Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit

GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit


Plagegeister aller Art und deren Bekämpfung: GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 28.07.2012, 19:45   #1
chia
 
GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit - Standard

GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit


Hallo,
ich habe ein Problem beim booten von CD...Beim Sart habe ich F2 gedrückt und komme dann zu BIOS Setup Utility, dann habe ich "Boot" gewählt. Dort kann ich ua "Boot Device Priority" auswählen:
1st Boot Device: [SATA: PM-Hitachi HT]
2st boot Device: [Removable Dev.]
3st Boot Device: [USB: TEAC DV-28E-V]
Normalerweise sollte beim 2st Boot device doch irgendwas mit CD/DVD stehen, oder?
Ist mit Removable Device mein externes Laufwerk gemeint in das ich die OTLPE-CD eingelegt habe? (Ich habe ein Netbook ohne integriertes Laufwerk) Ich bin mir nicht sicher deswegen frage ich lieber nach...

Alt 28.07.2012, 20:42   #2
rajo
/// Helfer-Team
 
GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit - Icon26

GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit


Zitat:
Zitat von chia Beitrag anzeigen
Hallo,

Normalerweise sollte beim 2st Boot device doch irgendwas mit CD/DVD stehen, oder?
Ist mit Removable Device mein externes Laufwerk gemeint in das ich die OTLPE-CD eingelegt habe? (Ich habe ein Netbook ohne integriertes Laufwerk) Ich bin mir nicht sicher deswegen frage ich lieber nach...
dies hier :

[USB: TEAC DV-28E-V]

ist dein CD / DVD external via USB - also die nr 3 ist deine Wahl

So ich nur ganz kurz den Rest macht der gute t john weiter

Rajo
__________________
Alt 28.07.2012, 21:31   #3
chia
 
GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit - Standard

GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit


Danke, Rajo! (Eigentlich logisch das mit dem USB, ich bin zu nervös!)

Der Scan lief ohne Probleme, allerdings wurde ich nicht
Zitat:
Do you wish to load the remote registry?
gefragt und es wurde ken Extra.txt erstellt!

OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 7/28/2012 11:07:58 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 84.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 100.00 Gb Total Space | 47.72 Gb Free Space | 47.72% Space Free | Partition Type: NTFS
Drive D: | 122.87 Gb Total Space | 122.78 Gb Free Space | 99.93% Space Free | Partition Type: NTFS
Drive E: | 3.72 Gb Total Space | 1.55 Gb Free Space | 41.65% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/06/21 12:02:21 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/05/03 02:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/03/26 11:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/03/26 11:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2011/09/08 11:48:34 | 005,554,552 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Program Files\Tablet\Pen\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2011/09/08 11:48:34 | 000,451,960 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Program Files\Tablet\Pen\Pen_TouchService.exe -- (TouchServicePen)
SRV - [2011/09/02 09:02:16 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/04/01 05:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/03/28 05:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010/03/08 09:47:06 | 005,010,288 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Windows\System32\Wacom_Tablet.exe -- (TabletServiceWacom)
SRV - [2009/10/08 23:45:56 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor8.0)
SRV - [2009/08/18 20:35:56 | 000,219,136 | ---- | M] () [Auto] -- C:\Windows\System32\AsusService.exe -- (AsusService)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (btwrchid)
DRV - File not found [Kernel | On_Demand] --  -- (btwl2cap)
DRV - File not found [Kernel | On_Demand] --  -- (btwavdt)
DRV - File not found [Kernel | On_Demand] --  -- (btwaudio)
DRV - [2012/03/20 14:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011/09/08 11:49:36 | 000,010,752 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV - [2011/02/09 09:03:00 | 000,011,832 | ---- | M] () [Kernel | System] -- C:\Windows\System32\drivers\AsUpIO.sys -- (AsUpIO)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/12/18 07:37:44 | 000,790,408 | ---- | M] (DiBcom SA) [Kernel | On_Demand] -- C:\Windows\System32\drivers\mod7700.sys -- (mod7700)
DRV - [2009/12/18 07:37:44 | 000,020,488 | ---- | M] (DiBcom S.A.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\modrc.sys -- (MODRC)
DRV - [2009/10/05 12:31:50 | 001,221,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/09/21 09:29:22 | 000,014,120 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2009/07/27 03:06:45 | 000,051,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20)
DRV - [2009/07/20 05:29:40 | 000,013,880 | ---- | M] ( ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2009/07/13 19:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2007/02/16 04:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Chiara_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
IE - HKU\Chiara_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com [binary data]
IE - HKU\Chiara_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchnu.com/406
IE - HKU\Chiara_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Chiara_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=394&systemid=406&sr=0&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.10: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.0.0.1: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/21 12:02:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/14 05:30:19 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/21 12:02:27 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/14 05:30:19 | 000,000,000 | ---D | M]
 
[2012/07/03 15:58:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chiara\AppData\Roaming\Mozilla\Extensions
[2012/07/19 16:26:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions
[2012/07/03 15:58:34 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2012/06/14 12:05:48 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\foxmarks@kei.com
[2012/07/19 16:26:07 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\extensions\plugin@yontoo.com
[2012/07/03 15:58:07 | 000,002,519 | ---- | M] () -- C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\rfec0it9.default\searchplugins\Search_Results.xml
[2012/07/03 15:58:58 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) -- 
[2012/06/21 12:02:26 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/03/05 17:57:22 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/02/12 11:39:57 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/02/12 11:39:57 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/12 11:39:57 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/02/12 11:39:57 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/07/03 15:58:07 | 000,002,519 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012/02/12 11:39:57 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/02/12 11:39:57 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (CmjBrowserHelperObject Object) - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - C:\Program Files\Mindjet\MindManager 8\Mm8InternetExplorer.dll (Mindjet)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (no name) -  - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\Chiara_ON_C\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [BambooCore] C:\Program Files\Bamboo Dock\BambooCore.exe ()
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Searchqu Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe ()
O4 - HKLM..\Run: [EeeStorageBackup] C:\Program Files\ASUS\Asus WebStorage\BackupService.exe (ECAREME)
O4 - HKLM..\Run: [HotKeyMon] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [HotkeyService] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [LiveUpdate] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [MMReminderService] C:\Program Files\Mindjet\MindManager 8\MmReminderService.exe (Mindjet)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SuperHybridEngine] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [SynAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated)
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk ()
O4 - Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ()
O4 - Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\Chiara_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: An Mindjet MindManager senden - {2F72393D-2472-4F82-B600-ED77F354B7FF} - C:\Program Files\Mindjet\MindManager 8\Mm8InternetExplorer.dll (Mindjet)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll) - C:\Program Files\Searchqu Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll) - C:\Program Files\Searchqu Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/03/24 20:04:12 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{fe8d4e18-6f23-11df-be5c-e0cb4e5d3656}\Shell - "" = AutoRun
O33 - MountPoints2\{fe8d4e18-6f23-11df-be5c-e0cb4e5d3656}\Shell\AutoRun\command - "" = E:\reatogoMenu.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/07/28 07:28:00 | 000,000,000 | ---D | C] -- C:\Users\Chiara\Desktop\Comics
[2012/07/28 07:21:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comical
[2012/07/28 07:21:18 | 000,000,000 | ---D | C] -- C:\Program Files\Comical
[2012/07/23 18:19:48 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/07/23 12:17:07 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{EA892A6D-C537-4AEF-A28A-2B0AE3925DE1}
[2012/07/23 12:16:51 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{FA5A0DBA-B8A8-422D-8201-CCDE62B96053}
[2012/07/22 06:45:22 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{09948269-86A9-4BE6-A839-6150C06A4566}
[2012/07/22 06:44:50 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{A700ABFA-42D7-4060-A5D4-6335077EA494}
[2012/07/21 18:25:25 | 000,000,000 | ---D | C] -- C:\Users\Chiara\Documents\MyPaint
[2012/07/21 17:20:33 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{E039B01A-717A-4FCC-968E-DE94E9E07E36}
[2012/07/21 17:19:56 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{B94B81EF-51BC-4F00-968A-E98C11007111}
[2012/07/21 05:19:15 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{4E110308-6991-4B05-8F0C-4F4A270AB143}
[2012/07/21 05:18:48 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{953C54D2-0F05-4846-99FF-FFE4545A3F08}
[2012/07/20 11:33:07 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{21B0B7D1-CD08-409B-80D0-21232122E606}
[2012/07/20 11:32:39 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{C8176B49-F268-4DC9-AE42-C768ADF94A89}
[2012/07/19 16:28:43 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Roaming\Weaverslave
[2012/07/19 16:27:42 | 000,000,000 | ---D | C] -- C:\Program Files\Weaverslave
[2012/07/19 16:26:27 | 000,000,000 | ---D | C] -- C:\Program Files\v-Grabber
[2012/07/19 16:25:53 | 000,000,000 | ---D | C] -- C:\Program Files\Yontoo
[2012/07/19 16:25:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2012/07/19 11:52:08 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{1708DA77-E2B6-4227-BAC1-EF1D064C1886}
[2012/07/19 11:51:40 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{26DC2D97-2073-42F6-84C9-D802FECC41C3}
[2012/07/19 03:12:17 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{707F5DCD-B5D1-4C35-B10E-328850AD3409}
[2012/07/19 03:11:52 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{7657B687-5A44-496A-B6A5-B4AC4B90EC9B}
[2012/07/18 13:33:58 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{47A4A027-C5C3-4942-9C7C-1075EA9822E3}
[2012/07/18 13:33:35 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{6071C35D-5376-4C50-AA9E-AC54CDA3B4FD}
[2012/07/17 15:04:53 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{FD07347F-040F-43C7-BB90-86C6C7E4A8A3}
[2012/07/17 15:04:29 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{8E8C3F4D-3DB5-4B5C-870D-76F15CBE412C}
[2012/07/16 12:30:59 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{904CE6CC-752F-4061-92E3-8AFC53362FDC}
[2012/07/16 12:30:34 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{33F819DB-35A6-4544-8917-83A113676FAA}
[2012/07/15 06:18:39 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{2B464BFE-E785-4AB8-A72E-09C062444729}
[2012/07/15 06:18:02 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{7DE2F303-2D18-44E8-9D82-86F0827D66FA}
[2012/07/14 05:40:51 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{8CEDA057-6649-4D40-8784-11D98CDC268B}
[2012/07/14 05:40:29 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{A80CF8E0-A373-4F13-9044-14E57E74C029}
[2012/07/13 12:58:28 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{AE713F93-EB69-4D4D-A3D2-AF8D2E1435DE}
[2012/07/13 12:58:13 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{4F952EB5-FFEF-40F8-BBF5-724E4DA8009F}
[2012/07/12 12:50:40 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{8EDB8DC7-2E1F-45DF-B370-D93476D8CD9F}
[2012/07/12 12:50:11 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{CDA5D384-B676-4668-990B-DE2FFF8F611C}
[2012/07/11 15:08:27 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\win32k.sys
[2012/07/11 12:01:04 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ncrypt.dll
[2012/07/11 12:00:53 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msxml3r.dll
[2012/07/11 12:00:50 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\cdosys.dll
[2012/07/11 11:57:30 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{7B25ED64-B564-4BC6-8460-7D8FF11745B1}
[2012/07/11 11:57:02 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{FD0EC20F-F0A4-46E9-91F4-157BB173F577}
[2012/07/10 12:47:59 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{0AF15AC9-7EB9-444F-B81A-6933B8516754}
[2012/07/10 12:47:21 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{8105FFF6-00E4-4612-BA58-968DDEE9C599}
[2012/07/09 11:47:34 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{FB40A348-1009-469F-8BA7-35869F7A45FC}
[2012/07/09 11:47:10 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{BD957484-CEEB-4B6B-99DB-65D31CCA0EF0}
[2012/07/08 06:30:39 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{1572E635-F3BF-4245-B792-C7659CA42797}
[2012/07/08 06:30:12 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{AECBEE27-0B88-4346-BFA9-607056CC5106}
[2012/07/07 06:02:29 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{1E4F0B33-76DE-4B36-A1F9-81BDDFD09A9F}
[2012/07/07 06:02:05 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{68CCA33D-A5D4-4F37-B9EA-F5977E620057}
[2012/07/06 12:34:15 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{CEB268B4-8E49-4456-AB43-6CA741274BCB}
[2012/07/06 12:33:49 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{FB51D69A-FC90-4467-BA9D-DAD4FAA0D94A}
[2012/07/05 12:44:09 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{A670069A-966E-47AB-8E1F-BDD07F7BDC3F}
[2012/07/05 12:43:46 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{9064BA18-F157-4953-8840-702A6BB38E79}
[2012/07/04 11:52:54 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{26A56922-0428-4B78-A2FE-75B04B1C5728}
[2012/07/04 11:52:21 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{0F53D3E0-DE2B-4B81-A691-C847F6BC97C1}
[2012/07/04 11:49:14 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2012/07/03 16:05:02 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\Ilivid Player
[2012/07/03 15:58:06 | 000,000,000 | ---D | C] -- C:\Program Files\Searchqu Toolbar
[2012/07/03 12:41:16 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{2F099194-7024-4309-A759-28CAB1383576}
[2012/07/03 12:40:13 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{AFDAEFF1-4E3B-4E72-9A85-58A07E737FDC}
[2012/07/02 12:15:32 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{EB4125D6-5930-418D-AF8E-D504A34634C2}
[2012/07/02 12:15:19 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{EFFD27C0-C21C-427C-A27E-45B66F706637}
[2012/07/01 07:12:35 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{DEF88F64-2D7B-456E-9DD3-CECB7E224E99}
[2012/07/01 07:12:10 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{B62B35E9-7776-4503-B598-3FA2A61E13A3}
[2012/06/30 08:19:58 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{22F4C30B-B0F2-4A7F-A7B0-2B98A651FA26}
[2012/06/29 11:54:57 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{394AD5EC-4539-4B47-9421-664CB6BC1452}
[2012/06/29 11:54:32 | 000,000,000 | ---D | C] -- C:\Users\Chiara\AppData\Local\{751A8E76-E0D8-470B-B493-C060A209E3D7}
[2009/10/06 09:08:27 | 000,013,880 | ---- | C] ( ) -- C:\windows\System32\drivers\kbfiltr.sys
[2 C:\Users\Chiara\Desktop\*.tmp files -> C:\Users\Chiara\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/07/28 15:47:28 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/07/28 15:46:02 | 1602,691,072 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/28 14:31:48 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/28 14:31:48 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/28 13:28:22 | 004,503,728 | ---- | M] () -- C:\ProgramData\zak_lo0i7g.pad
[2012/07/28 08:16:44 | 000,001,887 | ---- | M] () -- C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012/07/28 07:21:20 | 000,000,899 | ---- | M] () -- C:\Users\Chiara\Desktop\Comical.lnk
[2012/07/28 07:21:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comical
[2012/07/23 18:15:52 | 000,000,761 | ---- | M] () -- C:\Users\Chiara\AppData\Local\recently-used.xbel
[2012/07/16 14:41:49 | 000,660,716 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012/07/16 14:41:49 | 000,632,888 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/07/16 14:41:49 | 000,135,264 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012/07/16 14:41:49 | 000,112,112 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/07/12 03:09:45 | 000,380,856 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2 C:\Users\Chiara\Desktop\*.tmp files -> C:\Users\Chiara\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/07/28 08:16:44 | 000,001,887 | ---- | C] () -- C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012/07/28 08:16:43 | 004,503,728 | ---- | C] () -- C:\ProgramData\zak_lo0i7g.pad
[2012/07/28 07:21:20 | 000,000,899 | ---- | C] () -- C:\Users\Chiara\Desktop\Comical.lnk
[2012/07/23 18:15:52 | 000,000,761 | ---- | C] () -- C:\Users\Chiara\AppData\Local\recently-used.xbel
[2011/06/21 06:05:39 | 000,252,928 | ---- | C] () -- C:\windows\System32\DShowRdpFilter.dll
[2010/05/11 17:48:42 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/05/11 17:26:35 | 000,006,144 | ---- | C] () -- C:\windows\System32\drivers\ASUSHWIO.SYS
[2009/10/08 20:09:48 | 000,011,832 | ---- | C] () -- C:\windows\System32\drivers\AsUpIO.sys
[2009/10/08 20:09:34 | 000,001,769 | ---- | C] () -- C:\windows\Language_trs.ini
[2009/10/08 19:45:00 | 000,219,136 | ---- | C] () -- C:\windows\System32\AsusService.exe
[2009/10/08 19:45:00 | 000,021,864 | ---- | C] () -- C:\windows\AsAcpiSvrLang.ini
[2009/10/08 19:42:03 | 000,451,072 | ---- | C] () -- C:\windows\System32\ISSRemoveSP.exe
[2009/10/08 19:41:36 | 000,013,931 | ---- | C] () -- C:\windows\System32\RaCoInst.dat
[2009/10/08 19:37:32 | 000,004,692 | ---- | C] () -- C:\windows\System32\drivers\SamSfPa.dat
[2009/10/08 19:37:14 | 000,013,020 | ---- | C] () -- C:\windows\System32\lpgun.ini
[2009/07/26 18:01:28 | 000,660,716 | ---- | C] () -- C:\windows\System32\perfh007.dat
[2009/07/26 18:01:28 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat
[2009/07/26 18:01:28 | 000,135,264 | ---- | C] () -- C:\windows\System32\perfc007.dat
[2009/07/26 18:01:28 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
[2009/07/14 00:33:53 | 000,380,856 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,632,888 | ---- | C] () -- C:\windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- C:\windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,112,112 | ---- | C] () -- C:\windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- C:\windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- C:\windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- C:\windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\windows\System32\BWContextHandler.dll
[2009/07/01 04:10:50 | 000,000,176 | ---- | C] () -- C:\windows\explorer.exe.config
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat
[1999/07/06 20:00:00 | 000,000,006 | RHS- | C] () -- C:\ProgramData\D81EDBF9-D167-4011-B77D-211DF920EB80
 
========== LOP Check ==========
 
[2009/10/08 20:11:59 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Asus WebStorage
[2012/03/24 20:12:07 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Autodesk
[2012/04/29 15:00:18 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\BitZipper
[2012/07/28 13:23:20 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Dropbox
[2010/09/12 16:07:57 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Sony
[2010/05/18 07:38:17 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\SYSTEMAX Software Development
[2011/10/15 05:49:02 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Wacom
[2011/10/15 05:52:35 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2012/07/19 16:28:43 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Weaverslave
[2011/09/20 15:02:51 | 000,000,000 | ---D | M] -- C:\Users\Chiara\AppData\Roaming\Windows Live Writer
[2012/03/24 20:09:17 | 000,000,000 | ---D | M] -- C:\ProgramData\Alias
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/07/04 11:49:14 | 000,000,000 | ---D | M] -- C:\ProgramData\boost_interprocess
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/04/10 10:46:35 | 000,000,000 | ---D | M] -- C:\ProgramData\fOi16635kNgJe16635
[2011/03/08 11:37:00 | 000,000,000 | ---D | M] -- C:\ProgramData\Mindjet
[2009/10/08 19:41:35 | 000,000,000 | ---D | M] -- C:\ProgramData\Ralink Driver
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2010/05/18 07:38:17 | 000,000,000 | ---D | M] -- C:\ProgramData\SYSTEMAX Software Development
[2012/07/19 16:25:38 | 000,000,000 | ---D | M] -- C:\ProgramData\Tarma Installer
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/10/15 05:52:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Wacom
[2010/08/03 09:19:48 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/05/23 04:35:56 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
--- --- ---
__________________
Antwort

Themen zu GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit
ahnung, ausgeschaltet, benutzerkonto, blockiert, entferne, entfernen, heute, konnte, lange, punkt, rechner, sache, sachen, stehe, system, troja, trojaner, vermute, vermutet, versuch, versucht, viren, webcam, win, windows


« Neuer GVU-Trojaner, Ähnlich wie 2.04! | spy.banker.gen5 »


Ähnliche Themen: GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit


  1. GVU-Trojaner mit Webcam hat System blockiert, Vista 32bit
    Plagegeister aller Art und deren Bekämpfung - 08.08.2012 (21)
  2. GVU mit Webcam Virus, Task Manager blockiert usw.
    Log-Analyse und Auswertung - 27.07.2012 (20)
  3. BSI GVU Trojaner mit Webcam - ist mein System wieder sauber?
    Plagegeister aller Art und deren Bekämpfung - 25.07.2012 (13)
  4. GVU-Trojaner 2.07 mit Webcam-Bild sperrt mein System Win 7 64bit
    Log-Analyse und Auswertung - 20.07.2012 (8)
  5. BKA Trojaner System vollständig blockiert
    Log-Analyse und Auswertung - 19.07.2012 (6)
  6. GVU-Trojaner 2.07 mit Webcam-Bild - Ukash 100€ blockiert mein System
    Log-Analyse und Auswertung - 15.07.2012 (14)
  7. BKA Trojaner eingefangen; System blockiert;
    Plagegeister aller Art und deren Bekämpfung - 13.07.2012 (6)
  8. GVU Trojaner mit Webcam (64 bit System, Windows 7)
    Log-Analyse und Auswertung - 06.07.2012 (27)
  9. Bundespolizei Trojaner, das System ist blockiert.
    Plagegeister aller Art und deren Bekämpfung - 28.03.2012 (3)
  10. 50EUR Trojaner blockiert mein System
    Log-Analyse und Auswertung - 19.03.2012 (4)
  11. 50EUR Trojaner blockiert mein System
    Log-Analyse und Auswertung - 19.03.2012 (5)
  12. System blockiert - 100€ Trojaner eingefangen
    Plagegeister aller Art und deren Bekämpfung - 07.03.2012 (8)
  13. System blockiert! Trojaner? 50€ Zahlungsaufforderung!
    Plagegeister aller Art und deren Bekämpfung - 16.02.2012 (16)
  14. Trojaner :/ Windows-System ist blockiert..
    Plagegeister aller Art und deren Bekämpfung - 12.02.2012 (6)
  15. Trojaner Windows System ist blockiert
    Plagegeister aller Art und deren Bekämpfung - 12.02.2012 (3)
  16. Trojaner sbcvvhost_win86 blockiert Windows System
    Plagegeister aller Art und deren Bekämpfung - 23.12.2011 (7)
  17. webcam wird blockiert?!
    Netzwerk und Hardware - 30.06.2006 (5)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit - Hallo, ich habe ein Problem beim booten von CD...Beim Sart habe ich F2 gedrückt und komme dann zu BIOS Setup Utility, dann habe ich "Boot" gewählt. Dort kann ich ua - GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit...
Archiv
Du betrachtest: GVU Trojaner mit webcam, System blockiert, WIN 7 32-bit auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131