Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: File recovery in der Taskleiste + System error message

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 12.08.2012, 21:17   #1
cfmmk
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Surfen im I- net und dann o.g. Fehlermeldung.

Desktop wurde leer, File recovery tat sich auf und "animiert" zum kauf einer Vollversion, Firefox meldet sich ab und dann 20-30 System errors message....

Und ich hatte eben die kompletten Logs hier schon drin und dann sagte mir das Board beim versenden nicht angemeldet.....

Ich habe mir malware aktualisiert und quick und normal durchgeführt:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.12.03

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Papa :: FRANZI-PC [Administrator]

Schutz: Aktiviert

12.08.2012 13:17:03
mbam-log-2012-08-12 (21-54-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 358336
Laufzeit: 53 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 2
C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> 4084 -> Keine Aktion durchgeführt.
C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> 4092 -> Keine Aktion durchgeführt.

Infizierte Speichermodule: 1
C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> Keine Aktion durchgeführt.

Infizierte Registrierungsschlüssel: 5
HKCR\CLSID\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
HKCR\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC} (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
HKCR\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB} (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A8B0DBDE-8119-48B0-8088-D12DA01C36BA} (PUP.DownloadnSave) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 2
C:\ProgramData\DownloadnSave (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
C:\ProgramData\DownloadnSave\data (PUP.DownloadnSave) -> Keine Aktion durchgeführt.

Infizierte Dateien: 16
C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> Keine Aktion durchgeführt.
C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> Keine Aktion durchgeführt.
C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\krevkqcmdubtfvdz8[1].exe (Rogue.FakeHDD) -> Keine Aktion durchgeführt.
C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\Gxv1zF45[1].exe (Exploit.Drop.COD) -> Keine Aktion durchgeführt.
C:\Users\Netzbenutzer\AppData\Local\Temp\wYHCrAaxE5MMYA.exe.tmp (Rogue.FakeHDD) -> Keine Aktion durchgeführt.
C:\Users\Netzbenutzer\AppData\Local\Temp\tmpA8E6.tmp.exe (RootKit.0Access) -> Keine Aktion durchgeführt.
C:\Users\Netzbenutzer\Desktop\Downloads\MB-Scrsaver.zip.exe (Affiliate.Downloader) -> Keine Aktion durchgeführt.
C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W6JK739V\4fdbb519d63b4[1].exe (Adware.Dropper) -> Keine Aktion durchgeführt.
C:\Users\Papa\AppData\Local\Temp\{FFFE3346-117B-503B-B2D0-5959241D11B0}\Addons\download_save.exe (Adware.Dropper) -> Keine Aktion durchgeführt.
C:\Users\Netzbenutzer\AppData\Local\Temp\wuauclt.exe (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\ProgramData\DownloadnSave\content.js (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
C:\ProgramData\DownloadnSave\background.html (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
C:\ProgramData\DownloadnSave\odeoclokhmjimjdcfohekbelankbmihb.crx (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
C:\ProgramData\DownloadnSave\settings.ini (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
C:\ProgramData\DownloadnSave\uninstall.exe (PUP.DownloadnSave) -> Keine Aktion durchgeführt.

(Ende)

Das Lesen im Board hat mich auf unhide.exe gebracht:


Unhide by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Unhide.exe can be found at this link:
hxxp://www.bleepingcomputer.com/forums/topic405109.html

Program started at: 08/12/2012 01:57:33 PM
Windows Version: Windows Vista

Please be patient while your files are made visible again.

Processing the C:\ drive
Finished processing the C:\ drive. 122741 files processed.

Processing the D:\ drive
Finished processing the D:\ drive. 36392 files processed.

Processing the F:\ drive
Finished processing the F:\ drive. 0 files processed.

The C:\Users\Papa\AppData\Local\Temp\smtmp\ folder does not exist!!
Unhide cannot restore your missing shortcuts!!
Please see this topic in order to learn how to restore default
Start Menu shortcuts: hxxp://www.bleepingcomputer.com/forums/topic405109.html

Searching for Windows Registry changes made by FakeHDD rogues.
No registry changes detected.

Restarting Explorer.exe in order to apply changes.

Program finished at: 08/12/2012 02:00:02 PM
Execution time: 0 hours(s), 2 minute(s), and 29 seconds(s)



Abschliessend ist wohl OTL angesagt.

OTL logfile created on: 12.08.2012 21:37:09 - Run 1
OTL by OldTimer - Version 3.2.57.0 Folder = C:\Users\Papa\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 0,98 Gb Available Physical Memory | 49,21% Memory free
4,23 Gb Paging File | 2,60 Gb Available in Paging File | 61,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142,16 Gb Total Space | 6,74 Gb Free Space | 4,74% Space Free | Partition Type: NTFS
Drive D: | 142,93 Gb Total Space | 41,89 Gb Free Space | 29,31% Space Free | Partition Type: NTFS

Computer Name: FRANZI-PC | User Name: Papa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Papa\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\ProgramData\SoIaMjphesp9YP.exe (XNN)
PRC - C:\ProgramData\WQaJpUNUgPHe.exe (XNN)
PRC - d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - d:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
PRC - C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
PRC - C:\Programme\SiteAdvisor\6172\SAService.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
PRC - C:\Programme\Acer\Empowering Technology\SysMonitor.exe ()
PRC - C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
PRC - C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe (CyberLink)
PRC - c:\Programme\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Programme\SiteAdvisor\6172\SiteAdv.exe ()
PRC - C:\Programme\McAfee\MSK\msksrver.exe (McAfee, Inc.)
PRC - c:\Programme\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - c:\Programme\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Programme\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - c:\Programme\McAfee\MSC\mcuimgr.exe (McAfee, Inc.)
PRC - C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)
PRC - C:\Programme\avmwlanstick\WLanGUI.exe (AVM)
PRC - C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)


========== Modules (No Company Name) ==========

MOD - C:\ProgramData\DownloadnSave\bhoclass.dll ()
MOD - C:\Programme\SiteAdvisor\6172\saHook.dll ()
MOD - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ShowErrMsg.dll ()
MOD - C:\Programme\Acer\Empowering Technology\SysMonitor.exe ()
MOD - C:\Programme\NewTech Infosystems\NTI Backup Now 5\BkupTrayLOC.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\45ee94a63c463b93e3ff694c6ecd0820\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a35f567c4c67d6b1ca9a0023852847a2\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\267d4c344058092e6950c11594244f90\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5b3e3b0551bcaa722c27dbb089c431e4\mscorlib.ni.dll ()
MOD - c:\Programme\McAfee\MSK\mcapbho.dll ()
MOD - C:\Programme\SiteAdvisor\6172\SiteAdv.exe ()
MOD - C:\Programme\SiteAdvisor\6172\SiteAdv.dll ()
MOD - c:\Programme\Adobe\Reader 8.0\Reader\RdLang32.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Weblink.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Spelling.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\SendMail.deu ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Search.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\PPKLITE.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\SaveAsRTF.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\ReadOutLoud.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Multimedia.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\makeaccessible.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Escript.deu ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\EWH32.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\DigSig.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Annots.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Checkers.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Acroform.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\accessibility.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\ccme_base.dll ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\cryptocme2.dll ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\updater.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Search5.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\reflow.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\pddom.DEU ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Hls.deu ()
MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\eBook.DEU ()


========== Win32 Services (SafeList) ==========

SRV - (MBAMService) -- d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SiteAdvisor Service) -- C:\Programme\SiteAdvisor\6172\SAService.exe ()
SRV - (eDataSecurity Service) -- C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
SRV - (ETService) -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (Acer HomeMedia Connect Service) -- C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe (CyberLink)
SRV - (McNASvc) -- c:\Programme\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (MSK80Service) -- C:\Programme\McAfee\MSK\msksrver.exe (McAfee, Inc.)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (McProxy) -- c:\Programme\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (mcmscsvc) -- C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McODS) -- C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McSysmon) -- C:\Programme\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (McShield) -- C:\Programme\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (MpfService) -- C:\Programme\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (AVM WLAN Connection Service) -- C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)


========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (USB28xxBGA) -- C:\Windows\System32\drivers\emBDA.sys (eMPIA Technology, Inc.)
DRV - (USB28xxOEM) -- C:\Windows\System32\drivers\emOEM.sys (eMPIA Technology, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (int15) -- C:\Windows\System32\drivers\int15.sys (Acer, Inc.)
DRV - (tvicport) -- C:\Windows\System32\drivers\TVicPort.sys (EnTech Taiwan)
DRV - (zntport) -- C:\Windows\System32\drivers\zntport.sys (Zeal SoftStudio)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (mferkdk) -- C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (mfeavfk) -- C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfehidk) -- C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfesmfk) -- C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) -- C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (MPFP) -- C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: d:\Program Files\Mozilla Firefox\components [2012.07.18 15:48:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: d:\Program Files\Mozilla Firefox\plugins

[2012.08.12 14:03:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Papa\AppData\Roaming\mozilla\Extensions

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Reg Error: Value error.) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Programme\SiteAdvisor\6172\SiteAdv.dll ()
O2 - BHO: (McAfee Phishing Filter) - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\Programme\McAfee\MSK\mcapbho.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)
O2 - BHO: (DownloadnSave Class) - {96DE4F15-8EF3-5425-4360-D37D8DA9371D} - C:\ProgramData\DownloadnSave\bhoclass.dll ()
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Programme\SiteAdvisor\6172\SiteAdv.dll ()
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Programme\Acer\Empowering Technology\SysMonitor.exe ()
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
O4 - HKLM..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot File not found
O4 - HKLM..\Run: [eRecoveryService] File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PCMMediaSharing] C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SiteAdvisor] C:\Programme\SiteAdvisor\6172\SiteAdv.exe ()
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Programme\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Incorporated)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000..\Run: [LicenseValidator] C:\Users\Netzbenutzer\AppData\Roaming\Identities\{ECEB30EE-3DC7-4CB2-88FC-B205C8974BFC}\LicenseValidator.exe File not found
O4 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000..\Run: [SoIaMjphesp9YP] C:\ProgramData\SoIaMjphesp9YP.exe (XNN)
O4 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000..\Run: [WQaJpUNUgPHe.exe] C:\ProgramData\WQaJpUNUgPHe.exe (XNN)
O4 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O7 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O7 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..Trusted Domains: samsungsetup.com ([www] http in Vertrauenswürdige Sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{23354727-1E73-45CF-85FC-7B9D5C176287}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{30FB574D-DD06-485F-AED0-9D174A4816C5}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Programme\SiteAdvisor\6172\SiteAdv.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012.08.12 21:33:35 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Papa\Desktop\OTL.exe
[2012.08.12 21:21:04 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\Adobe
[2012.08.12 21:19:20 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Macromedia
[2012.08.12 21:19:13 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Adobe
[2012.08.12 14:20:59 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\Microsoft Games
[2012.08.12 14:03:15 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Mozilla
[2012.08.12 14:03:15 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\Mozilla
[2012.08.12 14:01:11 | 000,000,000 | R--D | C] -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.08.12 14:01:11 | 000,000,000 | R--D | C] -- C:\Users\Papa\Searches
[2012.08.12 14:01:11 | 000,000,000 | R--D | C] -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.08.12 14:01:02 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Identities
[2012.08.12 14:01:00 | 000,000,000 | R--D | C] -- C:\Users\Papa\Contacts
[2012.08.12 13:09:04 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.08.12 13:09:04 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Malwarebytes
[2012.08.12 13:08:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.12 13:08:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.12 13:08:41 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.12 12:07:08 | 000,255,488 | ---- | C] (XNN) -- C:\ProgramData\SoIaMjphesp9YP.exe
[2012.08.12 11:53:19 | 000,348,672 | ---- | C] (XNN) -- C:\ProgramData\WQaJpUNUgPHe.exe
[2012.07.22 22:50:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmoK DVD Shrinker

========== Files - Modified Within 30 Days ==========

[2012.08.12 21:33:36 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Papa\Desktop\OTL.exe
[2012.08.12 21:18:55 | 000,015,331 | ---- | M] () -- C:\Windows\System32\Config.MPF
[2012.08.12 21:11:24 | 000,618,192 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.08.12 21:11:24 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.08.12 21:11:24 | 000,122,636 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.08.12 21:11:24 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.08.12 21:07:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.12 21:02:11 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.12 21:02:11 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.12 13:09:36 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.08.12 12:48:15 | 000,000,064 | ---- | M] () -- C:\ProgramData\-SoIaMjphesp9YP
[2012.08.12 12:47:46 | 2146,676,736 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.12 12:14:14 | 000,000,064 | ---- | M] () -- C:\ProgramData\-SoIaMjphesp9YPr
[2012.08.12 12:08:03 | 000,000,368 | ---- | M] () -- C:\ProgramData\SoIaMjphesp9YP
[2012.08.12 12:07:08 | 000,255,488 | ---- | M] (XNN) -- C:\ProgramData\SoIaMjphesp9YP.exe
[2012.08.12 12:05:46 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2012.08.12 11:50:53 | 000,348,672 | ---- | M] (XNN) -- C:\ProgramData\WQaJpUNUgPHe.exe
[2012.08.01 01:00:00 | 000,000,348 | ---- | M] () -- C:\Windows\tasks\McQcTask.job

========== Files Created - No Company Name ==========

[2012.08.12 14:01:17 | 000,000,990 | ---- | C] () -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.08.12 14:01:10 | 000,000,985 | ---- | C] () -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012.08.12 14:01:00 | 000,000,956 | ---- | C] () -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2012.08.12 12:14:14 | 000,000,064 | ---- | C] () -- C:\ProgramData\-SoIaMjphesp9YPr
[2012.08.12 12:14:14 | 000,000,064 | ---- | C] () -- C:\ProgramData\-SoIaMjphesp9YP
[2012.08.12 12:07:09 | 000,000,368 | ---- | C] () -- C:\ProgramData\SoIaMjphesp9YP
[2012.06.16 00:03:07 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini
[2012.06.15 09:49:03 | 000,000,044 | ---- | C] () -- C:\Windows\Acer(Normal).ini
[2012.06.15 09:49:03 | 000,000,042 | ---- | C] () -- C:\Windows\Acer(Wide).ini
[2012.06.14 15:04:47 | 000,097,392 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin
[2012.06.14 12:52:12 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.06.14 12:34:35 | 000,000,032 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat
[2012.06.14 12:31:29 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012.06.14 11:55:20 | 000,001,024 | R--- | C] () -- C:\Windows\System32\NTIOFM4.dll
[2012.06.14 11:55:20 | 000,001,024 | R--- | C] () -- C:\Windows\System32\NTIBUN5.dll
[2011.06.22 06:47:58 | 000,024,064 | ---- | C] () -- C:\Windows\System32\ssp7ml3.dll

< End of report >

OTL Extras logfile created on: 12.08.2012 21:37:09 - Run 1
OTL by OldTimer - Version 3.2.57.0 Folder = C:\Users\Papa\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 0,98 Gb Available Physical Memory | 49,21% Memory free
4,23 Gb Paging File | 2,60 Gb Available in Paging File | 61,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142,16 Gb Total Space | 6,74 Gb Free Space | 4,74% Space Free | Partition Type: NTFS
Drive D: | 142,93 Gb Total Space | 41,89 Gb Free Space | 29,31% Space Free | Partition Type: NTFS

Computer Name: FRANZI-PC | User Name: Papa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0348F966-6FBB-4EA9-A86C-534590131884}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{1CDB347F-71FE-4C66-AE0E-AA3EE9D92CB8}" = rport=139 | protocol=6 | dir=out | app=system |
"{452AAF47-88B6-4EBB-A9E3-DCDDD33165B7}" = lport=445 | protocol=6 | dir=in | app=system |
"{8DDE18B7-80B3-4C04-BCAC-C965D0ACB451}" = rport=445 | protocol=6 | dir=out | app=system |
"{A3DF0975-C8FE-4951-A02E-8F9B8C0C7E1A}" = lport=139 | protocol=6 | dir=in | app=system |
"{C8795517-1B8C-42D2-9CD9-C46771835154}" = lport=138 | protocol=17 | dir=in | app=system |
"{CAF960DD-CA95-4FAA-BB86-6338C0CD5EE6}" = rport=137 | protocol=17 | dir=out | app=system |
"{D4347DE9-D0D8-46DF-8050-8F2147550B35}" = rport=138 | protocol=17 | dir=out | app=system |
"{F5E79D79-AC11-405F-90AC-2714F1455305}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{F99C9031-F656-47C4-BE62-6466A4A27EE0}" = lport=137 | protocol=17 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01FE3FD4-26C5-4E37-B930-B684975F193B}" = protocol=17 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{07DA85B6-C018-4865-BCF9-166A71EC1B4A}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{10DEA36A-A6F0-4568-884F-645E251C3DE6}" = dir=in | app=c:\program files\acer arcade live\acer slideshow dvd\acer slideshow dvd.exe |
"{1869C293-FB0D-4C67-BFD6-6ED4CFD93BE5}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{260AB72A-F760-407F-AEA3-5CDB93A31A23}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{2E1B7D6D-2F48-427E-A7B7-40AA5E46348E}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{3976701B-C292-45D3-9D48-1E81364F7947}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\kernel\dms\clmsserver.exe |
"{3C5E3CCE-5CB8-41AD-8E7B-2968D30F0AF0}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{3C94599E-B44B-442C-8A9E-BFCB1CE2599E}" = protocol=6 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{43651FB3-98FD-4678-8930-4EA7DE9AD1C9}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\acer homemedia connect.exe |
"{4A03E140-787F-4193-A083-1353B1BBC39A}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{5558548C-2788-4D7B-9814-157A4F660312}" = dir=in | app=c:\program files\acer arcade live\acer dv magician\acer dv magician.exe |
"{5DD397FA-170E-416A-81C9-F6B4693285E1}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{6BB68B0D-D11A-48A4-BE1B-0B215B7030E1}" = dir=in | app=c:\program files\acer arcade live\acer videomagician\acer videomagician.exe |
"{700E49C5-F76D-401D-BB4E-85F05E972951}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{731057D2-B45B-4969-93B2-1155798CC3AB}" = dir=in | app=c:\program files\acer arcade live\acer arcade live main page\acer arcade live.exe |
"{973CB9A0-AAA5-43FF-B19D-5298A5357A9F}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{B06796BE-928E-48B1-B85E-46088151CB78}" = dir=in | app=c:\program files\acer arcade live\acer homemedia\acer homemedia.exe |
"{B1373CDE-13BA-4AC4-A7EB-EF5D62B9A4B1}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe |
"{B4542DCD-9F3D-4C4C-8238-4DAA193DE8E6}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{B4DD9959-42D2-4C03-80EE-31CC48E85113}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{C7F3C151-C0E4-464B-8D47-605A872912B7}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{D03357EE-B605-4380-80EF-C2B3235848AB}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D0A80936-D1F1-4E67-A265-3999A13F0CC9}" = dir=in | app=c:\program files\acer arcade live\acer homemedia trial creator\acer homemedia trial creator.exe |
"{D3AB8735-8CE3-47AC-BD1E-B929CDFAD72A}" = dir=in | app=c:\program files\acer arcade live\acer dvdivine\acer dvdivine.exe |
"{FC00E7F8-34AB-436C-A1CD-E64B1DF98475}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe |
"TCP Query User{782BF6CE-562C-425D-BFC3-49324109EEF7}D:\program files\pap\panzers - phase1\run\panzers.exe" = protocol=6 | dir=in | app=d:\program files\pap\panzers - phase1\run\panzers.exe |
"UDP Query User{30B02002-96CE-4C03-9760-29A3ECD5BA1D}D:\program files\pap\panzers - phase1\run\panzers.exe" = protocol=17 | dir=in | app=d:\program files\pap\panzers - phase1\run\panzers.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect
"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2FA06473-23F0-4372-8DD5-1EAE42503D93}" = MAGIX Video easy TERRATEC Edition
"{39600969-41C3-4658-876E-16F108FC5C92}" = ISO Recorder
"{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD
"{45CEBDDE-AD94-4C5A-999D-0D35CE61405B}_is1" = 1.5
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7683B745-6060-41FD-AA75-0BBB383FEAD4}" = SweetIM for Messenger 3.7
"{774C0434-9948-4DEE-A14E-69CDD316E36C}" = Internet Explorer Toolbar 4.6 by SweetPacks
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110322783}" = Big Kahuna Reef
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110411970}" = Chuzzle
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111118433}" = Mystery Case Files - Huntsville
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111324990}" = Kick N Rush
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111543617}" = Backspin Billiards
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111692950}" = Mahjongg Artifacts
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111796363}" = Mystery Solitaire - Secret Island
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111872660}" = Diner Dash Flo on the Go
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112531267}" = Chicken Invaders 3
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112615863}" = Agatha Christie Death on the Nile
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113080210}" = Azada
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{58FC5E37-DD28-4D4A-A549-125744C6763C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{888B9AC7-8F5C-456B-A27A-157A6C310E52}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management
"{A8B0DBDE-8119-48B0-8088-D12DA01C36BA}" = DownloadnSave
"{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = Acer HomeMedia
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch
"{B145EC69-66F5-11D8-9D75-000129760D75}" = Acer DVDivine
"{B580C409-E16F-44FF-904D-3AE94E113BE0}" = Acer HomeMedia Trial Creator
"{BC14F40D-7C13-4F3A-9F4A-3835D7642036}" = PE585QAEncoder-32
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician
"{F79A208D-D929-11D9-9D77-000129760D75}" = Acer VideoMagician
"{FB697452-8CA4-46B4-98B1-165C922A2EF3}" = Update Manager for SweetPacks 1.0
"Acer GameZone Console_is1" = Acer GameZone Console DTV 2.0.1.1
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AVMWLANCLI" = AVM FRITZ!WLAN
"EPSON Scanner" = EPSON Scan
"EPSON SX130 Series" = Druckerdeinstallation für EPSON SX130 Series
"GPL Ghostscript 9.05" = GPL Ghostscript
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"MAGIX_MSI_Video_easy_3_TerraTec" = MAGIX Video easy TERRATEC Edition
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox 13.0 (x86 de)" = Mozilla Firefox 13.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSC" = McAfee SecurityCenter
"NVIDIA Drivers" = NVIDIA Drivers
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 03.08.2012 08:04:56 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10
Description =

Error - 03.08.2012 13:44:45 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10
Description =

Error - 04.08.2012 00:26:06 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10
Description =

Error - 04.08.2012 03:58:38 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10
Description =

Error - 04.08.2012 07:17:32 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10
Description =

Error - 04.08.2012 15:11:51 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10
Description =

Error - 05.08.2012 08:00:15 | Computer Name = Franzi-PC | Source = McLogEvent | ID = 5051
Description = Ein Thread in Vorgang C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe brauchte
länger als 90000 ms, um eine Anfrage auszuführen. Der Vorgang wird beendet. Thread-ID:
3000 (0xbb8) Thread-Adresse: 0x120DBCCE Thread-Nachricht: Build VSCORE.14.0.0.349
/ 5200.2160 Object being scanned = \Device\HarddiskVolume2\Program Files\McAfee\MSC\mclgview.exe

by c:\PROGRA~1\mcafee\msc\mcupdmgr.exe 4(0)(0) 4(0)(0) 7200(0)(0) 7595(0)(0) 7005(0)(0)

7004(0)(0) 5006(0)(0) 5004(0)(0)

Error - 06.08.2012 13:12:46 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10
Description =

Error - 07.08.2012 15:07:48 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10
Description =

Error - 07.08.2012 16:54:32 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 19.07.2012 03:23:27 | Computer Name = Franzi-PC | Source = HTTP | ID = 15016
Description =

Error - 19.07.2012 03:24:48 | Computer Name = Franzi-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 20.07.2012 04:13:40 | Computer Name = Franzi-PC | Source = HTTP | ID = 15016
Description =

Error - 20.07.2012 04:15:02 | Computer Name = Franzi-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 21.07.2012 03:18:14 | Computer Name = Franzi-PC | Source = HTTP | ID = 15016
Description =

Error - 21.07.2012 03:19:49 | Computer Name = Franzi-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 21.07.2012 08:44:47 | Computer Name = Franzi-PC | Source = HTTP | ID = 15016
Description =

Error - 21.07.2012 08:46:21 | Computer Name = Franzi-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 22.07.2012 11:16:06 | Computer Name = Franzi-PC | Source = HTTP | ID = 15016
Description =

Error - 22.07.2012 11:17:39 | Computer Name = Franzi-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >


So! Und nun?

Danke, wer auch immer hier Hilfe gibt.
Papa

Alt 16.08.2012, 13:18   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Zitat:
Keine Aktion durchgeführt.
-> No action taken.
Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! Bitte nachholen falls noch nicht getan!

NICHTS voreilig aus der Quarantäne löschen!
__________________

__________________

Alt 17.08.2012, 07:22   #3
cfmmk
 
File recovery in der Taskleiste  + System error message - Icon32

File recovery in der Taskleiste + System error message



Moin.

In die Quarantäne habe ich alle Funde schon verschoben.

Da alle bisherigen Meldungen auf diesen Umstand, dass nichts zu entfernen ist ( Ihr steht auf die Dinger...) besonders abgehoben haben, tat ich da auch nix.

Und nun....?
ein Papa
__________________

Alt 17.08.2012, 19:58   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Bitte erstmal routinemäßig einen neuen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
ATTFilter
 hier steht das Log
         
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 18.08.2012, 12:53   #5
cfmmk
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



1. Danke für die Info.

2. Da ich ja bereits Log- Files gepostet habe, wäre es für die "Neuen" wie mich gut auch zu hören, ob dies so bisher auch i.O. war!

Da bin ich mir nun mit meiner ersten Antwort - Mail mit Logs eben nicht sicher....

kompletter Malwarescan:

###################################################

Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.18.02

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Netzbenutzer :: FRANZI-PC [limited]

Protection: Disabled

18.08.2012 12:24:24
mbam-log-2012-08-18 (12-24-24).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 309804
Time elapsed: 57 minute(s), 14 second(s)

Memory Processes Detected: 2
C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> 3520 -> Delete on reboot.
C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> 2704 -> Delete on reboot.

Memory Modules Detected: 1
C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> Delete on reboot.

Registry Keys Detected: 6
HKCR\CLSID\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> Delete on reboot.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> Delete on reboot.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> Quarantined and deleted successfully.
HKCR\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC} (PUP.DownloadnSave) -> Delete on reboot.
HKCR\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB} (PUP.DownloadnSave) -> Delete on reboot.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A8B0DBDE-8119-48B0-8088-D12DA01C36BA} (PUP.DownloadnSave) -> Delete on reboot.

Registry Values Detected: 3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> Data: C:\ProgramData\WQaJpUNUgPHe.exe -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|SoIaMjphesp9YP (Rogue.FakeHDD) -> Data: C:\ProgramData\SoIaMjphesp9YP.exe -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|LicenseValidator (Trojan.Proxy) -> Data: C:\Users\Netzbenutzer\AppData\Roaming\Identities\{ECEB30EE-3DC7-4CB2-88FC-B205C8974BFC}\LicenseValidator.exe -> Quarantined and deleted successfully.

Registry Data Items Detected: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.

Folders Detected: 2
C:\ProgramData\DownloadnSave (PUP.DownloadnSave) -> Delete on reboot.
C:\ProgramData\DownloadnSave\data (PUP.DownloadnSave) -> Delete on reboot.

Files Detected: 18
C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> Delete on reboot.
C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> Delete on reboot.
C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> Delete on reboot.
C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\Gxv1zF45[1].exe (Exploit.Drop.COD) -> Quarantined and deleted successfully.
C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\krevkqcmdubtfvdz8[1].exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
C:\Users\Netzbenutzer\AppData\Local\Temp\tmpA8E6.tmp.exe (RootKit.0Access) -> Quarantined and deleted successfully.
C:\Users\Netzbenutzer\AppData\Local\Temp\wYHCrAaxE5MMYA.exe.tmp (Rogue.FakeHDD) -> Quarantined and deleted successfully.
C:\Users\Netzbenutzer\Desktop\Downloads\MB-Scrsaver.zip.exe (Affiliate.Downloader) -> Quarantined and deleted successfully.
C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W6JK739V\4fdbb519d63b4[1].exe (Adware.Dropper) -> Delete on reboot.
C:\Users\Papa\AppData\Local\Temp\{FFFE3346-117B-503B-B2D0-5959241D11B0}\Addons\download_save.exe (Adware.Dropper) -> Delete on reboot.
C:\Users\Netzbenutzer\AppData\Local\Temp\wuauclt.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\DownloadnSave\content.js (PUP.DownloadnSave) -> Delete on reboot.
C:\ProgramData\DownloadnSave\background.html (PUP.DownloadnSave) -> Delete on reboot.
C:\ProgramData\DownloadnSave\odeoclokhmjimjdcfohekbelankbmihb.crx (PUP.DownloadnSave) -> Delete on reboot.
C:\ProgramData\DownloadnSave\settings.ini (PUP.DownloadnSave) -> Delete on reboot.
C:\ProgramData\DownloadnSave\uninstall.exe (PUP.DownloadnSave) -> Delete on reboot.
C:\ProgramData\DownloadnSave\data\content.js (PUP.DownloadnSave) -> Delete on reboot.
C:\ProgramData\DownloadnSave\data\jsondb.js (PUP.DownloadnSave) -> Delete on reboot.

(end)

#####################################################


ICh habe dann remove als einzige wählbare Option vorgenommen-

die Ergebnisse sind in der Quarantäne dann sichtbar gewesen:
###################################################


Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.18.02

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Netzbenutzer :: FRANZI-PC [limited]

Protection: Disabled

18.08.2012 12:24:24
mbam-log-2012-08-18 (13-31-52).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 309804
Time elapsed: 57 minute(s), 14 second(s)

Memory Processes Detected: 2
C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> 3520 -> No action taken.
C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> 2704 -> No action taken.

Memory Modules Detected: 1
C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> No action taken.

Registry Keys Detected: 6
HKCR\CLSID\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> No action taken.
HKCR\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC} (PUP.DownloadnSave) -> No action taken.
HKCR\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB} (PUP.DownloadnSave) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A8B0DBDE-8119-48B0-8088-D12DA01C36BA} (PUP.DownloadnSave) -> No action taken.

Registry Values Detected: 3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> Data: C:\ProgramData\WQaJpUNUgPHe.exe -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|SoIaMjphesp9YP (Rogue.FakeHDD) -> Data: C:\ProgramData\SoIaMjphesp9YP.exe -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|LicenseValidator (Trojan.Proxy) -> Data: C:\Users\Netzbenutzer\AppData\Roaming\Identities\{ECEB30EE-3DC7-4CB2-88FC-B205C8974BFC}\LicenseValidator.exe -> No action taken.

Registry Data Items Detected: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.

Folders Detected: 2
C:\ProgramData\DownloadnSave (PUP.DownloadnSave) -> No action taken.
C:\ProgramData\DownloadnSave\data (PUP.DownloadnSave) -> No action taken.

Files Detected: 18
C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> No action taken.
C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> No action taken.
C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> No action taken.
C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\Gxv1zF45[1].exe (Exploit.Drop.COD) -> No action taken.
C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\krevkqcmdubtfvdz8[1].exe (Rogue.FakeHDD) -> No action taken.
C:\Users\Netzbenutzer\AppData\Local\Temp\tmpA8E6.tmp.exe (RootKit.0Access) -> No action taken.
C:\Users\Netzbenutzer\AppData\Local\Temp\wYHCrAaxE5MMYA.exe.tmp (Rogue.FakeHDD) -> No action taken.
C:\Users\Netzbenutzer\Desktop\Downloads\MB-Scrsaver.zip.exe (Affiliate.Downloader) -> No action taken.
C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W6JK739V\4fdbb519d63b4[1].exe (Adware.Dropper) -> No action taken.
C:\Users\Papa\AppData\Local\Temp\{FFFE3346-117B-503B-B2D0-5959241D11B0}\Addons\download_save.exe (Adware.Dropper) -> No action taken.
C:\Users\Netzbenutzer\AppData\Local\Temp\wuauclt.exe (Trojan.Agent) -> No action taken.
C:\ProgramData\DownloadnSave\content.js (PUP.DownloadnSave) -> No action taken.
C:\ProgramData\DownloadnSave\background.html (PUP.DownloadnSave) -> No action taken.
C:\ProgramData\DownloadnSave\odeoclokhmjimjdcfohekbelankbmihb.crx (PUP.DownloadnSave) -> No action taken.
C:\ProgramData\DownloadnSave\settings.ini (PUP.DownloadnSave) -> No action taken.
C:\ProgramData\DownloadnSave\uninstall.exe (PUP.DownloadnSave) -> No action taken.
C:\ProgramData\DownloadnSave\data\content.js (PUP.DownloadnSave) -> No action taken.
C:\ProgramData\DownloadnSave\data\jsondb.js (PUP.DownloadnSave) -> No action taken.

(end)

######################################################

SO!

Und nun?

Kann ich das ESET - LOg so hier weitergeben, wie ich es bisher mitdem Maleware - Log getan habe?

Ich benutze regulär Firefox. Der ist aber nun nicht nutzbar......

Also bin ich mit dem IE hier.

Welche ESET-Version nehme ich nun?
Und wenn ich das ESET laufen lasse, und alle störenden Programme abschalten soll:

Ist dies ein Internet- basierendes Suchprogramm? Muss ich online sein? Oder aber offline - was mein erster Gedanke wäre ( Ich lade etwas runter - das Etwas kommt von euch - ist also vertrauenswürdig, dann gehe ich offline - habe ein Ergebnis) das ich dann wieder zurücksende - online.

Mag blöd klingen, aber wie nun?

Welches ESET?

Das es ein ONLINE - Programm ist habe ich nun auch gesehen.........
Da ich mit dem IE Unterwegs bin - nutze ich nun das vorgeschlagenen....?

Sind die Logs in der gewünschten Form - ich kann da nix sehen....?

DAnke bis bald? Ich bleibe hier dran....


Alt 18.08.2012, 14:21   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Sry irgendwie spinnt das Laden der grafik, die da eigentlich in der ESET-Anleitung sein sollte


Im als Administrator geöffneten Browser diesen Link aufrufen => http://www.eset.com/online-scanner-popup

Und bitte die Logs alle in CODE-Tags posten!!!
__________________
--> File recovery in der Taskleiste + System error message

Alt 18.08.2012, 14:38   #7
cfmmk
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Mahlzeit.

ESET ist gelaufen. Das Log konnte ich nicht auf die beschriebene Weise erzeugen. Aber da ja die Anwendung ein TXT file erzeugen kann.....


ESET - Log:

C:\Program Files\Acer Arcade Live\Acer HomeMedia Trial Creator\Export\SoftDMA_Trial\Autorun.inf INF/Autorun.gen worm
C:\ProgramData\SoIaMjphesp9YP.exe a variant of Win32/Kryptik.AKAD trojan
C:\ProgramData\WQaJpUNUgPHe.exe a variant of Win32/Kryptik.AKAD trojan
C:\ProgramData\DownloadnSave\bhoclass.dll Win32/Adware.MultiPlug.A application
C:\ProgramData\DownloadnSave\uninstall.exe Win32/Adware.MultiPlug.A application
C:\Users\All Users\SoIaMjphesp9YP.exe a variant of Win32/Kryptik.AKAD trojan
C:\Users\All Users\WQaJpUNUgPHe.exe a variant of Win32/Kryptik.AKAD trojan
C:\Users\All Users\DownloadnSave\bhoclass.dll Win32/Adware.MultiPlug.A application
C:\Users\All Users\DownloadnSave\uninstall.exe Win32/Adware.MultiPlug.A application
C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W6JK739V\4fdbb519d63b4[1].exe Win32/Adware.MultiPlug.A application
C:\Users\Papa\AppData\Local\Temp\{FFFE3346-117B-503B-B2D0-5959241D11B0}\Addons\download_save.exe Win32/Adware.MultiPlug.A application
Operating memory multiple threats


Und jetzt?
Papa

Alt 18.08.2012, 14:41   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 18.08.2012, 19:12   #9
cfmmk
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Boah ey!

Nur 3 Minuten bis zur Antwort.
Ich bitte um Entschuldigung - wir haben gegrillt....
"Blödes Gelabere - wo ist das File....?"

Ich habe den Artikel "Tags" "gelesen" - aber nicht verstanden...
Ihr wollte keine Txt - Dateien - ja was wollt ihr denn? Also wie?

Mit etwas Apostroph etc ist es ja wohl nicht getan?! Also nochmal ein TXT....
Mit der Bitte um Nachsicht....

File:


# AdwCleaner v1.801 - Logfile created 08/18/2012 at 20:10:30
# Updated 14/08/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 1 (32 bits)
# User : Papa - FRANZI-PC
# Boot Mode : Normal
# Running from : C:\Users\Netzbenutzer\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Netzbenutzer\AppData\LocalLow\DownloadnSave
Folder Found : C:\Users\Netzbenutzer\AppData\LocalLow\SweetIM
Folder Found : C:\Users\Franzi\AppData\LocalLow\SweetIM
Folder Found : C:\Users\Papa\AppData\LocalLow\SweetIM
Folder Found : C:\Users\Netzbenutzer\AppData\Roaming\pdfforge
Folder Found : C:\Users\Papa\AppData\Roaming\pdfforge
Folder Found : C:\ProgramData\DownloadnSave
Folder Found : C:\ProgramData\InstallMate
Folder Found : C:\ProgramData\SweetIM
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DownloadnSave
Folder Found : C:\Program Files\SweetIM
Folder Found : C:\Windows\Installer\{FB697452-8CA4-46B4-98B1-165C922A2EF3}
Folder Found : C:\ProgramData\Partner
Folder Found : C:\ProgramData\Premium
File Found : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\searchplugins\SweetIm.xml
File Found : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi

***** [Registry] *****

Key Found : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho
Key Found : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0
Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Key Found : HKLM\SOFTWARE\Classes\sim-packages
Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A8B0DBDE-8119-48B0-8088-D12DA01C36BA}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB697452-8CA4-46B4-98B1-165C922A2EF3}
Key Found : HKLM\SOFTWARE\SweetIM
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SweetIM]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Sweetpacks Communicator]

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]

***** [Internet Browsers] *****

-\\ Internet Explorer v7.0.6001.18000

[OK] Registry is clean.

-\\ Mozilla Firefox v13.0 (de)

Profile name : default
File : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\prefs.js

[OK] File is clean.

Profile name : default
File : C:\Users\Franzi\AppData\Roaming\Mozilla\Firefox\Profiles\z5entuql.default\prefs.js

[OK] File is clean.

Profile name : default
File : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\hjxx7x27.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [5481 octets] - [18/08/2012 20:10:30]

########## EOF - \AdwCleaner[R1].txt - [5609 octets] ##########


Und....?

Guten Morgen...

Nein Firefox lässt sich nach wie vor ( natürlich) nicht öffnen, der IE
scheint mir sehr langsam zu sein, Mails - bei Yahoo - lassen sich nicht abrufen...

Mal so als Zwischenstand....

Morgen!

Beim Update malware erhalte ich eine Fehlermeldung

PROGRAMM_ERROR_UPDATING (5, 0, MBAMFileIOWriteFile)

Zugriff verweigert

NA und dann ist er fertig....

3. Versuch heute Sonntag eine Merldung hereinzubringen...
Was von gestern abend ab "Guten Morgen" steht, ist auch von heute....

Der IE nudelt sich einen ab und braucht immer länger zum Seitenaufbau....

Windowsdefender meldete sich mit 2 mal der Meldungen "Trojan:Win32/FakeSysdef"
Dies habe ich mal in die Quaantäne verschoben - erfolgreich als Status....

Wie gesagt, Malware lässt sich nicht aktualisieren.....

Grüsse und besoanders heute immer schön kühl bleiben....
Papa

Geändert von cfmmk (18.08.2012 um 19:22 Uhr)

Alt 20.08.2012, 16:33   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Es steht doch nun wirklich haarklein erklärt wie das mit den CODE-Tags geht!
Dafür hat man auch extra bei der über das Beitragstextfenster verschiedene Formatierbuttons, der Button mit # beschriftet oist für die CODE-Tags!

Nochmal: Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
ATTFilter
 hier steht das Log
         
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 21.08.2012, 18:54   #11
cfmmk
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Hallo und Danke für die Info.

Jetzt weiss ich also, dass die Logs bisher also nicht lesbar waren - nicht verwertbar? Aber ich habe die Frage schon beim ersten Mal gestellt.

Und jetzt? Habe ich was erreicht?

Ich weiss das "Cosinus" in den Urlaub geht. Sei gegönnt.

Und was weiter?
Soll ich das eine oder das andere Log neu einstellen?

Danke....

Alt 22.08.2012, 20:26   #12
cfmmk
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Hallo

Cosinus macht Urlaub.

Und was mach ich jetzt?

Danke sehr....

Alt 30.08.2012, 13:08   #13
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Wäre schön, wenn du dir mal etwas mehr Mühe geben könntest!
Es kann doch nicht zuviel verlangt sein, den die Log in vernünftiger Formatierung zu posten! Bei der Formatierleistee gibt es extra den Button der mit # beschriftet ist für die CODE-Boxen!

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 08.09.2012, 12:49   #14
cfmmk
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Guten Tag und bitte - die Datei:


Und jetzt also ? ein ( zur "Sicherheit" auch als Anhang)
:


# AdwCleaner v1.801 - Logfile created 09/08/2012 at 13:36:01
# Updated 14/08/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 1 (32 bits)
# User : Papa - FRANZI-PC
# Boot Mode : Normal
# Running from : C:\Users\Netzbenutzer\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\Netzbenutzer\AppData\LocalLow\DownloadnSave
Folder Deleted : C:\Users\Netzbenutzer\AppData\LocalLow\SweetIM
Folder Deleted : C:\Users\Franzi\AppData\LocalLow\SweetIM
Folder Deleted : C:\Users\Netzbenutzer\AppData\Roaming\pdfforge
Folder Deleted : C:\Users\Papa\AppData\Roaming\pdfforge
Folder Deleted : C:\ProgramData\DownloadnSave
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DownloadnSave
Folder Deleted : C:\Program Files\SweetIM
Folder Deleted : C:\ProgramData\Partner
Folder Deleted : C:\ProgramData\Premium
File Deleted : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\searchplugins\SweetIm.xml
File Deleted : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi

***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho
Key Deleted : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A8B0DBDE-8119-48B0-8088-D12DA01C36BA}
Key Deleted : HKLM\SOFTWARE\SweetIM

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]

***** [Internet Browsers] *****

-\\ Internet Explorer v7.0.6001.18000

[OK] Registry is clean.

-\\ Mozilla Firefox v13.0 (de)

Profile name : default
File : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\prefs.js

[OK] File is clean.

Profile name : default
File : C:\Users\Franzi\AppData\Roaming\Mozilla\Firefox\Profiles\z5entuql.default\prefs.js

[OK] File is clean.

Profile name : default
File : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\hjxx7x27.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R4].txt - [3167 octets] - [21/08/2012 20:39:33]
AdwCleaner[R5].txt - [3227 octets] - [08/09/2012 13:35:43]
AdwCleaner[S1].txt - [3028 octets] - [08/09/2012 13:36:01]
AdwCleaner[R1].txt - [5608 octets] - [18/08/2012 20:10:30]
AdwCleaner[R2].txt - [5668 octets] - [19/08/2012 01:06:47]
AdwCleaner[R3].txt - [5728 octets] - [19/08/2012 11:27:56]

########## EOF - \AdwCleaner[S1].txt - [3336 octets] ##########
Angehängte Dateien
Dateityp: txt AdwCleaner[S1].txt (3,3 KB, 113x aufgerufen)

Alt 10.09.2012, 15:00   #15
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
File recovery in der Taskleiste  + System error message - Standard

File recovery in der Taskleiste + System error message



Immer noch keine CODE-Tags!
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Antwort

Themen zu File recovery in der Taskleiste + System error message
affiliate.downloader, browser, diner dash, error, excel, file recovery, firefox, flash player, frage, helper, home, iexplore.exe, install.exe, logfile, malware, msiexec.exe, phishing, popup, realtek, registry, scan, siteadvisor, software, stick, sweetim, system, system error, usb, vista, wuauclt.exe



Ähnliche Themen: File recovery in der Taskleiste + System error message


  1. System-error-message.net entfernen
    Anleitungen, FAQs & Links - 25.10.2015 (2)
  2. Windows 7 recovery error
    Alles rund um Windows - 24.07.2015 (1)
  3. Windows Virus, Run DLL Error mit fehlenden Desktopsymbolen und Taskleiste
    Log-Analyse und Auswertung - 07.12.2014 (13)
  4. Viele Mails mit Inhalt: This message was created automatically by mail delivery software. A message that you sent could not be delivered to
    Plagegeister aller Art und deren Bekämpfung - 13.07.2014 (13)
  5. File Restore / File Recovery - bin ich wieder clean?
    Plagegeister aller Art und deren Bekämpfung - 03.11.2012 (1)
  6. System Message - Write Fault Error / system error hard disk failure detected
    Plagegeister aller Art und deren Bekämpfung - 20.09.2012 (9)
  7. System Message - write fault error
    Log-Analyse und Auswertung - 17.08.2012 (1)
  8. System message - write fault error
    Log-Analyse und Auswertung - 09.08.2012 (23)
  9. Data Recovery - S.M.A.R.T. Check/Repair write fault error
    Plagegeister aller Art und deren Bekämpfung - 17.07.2012 (5)
  10. ACMON ERROR und Deskptophintergrund und Taskleiste verschwinden immer nach Neustart
    Alles rund um Windows - 14.05.2011 (2)
  11. Malwarebytes Anti-Malware Runtime error 372 + Taskleiste verschwunden
    Log-Analyse und Auswertung - 28.04.2011 (15)
  12. Neues Symbol in der Taskleiste (Media Error)
    Plagegeister aller Art und deren Bekämpfung - 26.04.2009 (1)
  13. Windows Warnig Message & NT-Autorität/system
    Plagegeister aller Art und deren Bekämpfung - 10.09.2008 (9)
  14. System Error! Trojan horses : HJT Log-File included
    Log-Analyse und Auswertung - 19.07.2008 (22)
  15. System Message Click here for Details!
    Plagegeister aller Art und deren Bekämpfung - 13.06.2008 (43)
  16. system message - trojaner ?
    Log-Analyse und Auswertung - 03.03.2008 (5)
  17. Windows Error Message Virus/Wurm?
    Log-Analyse und Auswertung - 12.11.2007 (16)

Zum Thema File recovery in der Taskleiste + System error message - Surfen im I- net und dann o.g. Fehlermeldung. Desktop wurde leer, File recovery tat sich auf und "animiert" zum kauf einer Vollversion, Firefox meldet sich ab und dann 20-30 System - File recovery in der Taskleiste + System error message...
Archiv
Du betrachtest: File recovery in der Taskleiste + System error message auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.