB9-88AF-402A1B9CDD9C}" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"{47F16B82-1310-49BF-B8B1-3A1BC770FA4C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4E52D376-0035-4535-A07F-2F064819E95F}" = protocol=17 | dir=in | app=c:\windows\system32\xpsrchvw.exe |
"{5005FDE5-7C1A-40B4-BCBD-D3F5F4BC3204}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{502BAC88-A49D-4837-BDC7-3A5EC05621E5}" = protocol=6 | dir=in | app=c:\windows\system32\xpsrchvw.exe |
"{55631FCB-F509-4F5C-BCCF-4ACAC288E6BB}" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"{5EA75D74-3400-461C-8C9E-3973001D2A98}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{866AE4EE-BF60-4BC3-921A-3DD3E1BFC2D2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{9FE0CF8A-BF5D-4065-906A-BE45DAD77B2B}" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"{A4C2278D-B6E1-4302-AAEF-D7D08F0779EF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A75F03B0-2AB1-4160-91CC-DDFCC708E7C0}" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"{B5E8C4F9-A3DB-46AD-84C3-5EAA4706D502}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B80FF2A7-0455-4549-8B93-A84C7CEB79D5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B9BCEFDA-C2DB-44E0-8A1C-34E289768416}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{E0172745-6D73-4019-A875-977634333C51}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E4C46449-C3F8-431A-B6A3-476AD7C2C278}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FF3D0E2B-76D6-4AAC-AF80-5F4147C44C56}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5100_series" = Canon MG5100 series MP Drivers
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
"{8AAB4176-A747-493A-A42C-B63CFADFD8E3}" = NVIDIA PhysX
"{8AEA4BE2-2B52-41C0-BB7D-9F2D17AF1031}" = Nero 8
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F1D7AC58-554A-4A58-B784-B61558B1449A}" = QLBCASL
"{F5CC2EF8-20A4-4366-A681-3FE849E65809}" = RICOH Media Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"BabylonToolbar" = Babylon toolbar on IE
"Canon MG5100 series Benutzerregistrierung" = Canon MG5100 series Benutzerregistrierung
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"DAEMON Tools Lite" = DAEMON Tools Lite
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Internet Manager" = Internet Manager
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"NVIDIA Drivers" = NVIDIA Drivers
"ReiseGenial_is1" = ReiseGenial 3.6.5
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"VLC media player" = VLC media player 1.1.11
"WinRAR archiver" = WinRAR
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 30.05.2012 09:29:29 | Computer Name = Flo-PC | Source = Avira Antivirus | ID = 4110
Description = Während der Initialisierung der Suchengine trat ein unbekannter Fehler
auf! Fehlercode: 0x35
Error - 31.05.2012 14:44:50 | Computer Name = Flo-PC | Source = Avira Antivirus | ID = 4110
Description = Während der Initialisierung der Suchengine trat ein unbekannter Fehler
auf! Fehlercode: 0x35
Error - 04.06.2012 11:08:52 | Computer Name = Flo-PC | Source = Avira Antivirus | ID = 4110
Description = Während der Initialisierung der Suchengine trat ein unbekannter Fehler
auf! Fehlercode: 0x35
Error - 05.06.2012 15:14:46 | Computer Name = Flo-PC | Source = Avira Antivirus | ID = 4110
Description = Während der Initialisierung der Suchengine trat ein unbekannter Fehler
auf! Fehlercode: 0x35
Error - 05.06.2012 15:29:26 | Computer Name = Flo-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 06.06.2012 14:43:38 | Computer Name = Flo-PC | Source = Avira Antivirus | ID = 4110
Description = Während der Initialisierung der Suchengine trat ein unbekannter Fehler
auf! Fehlercode: 0x35
Error - 06.06.2012 15:18:03 | Computer Name = Flo-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 06.06.2012 15:18:03 | Computer Name = Flo-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 11.06.2012 14:18:03 | Computer Name = Flo-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 12.06.2012 14:50:02 | Computer Name = Flo-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
[ System Events ]
Error - 14.06.2012 16:21:38 | Computer Name = Flo-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
Error - 14.06.2012 16:21:53 | Computer Name = Flo-PC | Source = Microsoft-Windows-WHEA-Logger | ID = 18
Description = Schwerwiegender Hardwarefehler. Gemeldet von Komponente: Prozessorkern
Fehlerquelle:
3 Fehlertyp: 256 Prozessor-ID: 1 Die Detailansicht dieses Eintrags beinhaltet weitere
Informationen.
Error - 14.06.2012 16:21:53 | Computer Name = Flo-PC | Source = Microsoft-Windows-WHEA-Logger | ID = 18
Description = Schwerwiegender Hardwarefehler. Gemeldet von Komponente: Prozessorkern
Fehlerquelle:
3 Fehlertyp: 256 Prozessor-ID: 1 Die Detailansicht dieses Eintrags beinhaltet weitere
Informationen.
Error - 19.06.2012 12:01:08 | Computer Name = Flo-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Internet Manager. OUC erreicht.
Error - 19.06.2012 12:01:08 | Computer Name = Flo-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
Error - 19.06.2012 12:01:10 | Computer Name = Flo-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "rimmptsk" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1058
Error - 19.06.2012 12:01:10 | Computer Name = Flo-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "rimsptsk" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1058
Error - 19.06.2012 12:01:10 | Computer Name = Flo-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Ricoh xD-Picture Card Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1058
Error - 19.06.2012 12:01:24 | Computer Name = Flo-PC | Source = Microsoft-Windows-WHEA-Logger | ID = 18
Description = Schwerwiegender Hardwarefehler. Gemeldet von Komponente: Prozessorkern
Fehlerquelle:
3 Fehlertyp: 256 Prozessor-ID: 1 Die Detailansicht dieses Eintrags beinhaltet weitere
Informationen.
Error - 19.06.2012 13:39:34 | Computer Name = Flo-PC | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
Firmware verfügbar ist.
< End of report >
|
| Themen zu Nach Google Suche umleitung über Rocketnews zu safeseeking.com |
| allgemein, babylon toolbar, babylontoolbar, betrifft, browser, canon, folge, folgendes, google, hoffe, install.exe, kumpel, landet, langs, laptop, launch, malware, microsoft office word, plug-in, rocketnews, runtergeladen, scan, schei, script, searchscopes, seite, seiten, standard, starte, starten., suche, t-mobile, taskhost.exe, trojaner, umleitung |
Baum-Darstellung