Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: email link angeklickt - ist PC jetzt infiziert?

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 23.08.2012, 12:43   #1
atze2809
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?



Hallo,
ich habe eine email mit einem link von einem Bekannten bekommen und dummerweiße drauf geklickt. Es war irgend ne Werbung und jetzt hab ich natürlich Angst das ich mir irgendwas eingefangen hab .

(link: hxxp://swugradschool.com/wp-content/themes/twentyten/likeit.php?orange209.bmp)

Virenscanner hat nichts gefunden und gerade lass ich Malwarebytes laufen. Hab mich hier im forum bisschen eingelesen - jedoch waren die schirtte speziell nur für denjenigen der den Thread gepostet hat.

Wäre sehr nett, wenn mir jemand bei meinem Problem helfen könnte

Gruß Stephan

hier mal die ergebnisse von OTL:

OTL.txt

Code:
ATTFilter
OTL logfile created on: 23.08.2012 18:27:34 - Run 1
OTL by OldTimer - Version 3.2.58.1     Folder = C:\Users\Windows\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,97 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 56,90% Memory free
7,93 Gb Paging File | 6,00 Gb Available in Paging File | 75,69% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,76 Gb Total Space | 289,04 Gb Free Space | 62,06% Space Free | Partition Type: NTFS
 
Computer Name: LAPTOP | User Name: Windows | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Windows\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
PRC - C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\Stickies\stickies.exe (Zhorn Software)
PRC - C:\Users\Windows\AppData\LocalLow\WOT\IE\WOTUpdater.exe ()
PRC - C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files (x86)\SAP\SAPsetup\setup\Updater\NwSapAutoWorkstationUpdateService.exe (SAP AG)
PRC - C:\Program Files (x86)\SAP\SapSetup\setup\Updater\NwSapSetupUserNotificationTool.exe (SAP AG)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Program DJ\Wow Video&Audio\WVAMain.exe ()
PRC - C:\Program Files (x86)\Program DJ\Wireless Switch\wlss.exe (Compal Electronics, Inc.)
PRC - C:\Program Files (x86)\Program DJ\Program DJ3\ProgramDJ3.exe ()
PRC - C:\Program Files (x86)\EgisTec\VITAKEY\PdtWzd.exe (Egis Technology Inc.)
PRC - c:\Program Files (x86)\EgisTec\VITAKEY\CompPtcVUI.exe (Egis Technology Inc.)
PRC - c:\Program Files (x86)\EgisTec\VITAKEY\BASVC.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe (PostgreSQL Global Development Group)
PRC - C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe (PostgreSQL Global Development Group)
PRC - C:\Program Files\Dassault Systemes\PhotoStudioSatellite\B19\rayserver.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll ()
MOD - C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\00a4922fbf869a79c043b665035516b6\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\4230ed1c7990e4ee8352baf67a2a85fa\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d0e1cdaff8f9055187f8e7b52c060dff\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\63bc6e391de5014965039e100ce1e9d5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\608d29d7cc89f3a9a195c91354561915\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
MOD - C:\Users\Windows\AppData\Local\Temp\bd7c47bb-f5c0-417c-a180-ec348d87718a\CliSecureRT.dll ()
MOD - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
MOD - C:\Program Files (x86)\Stickies\shook70.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files (x86)\Program DJ\Wow Video&Audio\WVAMain.exe ()
MOD - C:\Program Files (x86)\Program DJ\Program DJ3\ProgramDJ3.exe ()
MOD - C:\Program Files (x86)\Program DJ\Program DJ3\PdjHook.dll ()
MOD - C:\Windows\SysWOW64\EMSC.DLL ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (IGDCTRL) -- C:\Program Files\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (Ray) -- C:\Program Files\Dassault Systemes\PhotoStudioSatellite\B19\rayserver.exe ()
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (vToolbarUpdater11.2.0) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (WOTUpdater) -- C:\Users\Windows\AppData\LocalLow\WOT\IE\WOTUpdater.exe ()
SRV - (McComponentHostService) -- C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe (McAfee, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NWSAPAutoWorkstationUpdateSvc) -- C:\Program Files (x86)\SAP\SAPsetup\setup\Updater\NwSapAutoWorkstationUpdateService.exe (SAP AG)
SRV - (OpenVPNService) -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe ()
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (IGBASVC) -- c:\Program Files (x86)\EgisTec\VITAKEY\BASVC.exe (Egis Technology Inc.)
SRV - (pgsql-8.3) -- C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe (PostgreSQL Global Development Group)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (ssudserd) -- C:\Windows\SysNative\drivers\ssudserd.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation)
DRV:64bit: - (ssadbus) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation)
DRV:64bit: - (ssadserd) -- C:\Windows\SysNative\drivers\ssadserd.sys (MCCI Corporation)
DRV:64bit: - (ssadmdfl) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (androidusb) -- C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (TFsExDisk) -- C:\Windows\SysNative\drivers\TFsExDisk.sys (Teruten Inc)
DRV:64bit: - (dgderdrv) -- C:\Windows\SysNative\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV:64bit: - (sscemdm) -- C:\Windows\SysNative\drivers\sscemdm.sys (MCCI Corporation)
DRV:64bit: - (ssceserd) -- C:\Windows\SysNative\drivers\ssceserd.sys (MCCI Corporation)
DRV:64bit: - (sscebus) -- C:\Windows\SysNative\drivers\sscebus.sys (MCCI Corporation)
DRV:64bit: - (sscemdfl) -- C:\Windows\SysNative\drivers\sscemdfl.sys (MCCI Corporation)
DRV:64bit: - (FPSensor) -- C:\Windows\SysNative\drivers\FPSensor.sys (LTT)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (NETw5v64) -- C:\Windows\SysNative\drivers\NETw5v64.sys (Intel Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (EMSC) -- C:\Windows\SysNative\drivers\EMSC.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corp)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (e1express) -- C:\Windows\SysNative\drivers\e1e6032e.sys (Intel Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corporation)
DRV:64bit: - (enecir) -- C:\Windows\SysNative\drivers\enecir.sys (ENE TECHNOLOGY INC.)
DRV:64bit: - (enecirhid) -- C:\Windows\SysNative\drivers\enecirhid.sys (ENE TECHNOLOGY INC.)
DRV:64bit: - (enecirhidma) -- C:\Windows\SysNative\drivers\enecirhidma.sys (ENE TECHNOLOGY INC.)
DRV:64bit: - (LUMDriver) -- C:\Windows\SysNative\drivers\LUMDriver.sys (IBM)
DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (IFXTPM) -- C:\Windows\SysNative\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV - (TFsExDisk) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys (Teruten Inc)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (EMSC) -- C:\Windows\SysWOW64\drivers\EMSC.sys (Windows (R) Win 7 DDK provider)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bigseekpro.com/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10}
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.avg.com/?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=10.2.0.3&sap=hp
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 70 79 93 11 89 B5 CA 01  [binary data]
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=10.2.0.3&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = hxxp://www.bigseekpro.com/search/browser/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10}?q={searchTerms}
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bigseekpro.com/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10}
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - No CLSID value found
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: info@youtube-mp3.org:1.0.2
FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49&sap=ku&q="
FF - prefs.js..network.proxy.autoconfig_url: "chrome://viewtubes/content/viewtubes_false.pac"
FF - prefs.js..network.proxy.type: 2
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_233.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Windows\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Windows\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012.07.09 22:48:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2012.06.03 18:18:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 17:20:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.07.19 09:18:30 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 17:20:30 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.07.19 09:18:30 | 000,000,000 | ---D | M]
 
[2010.02.26 19:00:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Windows\AppData\Roaming\mozilla\Extensions
[2012.08.10 14:33:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Windows\AppData\Roaming\mozilla\Firefox\Profiles\4ddcnqn9.default\extensions
[2012.03.30 17:34:32 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Windows\AppData\Roaming\mozilla\Firefox\Profiles\4ddcnqn9.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.01.13 19:59:36 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Windows\AppData\Roaming\mozilla\Firefox\Profiles\4ddcnqn9.default\extensions\wotstats@mywot.com
[2012.06.04 11:20:15 | 000,000,853 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\11-suche.xml
[2012.06.04 11:20:15 | 000,002,209 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\englische-ergebnisse.xml
[2012.06.04 11:20:15 | 000,010,506 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\gmx-suche.xml
[2012.06.04 11:20:15 | 000,002,368 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\lastminute.xml
[2011.04.29 10:42:42 | 000,002,382 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\search.xml
[2012.06.04 11:20:15 | 000,005,489 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\webde-suche.xml
[2012.07.19 09:18:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.03.10 19:39:18 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files (x86)\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2012.07.19 09:18:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2011.07.28 22:41:32 | 000,006,796 | ---- | M] () (No name found) -- C:\USERS\WINDOWS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4DDCNQN9.DEFAULT\EXTENSIONS\INFO@YOUTUBE-MP3.ORG.XPI
[2011.08.26 15:41:09 | 000,011,510 | ---- | M] () (No name found) -- C:\USERS\WINDOWS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4DDCNQN9.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI
[2012.07.18 17:20:30 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.06.09 10:15:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.09 22:48:36 | 000,003,769 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.06.09 10:15:29 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.09 10:15:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.09 10:15:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.09 10:15:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.09 10:15:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49
CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = hxxp://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=&lang=&ds=&pr=&d=&v=&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = hxxp://clients5.google.com/complete/search?hl={language}&q={searchTerms}&client=ie8&inputencoding={inputEncoding}&outputencoding={outputEncoding}
CHR - homepage: hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Windows\AppData\Local\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Windows\AppData\Local\Google\Chrome\Application\19.0.1084.52\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Windows\AppData\Local\Google\Chrome\Application\19.0.1084.52\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Windows\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Brushed = C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfjgbcjfpbbfepcccpaffkjofcmglifg\1.0_0\
CHR - Extension: WOT = C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Extensions\nphjeokkkbngjpiofnfpnafjeofjomfb\2.11.7_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (WOT) - {9E571C81-21E7-496B-9E6B-127E60263022} - C:\Users\Windows\AppData\LocalLow\WOT\IE\WOT.dll (WOT Services Oy)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [GCTray] C:\Program Files\Program DJ\Green Charger\GCTray.exe (Compal Electronics, Inc.)
O4 - HKLM..\Run: [HF_G_Jul] C:\Program Files (x86)\AVG Secure Search\HF_G_Jul.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Program DJ3] C:\Program Files (x86)\Program DJ\Program DJ3\ProgramDJ3.exe ()
O4 - HKLM..\Run: [SAP_WUS_UNT] C:\Program Files (x86)\SAP\SAPsetup\setup\Updater\NwSapSetupUserNotificationTool.exe (SAP AG)
O4 - HKLM..\Run: [VitaKeyPdtWzd] c:\Program Files (x86)\EgisTec\VITAKEY\PdtWzd.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
O4 - HKLM..\Run: [WLSS] C:\Program Files (x86)\Program DJ\Wireless Switch\WLSS.exe (Compal Electronics, Inc.)
O4 - HKLM..\Run: [Wow Video&Audio] C:\Program Files (x86)\Program DJ\Wow Video&Audio\WVAMain.exe ()
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000..\Run: [ICQ] C:\Program Files (x86)\ICQ7.0\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Windows\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk = C:\Users\Windows\AppData\Roaming\Microsoft\Installer\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}\Icon8CF9C550.exe ()
O4 - Startup: C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk = C:\Program Files (x86)\Stickies\stickies.exe (Zhorn Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{56B39D6E-573D-48E2-BBF4-87A7B2E9D49D}: DhcpNameServer = 134.108.34.5 134.108.34.6
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7C2A9F2F-FC47-483C-BAA4-23151AA28853}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DB15E62F-A29D-418C-9ED6-B25EC22F8E62}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\saphtmlp - No CLSID value found
O18:64bit: - Protocol\Handler\sapr3 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\saphtmlp {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll (SAP, Walldorf)
O18 - Protocol\Handler\sapr3 {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll (SAP, Walldorf)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\Shell - "" = AutoRun
O33 - MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\Shell\AutoRun\command - "" = E:\ICM_ML.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.23 18:24:51 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Windows\Desktop\OTL.exe
[2012.08.23 12:24:37 | 000,000,000 | ---D | C] -- C:\Users\Windows\AppData\Roaming\Malwarebytes
[2012.08.23 12:24:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.23 12:24:25 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.23 12:24:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.23 12:24:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.17 22:57:07 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2012.08.17 22:57:04 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2012.08.17 22:57:03 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2012.08.17 22:57:03 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2012.08.17 22:57:02 | 000,911,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.08.17 22:57:01 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.08.17 22:57:01 | 000,609,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.08.17 22:57:00 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2012.08.17 22:56:59 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2012.08.17 22:56:59 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2012.08.17 22:56:33 | 000,735,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.08.17 22:56:32 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.08.17 22:56:32 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.08.17 22:56:32 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.08.17 22:56:32 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.08.17 22:56:31 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.08.17 22:56:31 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.08.17 22:56:25 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2012.07.29 15:14:06 | 000,000,000 | ---D | C] -- C:\Users\Windows\AppData\Local\PunkBuster
[2012.07.29 15:14:03 | 000,000,000 | ---D | C] -- C:\Users\Windows\AppData\Roaming\Ubisoft
[3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.23 18:29:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.23 18:24:56 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Windows\Desktop\OTL.exe
[2012.08.23 17:45:01 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1545989608-3791393258-1579190891-1000UA.job
[2012.08.23 14:43:21 | 000,013,232 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.23 14:43:21 | 000,013,232 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.23 14:34:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.23 14:34:44 | 3193,540,608 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.23 12:24:26 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.22 20:45:00 | 000,001,076 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1545989608-3791393258-1579190891-1000Core.job
[2012.08.22 14:48:31 | 000,002,469 | ---- | M] () -- C:\Users\Windows\Desktop\Google Chrome.lnk
[2012.08.18 10:53:01 | 000,452,912 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.06 13:56:07 | 000,001,818 | ---- | M] () -- C:\Users\Windows\Desktop\Assassin's Creed Brotherhood.lnk
[2012.07.29 15:14:12 | 000,280,976 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012.07.29 15:14:12 | 000,280,976 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.23 12:24:26 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.11 18:40:26 | 044,381,525 | ---- | C] () -- C:\Users\Windows\Desktop\Die Perfekte Masche Von Neil Strauss S151.pdf
[2012.08.06 13:56:07 | 000,001,818 | ---- | C] () -- C:\Users\Windows\Desktop\Assassin's Creed Brotherhood.lnk
[2012.07.29 15:14:12 | 000,280,976 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012.07.18 17:17:13 | 000,280,976 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.07.18 17:17:09 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.03.28 22:11:08 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.03.28 22:11:06 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.03.28 22:11:06 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.03.28 22:11:06 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.03.28 22:11:06 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.03.27 16:17:31 | 001,064,960 | ---- | C] () -- C:\Windows\SysWow64\h5krnl32.dll
[2012.03.27 16:17:31 | 000,188,928 | ---- | C] () -- C:\Windows\SysWow64\h5icon32.dll
[2012.03.27 16:17:31 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\h5menu32.dll
[2012.03.27 16:17:31 | 000,095,744 | ---- | C] () -- C:\Windows\SysWow64\h5rtf32.dll
[2012.03.27 16:17:31 | 000,051,200 | ---- | C] () -- C:\Windows\SysWow64\h5tool32.dll
[2011.07.26 12:02:15 | 001,591,234 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.04.03 14:06:23 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.06.02 17:59:26 | 000,015,390 | ---- | C] () -- C:\ProgramData\CommentsGames.ele
[2010.06.02 17:59:26 | 000,000,612 | ---- | C] () -- C:\ProgramData\Categories.ecx
[2010.05.25 17:40:23 | 000,005,077 | ---- | C] () -- C:\ProgramData\bltofzsb.qlf
[2010.03.17 18:18:06 | 000,007,602 | ---- | C] () -- C:\Users\Windows\AppData\Local\Resmon.ResmonCfg
[2010.03.10 19:43:21 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.03.02 19:47:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\CommentsPlayers.ele
[2010.02.25 16:18:25 | 000,000,373 | ---- | C] () -- C:\Users\Windows\AppData\Local\postgresinstall.bat
 
========== LOP Check ==========
 
[2011.10.31 13:49:05 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\DAEMON Tools Lite
[2011.10.10 21:04:50 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\DassaultSystemes
[2012.08.23 14:37:10 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Dropbox
[2010.11.07 15:02:28 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\FRITZ!
[2011.05.09 21:00:30 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\HEM Data
[2012.07.17 10:45:33 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\HoldemManager
[2012.07.10 10:02:44 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\ICQ
[2011.06.01 18:56:49 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\JavaEditor
[2011.12.29 14:57:24 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Kalypso Media
[2012.03.27 20:41:04 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\OpenCandy
[2010.08.18 14:18:02 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\OpenOffice.org
[2012.03.27 20:41:06 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\pdfforge
[2012.07.18 17:17:05 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\PunkBuster
[2011.04.22 21:26:04 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Roaming
[2012.04.29 14:19:39 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Samsung
[2012.06.19 19:57:24 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\SAP
[2012.08.23 14:36:29 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\stickies
[2011.04.22 12:57:37 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\TeamViewer
[2012.05.12 13:50:49 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Tropico 4
[2011.12.25 23:13:03 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Tropico 4 Demo
[2012.07.29 15:14:03 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Ubisoft
[2011.11.19 15:33:41 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Vocup
[2011.06.07 15:17:09 | 000,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\www.rene-zeidler.de
[2012.05.19 11:30:07 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         

extras.txt

Code:
ATTFilter
OTL Extras logfile created on: 23.08.2012 18:27:34 - Run 1
OTL by OldTimer - Version 3.2.58.1     Folder = C:\Users\Windows\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,97 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 56,90% Memory free
7,93 Gb Paging File | 6,00 Gb Available in Paging File | 75,69% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,76 Gb Total Space | 289,04 Gb Free Space | 62,06% Space Free | Partition Type: NTFS
 
Computer Name: LAPTOP | User Name: Windows | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{18D237DF-3C95-4CD1-9F3F-F10B21988519}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{1D781EED-8A57-4FD2-BBE0-CC5655B39001}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{2FB5FF05-E9EC-4202-93B0-0F6BBE625861}" = rport=445 | protocol=6 | dir=out | app=system | 
"{3087FE83-0CF0-4023-A6F6-574B813B0C71}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{81B55B6C-F438-4BC5-B05D-A478C067F65E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{974DD0FA-A8AE-4B99-88F9-E3FE6CC9F612}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{981DF4FF-6C9B-457F-A55B-C2B9AC703CCF}" = rport=137 | protocol=17 | dir=out | app=system | 
"{99FA31BB-C114-4F7A-9023-DB1258D8B5FC}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{9E8831EA-57AD-45FD-B800-742273CC1697}" = rport=138 | protocol=17 | dir=out | app=system | 
"{9F4319BB-C55C-4F2C-9DCE-5383CB4D8111}" = lport=137 | protocol=17 | dir=in | app=system | 
"{B14FE3AD-934B-4D05-845A-012C37E5A51D}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 
"{B2552153-4DF3-46F2-8324-DF2902201DD8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{B2725B5D-9CED-4392-B032-4931B48CD783}" = rport=139 | protocol=6 | dir=out | app=system | 
"{C32B9495-23CD-4CCC-83C3-5F1412404984}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{CBFF105A-DDBD-469D-AC73-2E20D84C9F0F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D1CE0DFB-DCB5-43DC-A387-3680C90F1629}" = lport=139 | protocol=6 | dir=in | app=system | 
"{DA617D29-6248-48F6-9740-6A039F94961A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{E74D30E1-BA0A-4314-8613-F6E1C5B42CBF}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{E7D0F6F7-E044-4DD9-9351-8F7DE7D45EEB}" = lport=138 | protocol=17 | dir=in | app=system | 
"{F0CA6E35-DB0F-4B33-9317-1E2B85EF9DAE}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{FACF3BC8-4495-42CA-9E1F-95A81F3A88DA}" = lport=445 | protocol=6 | dir=in | app=system | 
"{FDBEE076-4DD7-4F32-A9A8-D4E413E29EBF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FE62D50C-E684-4D7B-AB5E-5453FD9ACFCA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08392412-A330-44EA-960E-DFCD4855E4AC}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrsp.exe | 
"{0A6C244D-B408-42C9-B0E7-83A4FF456BEC}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{13AECA43-0001-4BB6-85CC-4410CE6849D4}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe | 
"{1878020A-621B-4906-8D5A-58BDF1EBD97E}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{1D8421E9-FA91-4AD3-804B-BCCB9A9CFD5A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{1ECA765F-61EC-4A50-81DA-5984BDA728F6}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrsp.exe | 
"{2AAB2A12-27D4-4C23-B3E6-1B9A27821387}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{3054836D-D78B-41D1-936C-00E28BC79E40}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{3FC51A7D-E59B-4D90-B230-3858D6293007}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{407D7603-8AF7-46B4-9BE4-50481241F5CC}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbmp.exe | 
"{420D660A-BC26-48D8-A820-B8D735B68058}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{4ECF7ED1-B828-4E02-A693-A348B2148871}" = protocol=17 | dir=in | app=c:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe | 
"{4F08F6FF-9B7A-4AC7-BB25-4F502DF41236}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe | 
"{581F8A9A-0C82-4B14-A3C0-EE6A27672625}" = protocol=6 | dir=in | app=c:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe | 
"{65D1EAB6-7B61-4D68-82EE-BDE87B07F7A8}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbmp.exe | 
"{6606A7E7-88E5-43E5-9C8A-5A75181415D4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{69474EAC-CE18-4F3E-9EEA-CDD875880E4C}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe | 
"{6A7F6BF0-D085-4BB8-87D4-45389B6FEF1B}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\uplaybrowser.exe | 
"{6B238D72-302B-451F-AA21-7B13708F4FC7}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{6DBA4AD0-8582-421B-BC18-46E32440B91B}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\assassinscreedbrotherhood.exe | 
"{70DC66C4-2BB7-4B7E-93B3-B5DAA49935DE}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrmp.exe | 
"{720C7295-2BA5-4172-9EF9-34B040DE2F9A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{7444C175-182A-4446-B9CE-EA8AF5735FBC}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe | 
"{75FE62A2-822E-4098-A1C8-11970237E8A4}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbsp.exe | 
"{770CB09C-EEDE-4CF6-A795-C488B7E6B083}" = protocol=6 | dir=out | app=system | 
"{7865B82D-30EB-45EB-B378-BB5F4400E8C8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{787028BC-F159-4D75-BA0F-C457FA05AEF0}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\uplaybrowser.exe | 
"{790B600C-A66B-48A7-8D74-6C46885466A3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{813A4671-F246-4F5E-9706-A204B33C4D0D}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{8D01091B-3A9A-4477-BB32-54776364CEB3}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{99E21E47-E6E3-4D9E-AE80-BF6D4848F9E6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{A06FD655-4840-465A-9CE2-BF2DCAA94D1B}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{A6A8C204-265D-4216-AC6B-DB7A3FDD85FC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{AA71EC75-49AD-46F1-B524-FB1E9E29D805}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe | 
"{AAE7909C-CED9-4627-B3B2-9D4C7B0495B7}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{AEAE6C9A-1F7D-443D-BF57-2D22E28D534D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{BB05F38F-0B58-4B97-88F5-0226E5270B01}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{BE994362-DE8E-457B-BE71-09D3B954C8AC}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{CEE7C599-032D-4B6D-A442-5E719A09F435}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{D4AB5906-57FE-41EE-997E-309DCD4C25DF}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrmp.exe | 
"{DB13C7AC-6B1A-4FBD-BD4B-68E23FB7CFCA}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{DD3A761E-A136-4358-B91A-AB368A522B9D}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbsp.exe | 
"{DEC77A51-D43C-4E6F-B272-6E6509F0BF32}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\assassinscreedrevelations.exe | 
"{DED2630E-6424-4B0E-9BEC-8D7D0C3FA483}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\assassinscreedrevelations.exe | 
"{EAED3116-550C-4C5E-8C38-68370BF399E4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{ED11586F-0740-41D3-A2C4-D0AE71BB4C9E}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{F3292B40-CDD9-459E-AEC0-578DE0A627EE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{F41901A3-9291-461A-9899-28CD0CE833BD}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe | 
"{FB87BFA9-18E6-465F-8F8B-7ACB31419863}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\assassinscreedbrotherhood.exe | 
"{FD4F9363-4B79-4819-B186-FD47F07004B9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{2CB53398-6C5F-4FD9-93A4-C4E3F31A0A4E}C:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhdlc.exe" = protocol=6 | dir=in | app=c:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhdlc.exe | 
"TCP Query User{314287BA-60C1-43D1-872E-9274F5DBA1DF}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catutil.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catutil.exe | 
"TCP Query User{3BC178A9-63C9-4EE1-BE33-FE108054C401}C:\program files (x86)\icq7.0\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.0\icq.exe | 
"TCP Query User{42955380-0D5B-496E-88C1-5BDF1B2AE51B}C:\program files\bohemia interactive\arma demo\armademo.exe" = protocol=6 | dir=in | app=c:\program files\bohemia interactive\arma demo\armademo.exe | 
"TCP Query User{45B8C68B-1C4F-405C-9921-B1DFF31AF7DD}C:\program files\bohemia interactive\arma 2\arma2.exe" = protocol=6 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2.exe | 
"TCP Query User{479AF775-02BB-4D67-AC4D-E38EFEC62581}C:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe | 
"TCP Query User{4E7C578F-E6D6-4959-AED1-BD1A4C32F43F}C:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhd.exe" = protocol=6 | dir=in | app=c:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhd.exe | 
"TCP Query User{631FB4AB-2808-4652-8A88-BB9A63BE0640}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{AA619760-570C-45D4-997C-8915CAEB7568}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe | 
"TCP Query User{BD1714F1-5D91-43A3-88A6-A00182BDC2CE}C:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe | 
"TCP Query User{C4D7BB15-991A-420A-BDE6-0334099701FA}C:\program files (x86)\icq7.0\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.0\icq.exe | 
"TCP Query User{D2D73D6A-97BD-4AAF-B193-E19ED5DD14DA}C:\program files (x86)\pokerstrategy.com\pokerstrategy.com equilator\equilator.exe" = protocol=6 | dir=in | app=c:\program files (x86)\pokerstrategy.com\pokerstrategy.com equilator\equilator.exe | 
"TCP Query User{E608D09D-E1DF-4894-B85F-D20B873FB5D4}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\cnext.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\cnext.exe | 
"TCP Query User{E9FFFE7C-C3FE-4275-B263-14EF82DC957A}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\orbixd.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\orbixd.exe | 
"TCP Query User{F4D5892B-377F-4D02-9C0F-1F260FB9B8AB}C:\program files (x86)\ea games\command & conquer die ersten 10 jahre\command & conquer(tm) generals zero hour\game.dat" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\command & conquer die ersten 10 jahre\command & conquer(tm) generals zero hour\game.dat | 
"UDP Query User{0370D868-1279-4CB9-A980-6A822884FF0D}C:\program files (x86)\icq7.0\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.0\icq.exe | 
"UDP Query User{2C888E98-7A2F-421D-A1AB-310EF3DBE091}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{2FAAA548-A0BE-4FC8-A3C8-DF1AC83802AB}C:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhdlc.exe" = protocol=17 | dir=in | app=c:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhdlc.exe | 
"UDP Query User{35B8BC24-611D-45EF-96BE-304CFE3DAB26}C:\program files (x86)\icq7.0\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.0\icq.exe | 
"UDP Query User{3B716BAB-FC13-4435-A0F1-B880E977C850}C:\program files (x86)\pokerstrategy.com\pokerstrategy.com equilator\equilator.exe" = protocol=17 | dir=in | app=c:\program files (x86)\pokerstrategy.com\pokerstrategy.com equilator\equilator.exe | 
"UDP Query User{487BC037-3FD3-485B-AD9C-A675A64199EA}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catutil.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catutil.exe | 
"UDP Query User{6B45FA83-B8FC-43F1-A4B6-8638C3E4590B}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\catsysdemon.exe | 
"UDP Query User{6D2C2CB0-8D90-49A0-B35D-A85DFD49F3F2}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\cnext.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\cnext.exe | 
"UDP Query User{79648D2B-5E21-47A0-B33F-C8EED94AF06C}C:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhd.exe" = protocol=17 | dir=in | app=c:\users\windows\desktop\neuer ordner\delta force black hawk down\dfbhd.exe | 
"UDP Query User{89AB545A-45B2-4E09-A95B-A6A2DC12DF4D}C:\program files (x86)\ea games\command & conquer die ersten 10 jahre\command & conquer(tm) generals zero hour\game.dat" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\command & conquer die ersten 10 jahre\command & conquer(tm) generals zero hour\game.dat | 
"UDP Query User{D4AB077D-4856-47D7-8238-F9707FB7C16D}C:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe | 
"UDP Query User{DA7B3C67-E065-4BF4-8D88-7E294733C1ED}C:\program files\bohemia interactive\arma demo\armademo.exe" = protocol=17 | dir=in | app=c:\program files\bohemia interactive\arma demo\armademo.exe | 
"UDP Query User{DBE3EF87-C543-4BDE-822F-C7B5B56B175E}C:\program files (x86)\dassault systemes\b19\intel_a\code\bin\orbixd.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dassault systemes\b19\intel_a\code\bin\orbixd.exe | 
"UDP Query User{E683A843-44ED-41B0-B0CC-55281C43B58F}C:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\windows\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{FE6EF2A1-3A4F-45D2-96FB-59DCC4705456}C:\program files\bohemia interactive\arma 2\arma2.exe" = protocol=17 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.1.0.2200
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{26A24AE4-039D-4CA4-87B4-2F86416018FF}" = Java(TM) 6 Update 18 (64-bit)
"{2D5D9603-22CF-4B99-83F6-0CD20330F62E}" = FRITZ!DSL64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{CF1EB598-B424-436A-B15F-B763846BA970}" = Dassault Systemes Software Prerequisites x86-x64
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D285FC5F-3021-32E9-9C59-24CA325BDC5C}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Dassault Systemes B19_0" = Dassault Systemes Software B19
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{02A10468-2F1C-447C-AD8E-4DEDDEA25AE2}" = Medieval II Total War : Kingdoms : Crusades
"{045A9539-37B6-464D-94F9-E4ADFA856903}" = PokerStrategy.com Equilator
"{0B82D6C6-9ECC-4710-97AB-5CE482E72852}_is1" = TableScan Turbo v0.47b (BETA)
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23BDF7D8-C353-4BA8-8567-814F91332CEA}" = Wireless Switch 2
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{33A22B2D-55BA-4508-B767-BF2E9C21A73F}" = Assassin's Creed Revelations 1.03
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{419043F8-9CA0-4038-8939-E345EC4915DC}" = EzRemote
"{44D66AD9-AE19-4AFD-BE7E-A1B44C856697}" = MSXML4.0 redistributable
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CFFAEC0-1F2A-4D38-8D95-3995A936ADD9}" = NetWorkingWizard_ICM
"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{65FBA21B-7F80-4E4E-B275-0958D2648F94}_is1" = Java-Editor 9.19b, 2010.01.31
"{66D6F3BD-CA23-41A4-9FA3-96B26B32528D}" = Command & Conquer Die ersten 10 Jahre
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73D7F26F-A650-49F3-9928-AD204673797C}" = Green Charger2
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{75983B66-804C-40D1-BA13-64DAF652A6F1}" = Medieval II Total War : Kingdoms : Americas
"{7AEE1963-7001-4C37-BC20-2FAEB74AA41C}" = Medieval II Total War : Kingdoms : Teutonic
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{9366DD3C-3DCB-431B-BE4A-45D7E4BD4D2A}" = Program DJ3
"{9428A68A-9B43-473D-9771-FDA1D15B4C0D}" = VITAKEY
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A47A9101-6EB5-4314-BDA1-297880FBB908}" = Microsoft redistributable runtime DLLs VS2008 SP1(x86)
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{AED06A3C-2AA7-4418-89E7-94352385DCDC}" = Tropico 4 Demo
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B823632F-3B72-4514-8861-B961CE263224}" = PostgreSQL 8.3
"{BD8A0C60-1AEB-11D6-B8E1-00025521AE60}" = VBA (3821b)
"{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood
"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War
"{CADD1D0D-A26B-464E-A0F2-FC1DB07CC04E}" = EzTube
"{CB09F557-4821-46D0-BF86-8D1389AA6BC7}" = Tabellenbuch Metall digital
"{CEC7A786-A9C8-4EF7-BB59-6518E3B3C878}" = vcredist_x86
"{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}" = Medieval II Total War : Kingdoms : Britannia
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2F506E1-047B-457C-9611-0D60F930BF5E}" = PokerStrategy.com Elephant
"{F408DA6B-DA75-4D95-B87D-49AFF0B4EBB0}" = Wow Video&Audio utility
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FEF06E73-A519-4510-8CF3-B66041B91D8A}" = EMSC
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Algebrator_is1" = Algebrator 4.0
"ArmA2" = ArmA2 Uninstall
"avast" = avast! Free Antivirus
"AVG Secure Search" = AVG Security Toolbar
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"BattlEye" = BattlEye Uninstall
"Betfair Poker JPC_is1" = Betfair Poker JPC 1.0.0
"CamStudio" = CamStudio
"DAEMON Tools Lite" = DAEMON Tools Lite
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"FLV Player" = FLV Player 2.0 (build 25)
"HoldemManager2" = Holdem Manager 2
"InstallShield_{045A9539-37B6-464D-94F9-E4ADFA856903}" = PokerStrategy.com Equilator
"InstallShield_{23BDF7D8-C353-4BA8-8567-814F91332CEA}" = Wireless Switch 2
"InstallShield_{419043F8-9CA0-4038-8939-E345EC4915DC}" = EzRemote
"InstallShield_{73D7F26F-A650-49F3-9928-AD204673797C}" = Green Charger2
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{9366DD3C-3DCB-431B-BE4A-45D7E4BD4D2A}" = Program DJ3
"InstallShield_{9428A68A-9B43-473D-9771-FDA1D15B4C0D}" = VITAKEY
"InstallShield_{CADD1D0D-A26B-464E-A0F2-FC1DB07CC04E}" = EzTube
"InstallShield_{F408DA6B-DA75-4D95-B87D-49AFF0B4EBB0}" = Wow Video&Audio utility
"KaloMa_is1" = KaloMa 4.92
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"OpenVPN" = OpenVPN 2.1.1
"PartyPoker" = PartyPoker
"PokerStars" = PokerStars
"PROHYBRIDR" = 2007 Microsoft Office system
"PunkBusterSvc" = PunkBuster Services
"SAP_ECL" = ECL Viewer
"SAP_JNet" = SAP JNet
"SAP_WUS" = SAPSetup Automatic Workstation Update Service
"SAPBI" = SAP Business Explorer
"SAPGUI710" = SAP GUI for Windows 7.20
"Teachmaster 4.0" = Teachmaster 4.0 (nur Entfernen)
"Vocup_is1" = Vocup 1.4.2
"ZhornStickies" = Stickies 7.1a
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"Titan Poker" = Titan Poker
"Tropico 4" = Tropico 4 1.00
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 25.06.2012 14:16:51 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: McCHSvc.exe, Version: 3.0.207.0, 
Zeitstempel: 0x4dfb634d  Name des fehlerhaften Moduls: mcscan32.dll, Version: 5.400.0.1158,
 Zeitstempel: 0x4a705d78  Ausnahmecode: 0xc0000005  Fehleroffset: 0x002800f8  ID des fehlerhaften
 Prozesses: 0x1278  Startzeit der fehlerhaften Anwendung: 0x01cd52fead1b4f1f  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe
Pfad
 des fehlerhaften Moduls: C:\Program Files (x86)\McAfee Security Scan\3.0.207\mcscan32.dll
Berichtskennung:
 eef5c483-bef1-11e1-bb4e-00262260a35b
 
Error - 17.07.2012 04:39:06 | Computer Name = laptop | Source = .NET Runtime | ID = 1026
Description = 
 
Error - 17.07.2012 04:39:09 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: HoldemManager.exe, Version: 2.0.0.6556,
 Zeitstempel: 0x4f75e3b5  Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.17651,
 Zeitstempel: 0x4e21213c  Ausnahmecode: 0xe0434352  Fehleroffset: 0x000000000000cacd
ID
 des fehlerhaften Prozesses: 0x8c8  Startzeit der fehlerhaften Anwendung: 0x01cd63f77e4e6225
Pfad
 der fehlerhaften Anwendung: C:\Program Files (x86)\Holdem Manager 2\HoldemManager.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\system32\KERNELBASE.dll  Berichtskennung: dfecb498-cfea-11e1-ba58-00262260a35b
 
Error - 19.07.2012 12:42:54 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
 0x4ffecafb  Name des fehlerhaften Moduls: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
 0x4ffecafb  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001cd2b2  ID des fehlerhaften Prozesses:
 0xea8  Startzeit der fehlerhaften Anwendung: 0x01cd65a92c272289  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe  Pfad des
 fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe
Berichtskennung:
 c914c7b9-d1c0-11e1-8fb9-00262260a35b
 
Error - 19.07.2012 16:36:18 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
 0x4ffecafb  Name des fehlerhaften Moduls: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
 0x4ffecafb  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001cd2b2  ID des fehlerhaften Prozesses:
 0xcf4  Startzeit der fehlerhaften Anwendung: 0x01cd65d2fd2b0ed5  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe  Pfad des
 fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe
Berichtskennung:
 643db2ea-d1e1-11e1-bac3-00262260a35b
 
Error - 21.07.2012 10:51:12 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
 0x4ffecafb  Name des fehlerhaften Moduls: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
 0x4ffecafb  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001cd2b2  ID des fehlerhaften Prozesses:
 0x674  Startzeit der fehlerhaften Anwendung: 0x01cd67267425fc6a  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe  Pfad des
 fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe
Berichtskennung:
 835073d1-d343-11e1-b282-00262260a35b
 
Error - 21.07.2012 13:39:00 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: ACRSP.exe, Version: 0.0.0.0, Zeitstempel:
 0x4f3a78e5  Name des fehlerhaften Moduls: ACRSP.exe, Version: 0.0.0.0, Zeitstempel:
 0x4f3a78e5  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00438154  ID des fehlerhaften Prozesses:
 0xfa0  Startzeit der fehlerhaften Anwendung: 0x01cd675d2baf92a2  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Ubisoft\Assassin's Creed Revelations\ACRSP.exe
Pfad
 des fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Assassin's Creed Revelations\ACRSP.exe
Berichtskennung:
 f41d5a7f-d35a-11e1-b282-00262260a35b
 
Error - 22.07.2012 06:09:08 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: ACRSP.exe, Version: 0.0.0.0, Zeitstempel:
 0x4f3a78e5  Name des fehlerhaften Moduls: ACRSP.exe, Version: 0.0.0.0, Zeitstempel:
 0x4f3a78e5  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00438154  ID des fehlerhaften Prozesses:
 0x2f0  Startzeit der fehlerhaften Anwendung: 0x01cd67f19a2beba9  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Ubisoft\Assassin's Creed Revelations\ACRSP.exe
Pfad
 des fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Assassin's Creed Revelations\ACRSP.exe
Berichtskennung:
 45d391ae-d3e5-11e1-8783-00262260a35b
 
Error - 07.08.2012 16:06:12 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
 0x50167691  Name des fehlerhaften Moduls: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
 0x50167691  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001cd2b2  ID des fehlerhaften Prozesses:
 0x1388  Startzeit der fehlerhaften Anwendung: 0x01cd747d207338a5  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe  Pfad des
 fehlerhaften Moduls: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe
Berichtskennung:
 55775a10-e0cb-11e1-bad3-00262260a35b
 
Error - 22.08.2012 10:33:05 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
 0x50167691  Name des fehlerhaften Moduls: npuplaypchub.dll_unloaded, Version: 0.0.0.0,
 Zeitstempel: 0x50167629  Ausnahmecode: 0xc0000005  Fehleroffset: 0x74455450  ID des fehlerhaften
 Prozesses: 0xbc0  Startzeit der fehlerhaften Anwendung: 0x01cd8072b056f43f  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe
Pfad
 des fehlerhaften Moduls: npuplaypchub.dll  Berichtskennung: 488c8063-ec66-11e1-bad0-00262260a35b
 
Error - 22.08.2012 10:33:54 | Computer Name = laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel:
 0x50167691  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel:
 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0002ff27  ID des fehlerhaften Prozesses:
 0xbc0  Startzeit der fehlerhaften Anwendung: 0x01cd8072b056f43f  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe  Pfad des
 fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: 65cfab01-ec66-11e1-bad0-00262260a35b
 
[ System Events ]
Error - 22.08.2012 08:09:00 | Computer Name = laptop | Source = ACPI | ID = 327693
Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen
 Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware
 hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie 
den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen
 Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 
Error - 22.08.2012 09:57:34 | Computer Name = laptop | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 22.08.2012 14:21:21 | Computer Name = laptop | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 22.08.2012 15:28:34 | Computer Name = laptop | Source = ACPI | ID = 327693
Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen
 Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware
 hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie 
den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen
 Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 
Error - 22.08.2012 15:28:39 | Computer Name = laptop | Source = ACPI | ID = 327693
Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen
 Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware
 hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie 
den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen
 Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 
Error - 23.08.2012 05:55:40 | Computer Name = laptop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 23.08.2012 05:55:40 | Computer Name = laptop | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 23.08.2012 06:07:58 | Computer Name = laptop | Source = ACPI | ID = 327693
Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen
 Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware
 hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie 
den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen
 Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 
Error - 23.08.2012 08:34:50 | Computer Name = laptop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 23.08.2012 08:34:50 | Computer Name = laptop | Source = atikmdag | ID = 43029
Description = Display is not active
 
 
< End of report >
         

Alt 24.08.2012, 03:32   #2
t'john
/// Helfer-Team
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?





Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
ATTFilter
:OTL
MOD - C:\Users\Windows\AppData\Local\Temp\bd7c47bb-f5c0-417c-a180-ec348d87718a\CliSecureRT.dll () 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=10.2.0.3&sap=hp 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\URLSearchHook: - No CLSID value found 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=10.2.0.3&sap=dsp&q={searchTerms} 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = http://www.bigseekpro.com/search/browser/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10}?q={searchTerms} 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - No CLSID value found 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" 
FF - prefs.js..browser.search.selectedEngine: "Google" 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "www.google.de" 
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3 
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 
FF - prefs.js..extensions.enabledItems: info@youtube-mp3.org:1.0.2 
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49&sap=ku&q=" 
FF - prefs.js..network.proxy.autoconfig_url: "chrome://viewtubes/content/viewtubes_false.pac" 
FF - prefs.js..network.proxy.type: 2 
FF - user.js - File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_233.dll File not found 
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012.07.09 22:48:41 | 000,000,000 | ---D | M] 
CHR - homepage: http://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49 
CHR - default_search_provider: search_url = http://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=&lang=&ds=&pr=&d=&v=&sap=dsp&q={searchTerms} 
O3 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found. 
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - HKU\S-1-5-21-1545989608-3791393258-1579190891-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - Startup: C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk = C:\Users\Windows\AppData\Roaming\Microsoft\Installer\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}\Icon8CF9C550.exe () 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found 
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found 
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found 
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found 
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe () 
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe () 
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) 
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) 
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) 
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O33 - MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\Shell - "" = AutoRun 
O33 - MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\Shell\AutoRun\command - "" = E:\ICM_ML.exe 
[3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] 
 
[2012.06.04 11:20:15 | 000,000,853 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\11-suche.xml 
[2012.06.04 11:20:15 | 000,002,209 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\englische-ergebnisse.xml 
[2012.06.04 11:20:15 | 000,010,506 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\gmx-suche.xml 
[2012.06.04 11:20:15 | 000,002,368 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\lastminute.xml 
[2012.06.04 11:20:15 | 000,005,489 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\webde-suche.xml 
[2011.04.29 10:42:42 | 000,002,382 | ---- | M] () -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\search.xml 
[2012.06.09 10:15:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml 
[2012.06.09 10:15:29 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml 
[2012.06.09 10:15:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml 
[2012.06.09 10:15:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml 
[2012.06.09 10:15:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml 
[2012.06.09 10:15:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml 
[2012.07.09 22:48:36 | 000,003,769 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml 

[2012.03.28 22:11:08 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe 
[2010.03.10 19:43:21 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat 
:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________

__________________

Alt 24.08.2012, 15:10   #3
atze2809
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?



danke schonmal im vorraus
pc hat sich ein paar mal aufgehängt, hoffe das ist egal - otl hat ja was ausgegeben.

Code:
ATTFilter
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\ not found.
HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry key HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}\ not found.
HKU\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\{CA3EB689-8F09-4026-AA10-B9534C691CE0} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\ not found.
Prefs.js: "AVG Secure Search" removed from browser.search.defaultenginename
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "www.google.de" removed from browser.startup.homepage
Prefs.js: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3 removed from extensions.enabledItems
Prefs.js: youtube2mp3@mondayx.de:1.0.7 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems
Prefs.js: info@youtube-mp3.org:1.0.2 removed from extensions.enabledItems
Prefs.js: "hxxp://isearch.avg.com/search?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&ds=od011&v=10.2.0.3&lang=de&pr=sa&d=2012-03-27%2020%3A41%3A49&sap=ku&q=" removed from keyword.URL
Prefs.js: "chrome://viewtubes/content/viewtubes_false.pac" removed from network.proxy.autoconfig_url
Prefs.js: 2 removed from network.proxy.type
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0\ not found.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar not found.
File C:\ProgramData\AVG Secure Search\11.1.0.12\ not found.
Use Chrome's Settings page to change the HomePage.
Use Chrome's Settings page to remove the default_search_provider items.
Registry value HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DivXUpdate not found.
File C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
Registry value HKEY_USERS\S-1-5-21-1545989608-3791393258-1579190891-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
File move failed. C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk scheduled to be moved on reboot.
File C:\Users\Windows\AppData\Roaming\Microsoft\Installer\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}\Icon8CF9C550.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
File C:\Programs\PartyGaming\PartyPoker\RunApp.exe not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
File C:\Programs\PartyGaming\PartyPoker\RunApp.exe not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{935fcef5-08f8-11e0-99b9-00262260a35b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{935fcef5-08f8-11e0-99b9-00262260a35b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{935fcef5-08f8-11e0-99b9-00262260a35b}\ not found.
File E:\ICM_ML.exe not found.
File/Folder C:\Windows\SysWow64\*.tmp not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\11-suche.xml not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\englische-ergebnisse.xml not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\gmx-suche.xml not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\lastminute.xml not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\webde-suche.xml not found.
File C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\searchplugins\search.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml not found.
File C:\Windows\MusiccityDownload.exe not found.
File C:\ProgramData\ezsidmv.dat not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Windows\Desktop\cmd.bat deleted successfully.
C:\Users\Windows\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: elephant
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: Windows
->Temp folder emptied: 315975 bytes
->Temporary Internet Files folder emptied: 34698 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 23713977 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 456 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 15320 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 49554 bytes
RecycleBin emptied: 5854278965 bytes
 
Total Files Cleaned = 5.606,00 mb
 
 
OTL by OldTimer - Version 3.2.58.1 log created on 08242012_150234

Files\Folders moved on Reboot...
File\Folder C:\Users\Windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk not found!
C:\Users\Windows\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         
__________________

Alt 24.08.2012, 15:58   #4
t'john
/// Helfer-Team
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?



Du hast den Fix mehrmals ausgefuehrt?



1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.
__________________
Mfg, t'john
Das TB unterstützen

Alt 24.08.2012, 22:28   #5
atze2809
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?



ja, habe den fix mehrmals ausgeführt

malwarebytes:

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.24.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Windows :: LAPTOP [Administrator]

Schutz: Deaktiviert

24.08.2012 18:55:04
mbam-log-2012-08-24 (18-55-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 561698
Laufzeit: 1 Stunde(n), 37 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

adwcleaner:

Code:
ATTFilter
# AdwCleaner v1.801 - Logfile created 08/24/2012 at 22:26:38
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Windows - LAPTOP
# Boot Mode : Normal
# Running from : C:\Users\Windows\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****

Found : vToolbarUpdater11.2.0

***** [Files / Folders] *****

Folder Found : C:\Users\Windows\AppData\Local\AVG Secure Search
Folder Found : C:\Users\Windows\AppData\LocalLow\AVG Secure Search
Folder Found : C:\Users\Windows\AppData\LocalLow\Toolbar4
Folder Found : C:\Users\Windows\AppData\Roaming\OpenCandy
Folder Found : C:\Users\Windows\AppData\Roaming\pdfforge
Folder Found : C:\ProgramData\AVG Secure Search
Folder Found : C:\Program Files (x86)\AVG Secure Search
Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search

***** [Registry] *****

Key Found : HKCU\Software\AVG Secure Search
Key Found : HKCU\Software\IGearSettings
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\AVG Secure Search
Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Found : HKLM\SOFTWARE\Classes\S
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
[x64] Key Found : HKCU\Software\AVG Secure Search
[x64] Key Found : HKCU\Software\IGearSettings
[x64] Key Found : HKCU\Software\Softonic
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
[x64] Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
[x64] Key Found : HKLM\SOFTWARE\Classes\S
[x64] Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
[x64] Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
[x64] Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
[x64] Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.bigseekpro.com/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10}
[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=11.1.0.12&sap=nt

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\prefs.js

Found : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\10.2.0.3");

-\\ Google Chrome v21.0.1180.83

File : C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found :       "homepage": "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66[...]
Found :          "urls_to_restore_on_startup": [ "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5[...]
Found :       "icon_url": "hxxp://isearch.avg.com/favicon.ico",
Found :       "keyword": "isearch.avg.com",
Found :       "name": "AVG Secure Search",
Found :       "search_url": "hxxp://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=&l[...]
Found :    "homepage": "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae[...]
Found :       "urls_to_restore_on_startup": [ "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb2[...]

*************************

AdwCleaner[R1].txt - [7901 octets] - [24/08/2012 22:26:38]

########## EOF - C:\AdwCleaner[R1].txt - [8029 octets] ##########
         


Alt 25.08.2012, 00:07   #6
t'john
/// Helfer-Team
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?



Sehr gut!


  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.




danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
--> email link angeklickt - ist PC jetzt infiziert?

Alt 25.08.2012, 14:04   #7
atze2809
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?



adwcleaner

Code:
ATTFilter
# AdwCleaner v1.801 - Logfile created 08/25/2012 at 11:29:29
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Windows - LAPTOP
# Boot Mode : Normal
# Running from : C:\Users\Windows\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : vToolbarUpdater11.2.0

***** [Files / Folders] *****

Folder Deleted : C:\Users\Windows\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Windows\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Windows\AppData\LocalLow\Toolbar4
Folder Deleted : C:\Users\Windows\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\Windows\AppData\Roaming\pdfforge
Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search

***** [Registry] *****

Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.bigseekpro.com/anyvideo2dvd/{114FF124-BB9F-4955-B8F2-1E11489AFF10} --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=aa5cd66eae4747d098eed16f64844aa8-a787358b3d2488035844da9db76e0a3bf1489a16&lang=de&ds=od011&pr=sa&d=2012-03-27 20:41:49&v=11.1.0.12&sap=nt --> hxxp://www.google.com

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\4ddcnqn9.default\prefs.js

Deleted : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\10.2.0.3");

-\\ Google Chrome v21.0.1180.83

File : C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted :       "homepage": "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66[...]
Deleted :          "urls_to_restore_on_startup": [ "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5[...]
Deleted :       "icon_url": "hxxp://isearch.avg.com/favicon.ico",
Deleted :       "keyword": "isearch.avg.com",
Deleted :       "name": "AVG Secure Search",
Deleted :       "search_url": "hxxp://isearch.avg.com/search?cid={BD2569D7-E93E-4D61-82B1-31CFC871DFCB}&mid=&l[...]
Deleted :    "homepage": "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb29fd64%7D&mid=aa5cd66eae[...]
Deleted :       "urls_to_restore_on_startup": [ "hxxp://isearch.avg.com?cid=%7B8437cb3e-3a8b-4af9-8839-07c5cb2[...]

*************************

AdwCleaner[R1].txt - [7976 octets] - [24/08/2012 22:26:38]
AdwCleaner[S1].txt - [6519 octets] - [25/08/2012 11:29:29]

########## EOF - C:\AdwCleaner[S1].txt - [6647 octets] ##########
         
emsisoft

Code:
ATTFilter
Emsisoft Anti-Malware - Version 6.6
Letztes Update: 25.08.2012 11:46:28

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	25.08.2012 11:46:57

c:\users\windows\appdata\roaming\microsoft\windows\start menu\programs\partypoker 	gefunden: Trace.File.partypoker!E1
c:\poker\titan poker 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\buttons 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\dialogs 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\login 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\buttons 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\history 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\sidegames 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\history\cards 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\sounds 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\anim 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\waitinglist 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\emoticons 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\buttons 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\dialogs 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\history 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\cards 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\tables 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat\chat_bottom 	gefunden: Trace.File.titan poker!E1
c:\poker 	gefunden: Trace.File.club dice poker!E1
c:\users\windows\appdata\roaming\microsoft\internet explorer\quick launch\partypoker.lnk 	gefunden: Trace.File.partypoker!E1
c:\users\windows\appdata\roaming\microsoft\internet explorer\quick launch\titan poker.lnk 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\casino.hlp 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\casino.ico 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\cactivex.dll 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack.dll 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack.gam 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\cashier.gam 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\casino.exe 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\common.gam 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\common.dll 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\cashier.dll 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\loader.dll 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\loader.gam 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_common.gam 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_common.dll 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline.css 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_table.dll 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_lobby.dll 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline.js 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline_functions.js 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline_poker.html 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\chat.html 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\colors.html 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\edit.html 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_lobby.gam 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\emoticons.html 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\cards\card.lwo 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins\coins-alpha.bmp 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins\coins.bmp 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat\chat.html 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\directsounddriver.dll 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\fileinfo2r.dat 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\fileinfo2.dat 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\ptsetup.lang 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\gdigraphdriver.dll 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\data\topview.gam 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\ptsetup.log 	gefunden: Trace.File.titan poker!E1
c:\poker\titan poker\replace.exe 	gefunden: Trace.File.titan poker!E1
Key: hkey_current_user\software\ptech 	gefunden: Trace.Registry.e2give(charitynetwork)!E1
Value: hkey_current_user\software\partygaming\partypoker --> 1 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 2 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 4 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 5 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 6 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 7 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 10 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 9 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> adslastknownstate 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> apppath 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> fourcolourdeck 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> initialport 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> installstate 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> mucklosinghand 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> sl 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> tabletype 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> id 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> usecount 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> autologintoothergames 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> cfdialogshown 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> oldcfformat 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> freshinstall 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayname 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayversion 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installdate 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installlocation 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installsource 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installsourcefile 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> publisher 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> silentsettings 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> uninstallstring 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayicon 	gefunden: Trace.Registry.partypoker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> table_minplayers 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> table_playmode 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_6players 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_beginner 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_buyin 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_gametype 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_headsup 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_scheduled 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_sitngo 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_startin 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> global_login_hint 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> lobby_favouritegames 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_dealervoices 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_music 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_avatar_num 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_empty 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_finished 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_full 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_inprogress 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_showsidegames 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_smallview 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_sounds 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_xlslots 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options-fullscreen 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options-volume 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_12players 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> poker_nickname 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> ptdevm 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> table_realmode 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortby_second 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortorder_first 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortorder_second 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> tribeca_playernotes 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> username 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortby_first 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_10players 	gefunden: Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> poker_login_type 	gefunden: Trace.Registry.titan poker!E1

Gescannt	834703
Gefunden	140

Scan Ende:	25.08.2012 13:13:18
Scan Zeit:	1:26:21

Value: hkey_current_user\software\titan poker\quicksearch --> table_minplayers	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> table_playmode	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_6players	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_beginner	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_buyin	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_gametype	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_headsup	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_scheduled	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_sitngo	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_startin	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> global_login_hint	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> lobby_favouritegames	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_dealervoices	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_music	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_avatar_num	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_empty	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_finished	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_full	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_filter_inprogress	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_showsidegames	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_poker_smallview	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_sounds	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options_xlslots	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options-fullscreen	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> options-volume	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_12players	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> poker_nickname	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> ptdevm	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> table_realmode	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortby_second	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortorder_first	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortorder_second	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> tribeca_playernotes	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> username	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> selected_node_sortby_first	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker\quicksearch --> tour_10players	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\titan poker --> poker_login_type	Quarantäne Trace.Registry.titan poker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 1	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 2	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 4	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 5	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 6	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 7	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 10	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> 9	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> adslastknownstate	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> apppath	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> fourcolourdeck	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> initialport	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> installstate	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> mucklosinghand	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> sl	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> tabletype	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> id	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming\partypoker --> usecount	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> autologintoothergames	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> cfdialogshown	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> oldcfformat	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_current_user\software\partygaming --> freshinstall	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayname	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayversion	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installdate	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installlocation	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installsource	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> installsourcefile	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> publisher	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> silentsettings	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> uninstallstring	Quarantäne Trace.Registry.partypoker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\partypoker --> displayicon	Quarantäne Trace.Registry.partypoker!E1
Key: hkey_current_user\software\ptech	Quarantäne Trace.Registry.e2give(charitynetwork)!E1
c:\poker\titan poker	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\buttons	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\dialogs	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\login	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\buttons	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\history	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\sidegames	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\history\cards	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\sounds	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\anim	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\waitinglist	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\emoticons	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\buttons	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\dialogs	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\history	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\cards	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\lobby\tables	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat\chat_bottom	Quarantäne Trace.File.titan poker!E1
c:\users\windows\appdata\roaming\microsoft\internet explorer\quick launch\titan poker.lnk	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\casino.hlp	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\casino.ico	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\cactivex.dll	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack.dll	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\blackjack.gam	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\cashier.gam	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\casino.exe	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\common.gam	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\common.dll	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\cashier.dll	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\loader.dll	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\loader.gam	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_common.gam	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_common.dll	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline.css	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_table.dll	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_lobby.dll	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline.js	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline_functions.js	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\cashier_offline_poker.html	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\chat.html	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\colors.html	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\edit.html	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\poker_lobby.gam	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\shared\html\chat\emoticons.html	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\cards\card.lwo	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins\coins-alpha.bmp	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\coins\coins.bmp	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\table\topview\chat\chat.html	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\directsounddriver.dll	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\fileinfo2r.dat	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\fileinfo2.dat	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\ptsetup.lang	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\gdigraphdriver.dll	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\data\topview.gam	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\ptsetup.log	Quarantäne Trace.File.titan poker!E1
c:\poker\titan poker\replace.exe	Quarantäne Trace.File.titan poker!E1
c:\users\windows\appdata\roaming\microsoft\windows\start menu\programs\partypoker	Quarantäne Trace.File.partypoker!E1
c:\users\windows\appdata\roaming\microsoft\internet explorer\quick launch\partypoker.lnk	Quarantäne Trace.File.partypoker!E1
c:\poker	Quarantäne Trace.File.club dice poker!E1

Quarantäne	140
         

Alt 25.08.2012, 18:35   #8
t'john
/// Helfer-Team
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?



Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
__________________
Mfg, t'john
Das TB unterstützen

Alt 26.08.2012, 14:46   #9
atze2809
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?



Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=7079e18fc3fbe04f92519d1736e1f100
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-25 06:14:14
# local_time=2012-08-25 08:14:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=770 16774141 100 97 5621909 122625598 0 0
# compatibility_mode=5893 16776573 100 94 15729 97545574 0 0
# compatibility_mode=8192 67108863 100 0 280 280 0 0
# scanned=172862
# found=0
# cleaned=0
# scan_time=2730
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=7079e18fc3fbe04f92519d1736e1f100
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-26 12:38:21
# local_time=2012-08-26 02:38:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=770 16774141 100 97 5677632 122684921 0 0
# compatibility_mode=5893 16776573 100 94 52899 97604897 0 0
# compatibility_mode=8192 67108863 100 0 59603 59603 0 0
# scanned=354633
# found=3
# cleaned=3
# scan_time=9655
C:\Users\Windows\Downloads\Programme\SoftonicDownloader_fuer_vocup.exe	a variant of Win32/SoftonicDownloader.A application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Users\Windows\Downloads\Programme\Topviewsoft_ScreenVideoCapture(2).exe	Win32/Somoto application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Users\Windows\Downloads\Programme\vlc-1.1.9-win32.exe	Win32/StartPage.OIE trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
         

Alt 27.08.2012, 03:03   #10
t'john
/// Helfer-Team
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?



Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 6 ) herunter laden.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.


Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck
__________________
Mfg, t'john
Das TB unterstützen

Alt 27.08.2012, 12:26   #11
atze2809
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?



PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

Firefox 14.0.1 ist aktuell

Flash (11,4,402,265) ist aktuell.

Java (1,7,0,6) ist aktuell.

Adobe Reader 10,1,4,38 ist aktuell.

Alt 27.08.2012, 19:23   #12
t'john
/// Helfer-Team
 
email link angeklickt - ist PC jetzt infiziert? - Standard

email link angeklickt - ist PC jetzt infiziert?



Sehr gut!

damit bist Du sauber und entlassen!

adwCleaner entfernen

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Uninstall.
  • Bestätige mit Ja.




Tool-Bereinigung mit OTL


Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
  • Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
  • Speichere es auf Deinem Desktop.
  • Doppelklick auf OTL.exe um das Programm auszuführen.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Klicke auf den Button "Bereinigung"
  • OTL fragt eventuell nach einem Neustart.
    Sollte es dies tun, so lasse dies bitte zu.
Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.


Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html


Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.


Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

  • Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
  • temporäre Dateien löschen.




Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
PC wird immer langsamer - was tun?
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu email link angeklickt - ist PC jetzt infiziert?
angeklickt, angst, avg secure search, avg security toolbar, bekannte, black, eingefangen, email, forum, gefangen, gefunde, geklickt, gepostet, infiziert, infiziert?, install.exe, intranet, irgend, langs, laufe, link, link angeklickt, malwarebytes, microsoft office 2003, natürlich, nichts, ntdll.dll, orange, problem, scan, scanner, secure search, speziell, thread, vcredist, vtoolbarupdater, werbung



Ähnliche Themen: email link angeklickt - ist PC jetzt infiziert?


  1. Hab leider einen Link in einer Email angeklickt
    Plagegeister aller Art und deren Bekämpfung - 17.08.2015 (9)
  2. DHL Paketankündigung fake email - leider versehentlich den Sendungsstatus link angeklickt - Infiziert?
    Plagegeister aller Art und deren Bekämpfung - 13.05.2015 (38)
  3. Link angeklickt DHL
    Plagegeister aller Art und deren Bekämpfung - 21.03.2015 (18)
  4. Windows 8.1, email von dhl mit Sendungsnummer angeklickt, hat sich jetzt ein Trojaner auf meinem PC versteckt?
    Plagegeister aller Art und deren Bekämpfung - 15.03.2015 (31)
  5. DHL Fake Email - Phishing Link leider angeklickt
    Plagegeister aller Art und deren Bekämpfung - 08.03.2015 (5)
  6. DHL Fake Email - Phishing Link leider angeklickt
    Plagegeister aller Art und deren Bekämpfung - 28.02.2015 (8)
  7. Link in verdächtiger Email angeklickt
    Plagegeister aller Art und deren Bekämpfung - 14.11.2014 (13)
  8. Link angeklickt der von einer gehackten EMail Adresse kam und auf dann auf Seite mit Werbung weitergeleitet
    Plagegeister aller Art und deren Bekämpfung - 15.09.2014 (9)
  9. Linux Ubuntu: Link in email angeklickt
    Plagegeister aller Art und deren Bekämpfung - 12.09.2014 (3)
  10. Email von einer Bekannten erhalten mit fragwürdigem Link, sie hat jedoch keine Email verschickt.
    Plagegeister aller Art und deren Bekämpfung - 11.07.2014 (3)
  11. Link in einer Vodafone Phishing Mail angeklick - ist der Rechner jetzt infiziert?
    Plagegeister aller Art und deren Bekämpfung - 22.05.2014 (3)
  12. Link in Email geklickt... getarnt als Telekom Email
    Plagegeister aller Art und deren Bekämpfung - 13.01.2014 (1)
  13. Link in Email angeklickt durch gehackten Mail account
    Log-Analyse und Auswertung - 14.04.2013 (26)
  14. Link in Email angeklickt. PC mit Malware infiziert?
    Log-Analyse und Auswertung - 10.11.2012 (8)
  15. Link in einer Email angeklickt! Ist mein Laptop jetzt infiziert?
    Plagegeister aller Art und deren Bekämpfung - 23.07.2012 (17)
  16. Link in eMail angeklickt: PC infiziert?
    Plagegeister aller Art und deren Bekämpfung - 15.07.2012 (5)
  17. Per ICQ geschickter Link, leider angeklickt. Jetzt Viren.(?)
    Log-Analyse und Auswertung - 22.02.2007 (8)

Zum Thema email link angeklickt - ist PC jetzt infiziert? - Hallo, ich habe eine email mit einem link von einem Bekannten bekommen und dummerweiße drauf geklickt. Es war irgend ne Werbung und jetzt hab ich natürlich Angst das ich mir - email link angeklickt - ist PC jetzt infiziert?...
Archiv
Du betrachtest: email link angeklickt - ist PC jetzt infiziert? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.