| |
| |||||||
Log-Analyse und Auswertung: Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
18.01.2013, 05:58
| #1 |
| |  Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 Hallo leider hat sich auf den Pc meines Freundes ein Virus geschlichen. Angeschlagen hat das Avira AntiVirus. Beim letzten Online Banking hat die Bank ihn schon von der Seite "geschmissen"... Ich hatte daraufhin alles durchlaufen lassen (AntiVir, CC Cleaner) und hab noch Spyware Terminator drauf gespielt und durchlaufen lassen. Es blieben immer diese beiden Dateien übrig, die sich nicht löschen lassen. Zu guter Letzt habe ich nun Malwarebytes runtergeladen und auch durchlaufen lassen, dort wurde aber nichts gefunden. Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.70.0.1100 www.malwarebytes.org Datenbank Version: v2013.01.17.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Andreas Dorn :: ANDREASDORN-PC [Administrator] Schutz: Aktiviert 17.01.2013 21:37:17 mbam-log-2013-01-17 (21-37-17).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 451537 Laufzeit: 1 Stunde(n), 55 Minute(n), 5 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter Avira Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 17. Januar 2013 20:07
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : ANDREASDORN-PC
Versionsinformationen:
BUILD.DAT : 13.0.0.2890 48567 Bytes 05.12.2012 17:11:00
AVSCAN.EXE : 13.6.0.402 639264 Bytes 11.12.2012 18:20:53
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 11.12.2012 18:20:53
LUKE.DLL : 13.6.0.400 67360 Bytes 11.12.2012 18:20:59
AVSCPLR.DLL : 13.6.0.402 93984 Bytes 10.12.2012 17:58:23
AVREG.DLL : 13.6.0.406 248096 Bytes 10.12.2012 17:58:23
avlode.dll : 13.6.1.402 428832 Bytes 10.12.2012 17:58:23
avlode.rdf : 13.0.0.26 7958 Bytes 10.12.2012 17:58:23
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 14:50:29
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 14:50:31
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 14:50:34
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 14:50:36
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 14:50:37
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 14:42:40
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 14:42:40
VBASE007.VDF : 7.11.50.230 3904512 Bytes 22.11.2012 17:54:28
VBASE008.VDF : 7.11.55.142 2214912 Bytes 03.01.2013 15:28:09
VBASE009.VDF : 7.11.55.143 2048 Bytes 03.01.2013 15:28:10
VBASE010.VDF : 7.11.55.144 2048 Bytes 03.01.2013 15:28:10
VBASE011.VDF : 7.11.55.145 2048 Bytes 03.01.2013 15:28:10
VBASE012.VDF : 7.11.55.146 2048 Bytes 03.01.2013 15:28:10
VBASE013.VDF : 7.11.55.196 260096 Bytes 04.01.2013 11:44:28
VBASE014.VDF : 7.11.56.23 206848 Bytes 07.01.2013 19:27:08
VBASE015.VDF : 7.11.56.83 186880 Bytes 08.01.2013 18:47:42
VBASE016.VDF : 7.11.56.145 135168 Bytes 09.01.2013 20:19:08
VBASE017.VDF : 7.11.56.211 139776 Bytes 11.01.2013 15:30:22
VBASE018.VDF : 7.11.57.11 153088 Bytes 13.01.2013 06:23:24
VBASE019.VDF : 7.11.57.75 165888 Bytes 15.01.2013 12:24:46
VBASE020.VDF : 7.11.57.163 190976 Bytes 17.01.2013 18:09:03
VBASE021.VDF : 7.11.57.164 2048 Bytes 17.01.2013 18:09:03
VBASE022.VDF : 7.11.57.165 2048 Bytes 17.01.2013 18:09:03
VBASE023.VDF : 7.11.57.166 2048 Bytes 17.01.2013 18:09:03
VBASE024.VDF : 7.11.57.167 2048 Bytes 17.01.2013 18:09:03
VBASE025.VDF : 7.11.57.168 2048 Bytes 17.01.2013 18:09:03
VBASE026.VDF : 7.11.57.169 2048 Bytes 17.01.2013 18:09:03
VBASE027.VDF : 7.11.57.170 2048 Bytes 17.01.2013 18:09:03
VBASE028.VDF : 7.11.57.171 2048 Bytes 17.01.2013 18:09:03
VBASE029.VDF : 7.11.57.172 2048 Bytes 17.01.2013 18:09:03
VBASE030.VDF : 7.11.57.173 2048 Bytes 17.01.2013 18:09:04
VBASE031.VDF : 7.11.57.180 48640 Bytes 17.01.2013 18:09:04
Engineversion : 8.2.10.232
AEVDF.DLL : 8.1.2.10 102772 Bytes 19.09.2012 14:42:55
AESCRIPT.DLL : 8.1.4.82 467323 Bytes 17.01.2013 18:09:04
AESCN.DLL : 8.1.10.0 131445 Bytes 13.12.2012 19:30:06
AESBX.DLL : 8.2.5.12 606578 Bytes 28.08.2012 16:58:06
AERDL.DLL : 8.2.0.88 643444 Bytes 10.01.2013 14:26:56
AEPACK.DLL : 8.3.1.2 819574 Bytes 20.12.2012 19:55:50
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 05.11.2012 17:17:30
AEHEUR.DLL : 8.1.4.174 5615991 Bytes 10.01.2013 14:26:56
AEHELP.DLL : 8.1.25.2 258423 Bytes 12.10.2012 15:52:32
AEGEN.DLL : 8.1.6.14 434548 Bytes 10.01.2013 14:26:54
AEEXP.DLL : 8.3.0.10 188789 Bytes 17.01.2013 18:09:04
AEEMU.DLL : 8.1.3.2 393587 Bytes 19.09.2012 14:42:55
AECORE.DLL : 8.1.30.0 201079 Bytes 13.12.2012 19:30:06
AEBB.DLL : 8.1.1.4 53619 Bytes 05.11.2012 17:17:29
AVWINLL.DLL : 13.4.0.163 25888 Bytes 19.09.2012 18:09:30
AVPREF.DLL : 13.4.0.360 50464 Bytes 11.12.2012 18:20:53
AVREP.DLL : 13.4.0.360 177952 Bytes 10.12.2012 17:58:23
AVARKT.DLL : 13.6.0.402 260384 Bytes 11.12.2012 18:20:52
AVEVTLOG.DLL : 13.6.0.400 167200 Bytes 11.12.2012 18:20:53
SQLITE3.DLL : 3.7.0.1 397088 Bytes 19.09.2012 18:17:40
AVSMTP.DLL : 13.4.0.163 62240 Bytes 19.09.2012 18:08:54
NETNT.DLL : 13.4.0.360 15648 Bytes 11.12.2012 18:20:59
RCIMAGE.DLL : 13.4.0.360 4780832 Bytes 11.12.2012 18:20:51
RCTEXT.DLL : 13.4.0.360 68384 Bytes 11.12.2012 18:20:51
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_50f6f28b\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: reparieren
Sekundäre Aktion......................: quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig
Abweichende Gefahrenkategorien........: +PCK,+SPR,
Beginn des Suchlaufs: Donnerstag, 17. Januar 2013 20:07
Der Registrierungseintrag <HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500> wurde erfolgreich entfernt.
Der Registrierungseintrag <HKEY_USERS\S-1-5-21-2134661548-759548437-1938560921-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500> wurde erfolgreich entfernt.
Der Registrierungseintrag <HKEY_USERS\S-1-5-21-2134661548-759548437-1938560921-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ucavymyzap> konnte nicht entfernt werden.
Der Registrierungseintrag <HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500> wurde erfolgreich repariert.
Der Registrierungseintrag <HKEY_USERS\S-1-5-21-2134661548-759548437-1938560921-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500> wurde erfolgreich repariert.
Der Registrierungseintrag <HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500> wurde erfolgreich repariert.
Der Registrierungseintrag <HKEY_USERS\S-1-5-21-2134661548-759548437-1938560921-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Biuzlyugpu> wurde erfolgreich entfernt.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '125' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '171' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'dsiwmis.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'ePowerSvc.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'GREGsvc.exe' - '15' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'IScheduleSvc.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'SchedulerSvc.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '191' Modul(e) wurden durchsucht
Durchsuche Prozess 'PnkBstrA.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'c2c_service.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'st_rsser64.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'UpdaterService.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorDataMgrSvc.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'ePowerTray.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'SpywareTerminatorShield.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'segis.exe' - '69' Modul(e) wurden durchsucht
Modul ist infiziert -> <C:\Users\Andreas Dorn\AppData\Roaming\Utefa\segis.exe>
[FUND] Ist das Trojanische Pferd TR/Spy.ZBot.2599874
[HINWEIS] Prozess 'segis.exe' wurde beendet
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3471e7e4.qua' verschoben!
Durchsuche Prozess 'lodo.exe' - '65' Modul(e) wurden durchsucht
Modul ist infiziert -> <C:\Users\Andreas Dorn\AppData\Roaming\Zawuna\lodo.exe>
[FUND] Ist das Trojanische Pferd TR/Spy.ZBot.EB.168
[HINWEIS] Prozess 'lodo.exe' wurde beendet
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4b69d58e.qua' verschoben!
Durchsuche Prozess 'unsecapp.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorIcon.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'BackupManagerTray.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'LManager.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'ePowerEvent.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'MMDx64Fx.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMworker.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPHelper.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '109' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '216' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '142' Modul(e) wurden durchsucht
Durchsuche Prozess 'SpywareTerminatorUpdate.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '108' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '22' Modul(e) wurden durchsucht
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\Users\Andreas Dorn\AppData\Roaming\Zawuna\lodo.exe'
Der zu durchsuchende Pfad C:\Users\Andreas Dorn\AppData\Roaming\Zawuna\lodo.exe konnte nicht geöffnet werden!
Systemfehler [2]: Das System kann die angegebene Datei nicht finden.
Ende des Suchlaufs: Donnerstag, 17. Januar 2013 20:37
Benötigte Zeit: 30:00 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
0 Verzeichnisse wurden überprüft
3117 Dateien wurden geprüft
4 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
2 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
3113 Dateien ohne Befall
24 Archive wurden durchsucht
0 Warnungen
2 Hinweise
Code:
ATTFilter Avira Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 17. Januar 2013 22:16
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : ANDREASDORN-PC
Versionsinformationen:
BUILD.DAT : 13.0.0.2890 48567 Bytes 05.12.2012 17:11:00
AVSCAN.EXE : 13.6.0.402 639264 Bytes 11.12.2012 18:20:53
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 11.12.2012 18:20:53
LUKE.DLL : 13.6.0.400 67360 Bytes 11.12.2012 18:20:59
AVSCPLR.DLL : 13.6.0.402 93984 Bytes 10.12.2012 17:58:23
AVREG.DLL : 13.6.0.406 248096 Bytes 10.12.2012 17:58:23
avlode.dll : 13.6.1.402 428832 Bytes 10.12.2012 17:58:23
avlode.rdf : 13.0.0.26 7958 Bytes 10.12.2012 17:58:23
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 14:50:29
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 14:50:31
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 14:50:34
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 14:50:36
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 14:50:37
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 14:42:40
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 14:42:40
VBASE007.VDF : 7.11.50.230 3904512 Bytes 22.11.2012 17:54:28
VBASE008.VDF : 7.11.55.142 2214912 Bytes 03.01.2013 15:28:09
VBASE009.VDF : 7.11.55.143 2048 Bytes 03.01.2013 15:28:10
VBASE010.VDF : 7.11.55.144 2048 Bytes 03.01.2013 15:28:10
VBASE011.VDF : 7.11.55.145 2048 Bytes 03.01.2013 15:28:10
VBASE012.VDF : 7.11.55.146 2048 Bytes 03.01.2013 15:28:10
VBASE013.VDF : 7.11.55.196 260096 Bytes 04.01.2013 11:44:28
VBASE014.VDF : 7.11.56.23 206848 Bytes 07.01.2013 19:27:08
VBASE015.VDF : 7.11.56.83 186880 Bytes 08.01.2013 18:47:42
VBASE016.VDF : 7.11.56.145 135168 Bytes 09.01.2013 20:19:08
VBASE017.VDF : 7.11.56.211 139776 Bytes 11.01.2013 15:30:22
VBASE018.VDF : 7.11.57.11 153088 Bytes 13.01.2013 06:23:24
VBASE019.VDF : 7.11.57.75 165888 Bytes 15.01.2013 12:24:46
VBASE020.VDF : 7.11.57.163 190976 Bytes 17.01.2013 18:09:03
VBASE021.VDF : 7.11.57.164 2048 Bytes 17.01.2013 18:09:03
VBASE022.VDF : 7.11.57.165 2048 Bytes 17.01.2013 18:09:03
VBASE023.VDF : 7.11.57.166 2048 Bytes 17.01.2013 18:09:03
VBASE024.VDF : 7.11.57.167 2048 Bytes 17.01.2013 18:09:03
VBASE025.VDF : 7.11.57.168 2048 Bytes 17.01.2013 18:09:03
VBASE026.VDF : 7.11.57.169 2048 Bytes 17.01.2013 18:09:03
VBASE027.VDF : 7.11.57.170 2048 Bytes 17.01.2013 18:09:03
VBASE028.VDF : 7.11.57.171 2048 Bytes 17.01.2013 18:09:03
VBASE029.VDF : 7.11.57.172 2048 Bytes 17.01.2013 18:09:03
VBASE030.VDF : 7.11.57.173 2048 Bytes 17.01.2013 18:09:04
VBASE031.VDF : 7.11.57.180 48640 Bytes 17.01.2013 18:09:04
Engineversion : 8.2.10.232
AEVDF.DLL : 8.1.2.10 102772 Bytes 19.09.2012 14:42:55
AESCRIPT.DLL : 8.1.4.82 467323 Bytes 17.01.2013 18:09:04
AESCN.DLL : 8.1.10.0 131445 Bytes 13.12.2012 19:30:06
AESBX.DLL : 8.2.5.12 606578 Bytes 28.08.2012 16:58:06
AERDL.DLL : 8.2.0.88 643444 Bytes 10.01.2013 14:26:56
AEPACK.DLL : 8.3.1.2 819574 Bytes 20.12.2012 19:55:50
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 05.11.2012 17:17:30
AEHEUR.DLL : 8.1.4.174 5615991 Bytes 10.01.2013 14:26:56
AEHELP.DLL : 8.1.25.2 258423 Bytes 12.10.2012 15:52:32
AEGEN.DLL : 8.1.6.14 434548 Bytes 10.01.2013 14:26:54
AEEXP.DLL : 8.3.0.10 188789 Bytes 17.01.2013 18:09:04
AEEMU.DLL : 8.1.3.2 393587 Bytes 19.09.2012 14:42:55
AECORE.DLL : 8.1.30.0 201079 Bytes 13.12.2012 19:30:06
AEBB.DLL : 8.1.1.4 53619 Bytes 05.11.2012 17:17:29
AVWINLL.DLL : 13.4.0.163 25888 Bytes 19.09.2012 18:09:30
AVPREF.DLL : 13.4.0.360 50464 Bytes 11.12.2012 18:20:53
AVREP.DLL : 13.4.0.360 177952 Bytes 10.12.2012 17:58:23
AVARKT.DLL : 13.6.0.402 260384 Bytes 11.12.2012 18:20:52
AVEVTLOG.DLL : 13.6.0.400 167200 Bytes 11.12.2012 18:20:53
SQLITE3.DLL : 3.7.0.1 397088 Bytes 19.09.2012 18:17:40
AVSMTP.DLL : 13.4.0.163 62240 Bytes 19.09.2012 18:08:54
NETNT.DLL : 13.4.0.360 15648 Bytes 11.12.2012 18:20:59
RCIMAGE.DLL : 13.4.0.360 4780832 Bytes 11.12.2012 18:20:51
RCTEXT.DLL : 13.4.0.360 68384 Bytes 11.12.2012 18:20:51
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_50f6f28b\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: reparieren
Sekundäre Aktion......................: quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig
Abweichende Gefahrenkategorien........: +PCK,+SPR,
Beginn des Suchlaufs: Donnerstag, 17. Januar 2013 22:16
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '126' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '172' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'dsiwmis.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'ePowerSvc.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'GREGsvc.exe' - '15' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'IScheduleSvc.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'SchedulerSvc.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '189' Modul(e) wurden durchsucht
Durchsuche Prozess 'PnkBstrA.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'c2c_service.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'st_rsser64.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'UpdaterService.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorDataMgrSvc.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'ePowerTray.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'SpywareTerminatorShield.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorIcon.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'BackupManagerTray.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '90' Modul(e) wurden durchsucht
Durchsuche Prozess 'LManager.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'ePowerEvent.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'MMDx64Fx.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMworker.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPHelper.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '109' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '216' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SpywareTerminatorUpdate.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'FlashUtil32_11_5_502_146_ActiveX.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '139' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '135' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamscheduler.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamgui.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbam.exe' - '93' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '146' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '108' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '32' Modul(e) wurden durchsucht
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\Users\Andreas Dorn\AppData\Local\Temp\tmpaf93bbcd\gd.exe'
C:\Users\Andreas Dorn\AppData\Local\Temp\tmpaf93bbcd\gd.exe
[FUND] Ist das Trojanische Pferd TR/Agent.57344
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '56f8f559.qua' verschoben!
Beginne mit der Suche in 'C:\Users\Andreas Dorn\AppData\Local\Temp\tmpdbe8762b\ork.exe'
C:\Users\Andreas Dorn\AppData\Local\Temp\tmpdbe8762b\ork.exe
[FUND] Ist das Trojanische Pferd TR/Spy.ZBot.ifjz.1
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4e2adaed.qua' verschoben!
Ende des Suchlaufs: Donnerstag, 17. Januar 2013 22:17
Benötigte Zeit: 01:26 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
0 Verzeichnisse wurden überprüft
1071 Dateien wurden geprüft
2 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
2 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1069 Dateien ohne Befall
5 Archive wurden durchsucht
0 Warnungen
2 Hinweise
Ich danke euch!! Lg |
|
18.01.2013, 14:27
| #2 |
| /// Malwareteam   | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist. Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Schritt 1 CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
|
|
18.01.2013, 17:41
| #3 |
| | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 OTL Logfile:
__________________Code:
ATTFilter OTL logfile created on: 18.01.2013 17:09:21 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Andreas Dorn\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,93 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 61,40% Memory free 7,87 Gb Paging File | 5,96 Gb Available in Paging File | 75,80% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 584,07 Gb Total Space | 325,98 Gb Free Space | 55,81% Space Free | Partition Type: NTFS Drive D: | 1,36 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: ANDREASDORN-PC | User Name: Andreas Dorn | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.01.18 17:07:10 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Andreas Dorn\Downloads\OTL.exe PRC - [2013.01.14 06:03:46 | 003,674,248 | ---- | M] (Crawler.com) -- C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe PRC - [2013.01.14 06:03:38 | 002,777,736 | ---- | M] (Crawler.com) -- C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe PRC - [2013.01.09 18:16:55 | 000,699,400 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe PRC - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.12.14 16:49:28 | 000,512,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.12.11 19:21:00 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2012.12.11 19:20:53 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.12.11 19:20:53 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe PRC - [2011.09.03 16:05:55 | 000,066,872 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2010.03.09 00:58:24 | 000,250,368 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe PRC - [2010.03.09 00:56:38 | 000,260,608 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe PRC - [2010.03.03 14:21:16 | 001,300,560 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe PRC - [2010.03.03 14:21:16 | 000,325,200 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe PRC - [2010.03.03 14:21:16 | 000,297,040 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe PRC - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe PRC - [2010.01.08 14:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe PRC - [2009.12.24 01:39:04 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2009.12.24 01:39:02 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe PRC - [2009.09.30 18:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2009.09.30 18:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe ========== Modules (No Company Name) ========== MOD - [2013.01.09 18:26:22 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll MOD - [2013.01.09 18:25:53 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\865d2bf19a7af7fab8660a42d92550fe\System.Windows.Forms.ni.dll MOD - [2013.01.09 18:25:47 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll MOD - [2013.01.09 18:25:36 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll MOD - [2013.01.09 18:25:30 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll MOD - [2013.01.09 18:25:25 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll MOD - [2013.01.09 18:25:24 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll MOD - [2013.01.09 18:25:17 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll MOD - [2010.11.13 01:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2010.03.09 01:18:10 | 000,465,576 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll MOD - [2009.05.20 07:02:04 | 000,072,200 | ---- | M] () -- C:\Program Files (x86)\Launch Manager\CdDirIo.dll ========== Services (SafeList) ========== SRV:64bit: - [2012.09.28 02:38:16 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV - [2013.01.14 06:03:54 | 001,149,104 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe -- (ST2012_Svc) SRV - [2013.01.09 19:16:20 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.12.21 20:06:18 | 000,541,760 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.12.11 19:21:00 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.12.11 19:20:53 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2011.09.03 16:05:55 | 000,066,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2010.10.22 12:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.03.17 09:56:12 | 000,866,336 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc) SRV - [2010.03.09 00:58:24 | 000,250,368 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc) SRV - [2010.03.03 14:21:16 | 000,325,200 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService) SRV - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service) SRV - [2010.01.08 14:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService) SRV - [2009.12.24 01:39:04 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2009.11.02 11:48:18 | 000,126,352 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost) SRV - [2009.09.30 18:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2009.09.30 18:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2009.08.18 11:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.01.16 18:48:05 | 000,051,496 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\stflt.sys -- (sp_rsdrv2) DRV:64bit: - [2012.12.14 16:49:28 | 000,024,176 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.12.11 19:21:02 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.12.11 19:21:02 | 000,099,912 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.09.28 03:21:20 | 010,697,216 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2012.09.28 02:12:52 | 000,460,288 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2012.09.24 09:58:11 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012.05.14 07:12:30 | 000,096,896 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.03.18 16:20:22 | 000,410,184 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ladfBakerCamd64.sys -- (LADF_BakerCOnly) DRV:64bit: - [2011.03.18 13:33:48 | 000,335,688 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ladfBakerRamd64.sys -- (LADF_BakerROnly) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.04.28 00:57:20 | 000,016,200 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WmVirHid.sys -- (WmVirHid) DRV:64bit: - [2010.04.28 00:57:12 | 000,026,440 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmBEnum.sys -- (WmBEnum) DRV:64bit: - [2010.04.27 22:03:12 | 000,077,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmXlCore.sys -- (WmXlCore) DRV:64bit: - [2010.04.27 22:02:42 | 000,043,976 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WmFilter.sys -- (WmFilter) DRV:64bit: - [2010.04.07 03:04:22 | 002,216,960 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2010.02.11 04:01:12 | 003,058,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX) DRV:64bit: - [2010.01.28 03:33:38 | 000,116,736 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:64bit: - [2010.01.19 00:38:00 | 000,075,304 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:64bit: - [2009.12.17 18:42:08 | 000,538,136 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.11.02 11:48:02 | 000,013,784 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB) DRV:64bit: - [2009.09.17 13:12:06 | 000,292,912 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2009.09.17 11:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009.07.14 01:01:09 | 000,679,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\xnacc.sys -- (xnacc) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.27 06:32:38 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor) DRV:64bit: - [2009.05.05 09:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:64bit: - [2009.05.05 09:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV:64bit: - [2008.11.08 10:55:22 | 000,115,328 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7745g&r=27360710s416l0423z145t45i1l785 IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7745g&r=27360710s416l0423z145t45i1l785 IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7745g&r=27360710s416l0423z145t45i1l785 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7745g&r=27360710s416l0423z145t45i1l785 IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2903595 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7745g&r=27360710s416l0423z145t45i1l785 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ig?hl=de IE - HKCU\..\URLSearchHook: {795828a9-f271-43a8-8536-4484bb991d3d} - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2903595 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll () FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@ptc.com/ProductViewLite: C:\Program Files (x86)\Common Files\PTC\np6_pvapplite9.dll (PTC) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.04.02 15:44:00 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.04.04 17:54:40 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.04.02 15:44:00 | 000,000,000 | ---D | M] ========== Chrome ========== O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (WebCGMHlprObj Class) - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\Windows\SysWOW64\cgmopenbho.dll (CGM Open Consortium, Inc.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {795828A9-F271-43A8-8536-4484BB991D3D} - No CLSID value found. O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated) O4:64bit: - HKLM..\Run: [SpywareTerminatorShield] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com) O4:64bit: - HKLM..\Run: [SpywareTerminatorUpdater] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [PlayNC Launcher] File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: amazon.de ([www] https in Trusted sites) O15 - HKCU\..Trusted Domains: cat.com ([login] https in Trusted sites) O15 - HKCU\..Trusted Domains: cat.com ([sis] https in Trusted sites) O15 - HKCU\..Trusted Domains: modhoster.de ([www] http in Trusted sites) O15 - HKCU\..Trusted Domains: uploaded.to ([]http in Trusted sites) O16 - DPF: {865B2280-2B71-11D1-BC01-006097AC382A} https://sis.cat.com/sisfiles/plugin/isoview/isoview7.cab (Arbortext IsoView Control) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0854F69D-7F03-48BD-86AE-1236350A7DE5}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DCF34AFD-7835-43DB-833B-FFD87F519A87}: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2012.09.13 15:21:51 | 000,000,000 | ---D | M] - D:\autorun -- [ CDFS ] O32 - AutoRun File - [2010.10.15 08:52:28 | 000,000,047 | R--- | M] () - D:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{0cac3248-525d-11df-babe-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{0cac3248-525d-11df-babe-806e6f6e6963}\Shell\AutoRun\command - "" = D:\cdstart.exe -- [2011.02.07 18:47:39 | 001,419,984 | R--- | M] () O33 - MountPoints2\{25a513a4-dd76-11e1-8363-c80aa950f342}\Shell - "" = AutoRun O33 - MountPoints2\{25a513a4-dd76-11e1-8363-c80aa950f342}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{25a513a7-dd76-11e1-8363-c80aa950f342}\Shell - "" = AutoRun O33 - MountPoints2\{25a513a7-dd76-11e1-8363-c80aa950f342}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{a5801509-f0ce-11df-b412-f07bcb7c1cf5}\Shell - "" = AutoRun O33 - MountPoints2\{a5801509-f0ce-11df-b412-f07bcb7c1cf5}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{a580150f-f0ce-11df-b412-f07bcb7c1cf5}\Shell - "" = AutoRun O33 - MountPoints2\{a580150f-f0ce-11df-b412-f07bcb7c1cf5}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{a5801540-f0ce-11df-b412-c80aa950f342}\Shell - "" = AutoRun O33 - MountPoints2\{a5801540-f0ce-11df-b412-c80aa950f342}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{d991c1d9-166d-11e1-8052-f07bcb7c1cf5}\Shell - "" = AutoRun O33 - MountPoints2\{d991c1d9-166d-11e1-8052-f07bcb7c1cf5}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{d991c1de-166d-11e1-8052-f07bcb7c1cf5}\Shell - "" = AutoRun O33 - MountPoints2\{d991c1de-166d-11e1-8052-f07bcb7c1cf5}\Shell\AutoRun\command - "" = F:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) Drivers32:64bit: aux - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: aux1 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: aux2 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: aux3 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: aux4 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: aux5 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: aux6 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: aux7 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: aux8 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: aux9 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi1 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi2 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi3 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi4 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi5 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi6 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi7 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi8 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midi9 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: midimapper - midimap.dll (Microsoft Corporation) Drivers32:64bit: mixer - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer1 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer2 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer3 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer4 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer5 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer6 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer7 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer8 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: mixer9 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: msacm.imaadpcm - imaadp32.acm (Microsoft Corporation) Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32:64bit: msacm.msadpcm - msadp32.acm (Microsoft Corporation) Drivers32:64bit: msacm.msg711 - msg711.acm (Microsoft Corporation) Drivers32:64bit: msacm.msgsm610 - msgsm32.acm (Microsoft Corporation) Drivers32:64bit: MSVideo8 - VfWWDM32.dll (Microsoft Corporation) Drivers32:64bit: vidc.i420 - iyuv_32.dll (Microsoft Corporation) Drivers32:64bit: VIDC.IYUV - iyuv_32.dll (Microsoft Corporation) Drivers32:64bit: vidc.mrle - msrle32.dll (Microsoft Corporation) Drivers32:64bit: vidc.msvc - msvidc32.dll (Microsoft Corporation) Drivers32:64bit: VIDC.UYVY - msyuv.dll (Microsoft Corporation) Drivers32:64bit: VIDC.YUY2 - msyuv.dll (Microsoft Corporation) Drivers32:64bit: VIDC.YVU9 - tsbyuv.dll (Microsoft Corporation) Drivers32:64bit: VIDC.YVYU - msyuv.dll (Microsoft Corporation) Drivers32:64bit: wave - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave1 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave2 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave3 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave4 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave5 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave6 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave7 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave8 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wave9 - wdmaud.drv (Microsoft Corporation) Drivers32:64bit: wavemapper - msacm32.drv (Microsoft Corporation) Drivers32: aux - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: aux1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: aux2 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: aux3 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: aux4 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: aux5 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: aux6 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: aux7 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: aux8 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: aux9 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi2 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi3 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi4 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi5 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi6 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi7 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi8 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midi9 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: midimapper - C:\Windows\SysWow64\midimap.dll (Microsoft Corporation) Drivers32: mixer - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: mixer1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: mixer2 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: mixer3 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: mixer4 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: mixer5 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: mixer6 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: mixer7 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: mixer8 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: mixer9 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: msacm.imaadpcm - C:\Windows\SysWow64\imaadp32.acm (Microsoft Corporation) Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.msadpcm - C:\Windows\SysWow64\msadp32.acm (Microsoft Corporation) Drivers32: msacm.msg711 - C:\Windows\SysWow64\msg711.acm (Microsoft Corporation) Drivers32: msacm.msgsm610 - C:\Windows\SysWow64\msgsm32.acm (Microsoft Corporation) Drivers32: msacm.siren - C:\Windows\SysWow64\sirenacm.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.) Drivers32: vidc.i420 - C:\Windows\SysWow64\iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.iyuv - C:\Windows\SysWow64\iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.mrle - C:\Windows\SysWow64\msrle32.dll (Microsoft Corporation) Drivers32: vidc.msvc - C:\Windows\SysWow64\msvidc32.dll (Microsoft Corporation) Drivers32: vidc.uyvy - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation) Drivers32: vidc.VP60 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com) Drivers32: vidc.VP61 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com) Drivers32: vidc.yuy2 - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation) Drivers32: vidc.yvu9 - C:\Windows\SysWow64\tsbyuv.dll (Microsoft Corporation) Drivers32: vidc.yvyu - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation) Drivers32: wave - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wave1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wave2 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wave3 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wave4 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wave5 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wave6 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wave7 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wave8 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wave9 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation) Drivers32: wavemapper - C:\Windows\SysWow64\msacm32.drv (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2013.01.17 21:36:11 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Malwarebytes [2013.01.17 21:35:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.01.17 21:35:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.01.17 21:35:37 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2013.01.17 21:35:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2013.01.17 21:35:03 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Local\Programs [2013.01.17 09:05:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamSpeak3 [2013.01.16 18:48:05 | 000,051,496 | ---- | C] (Windows (R) Win 7 DDK provider) -- C:\Windows\SysNative\drivers\stflt.sys [2013.01.16 18:48:05 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Spyware Terminator [2013.01.16 18:48:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Spyware Terminator [2013.01.16 18:48:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator 2012 [2013.01.16 18:47:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spyware Terminator [2013.01.16 18:25:07 | 000,000,000 | ---D | C] -- C:\Windows\pss [2013.01.16 18:19:17 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\Documents\cc cleaner registry sicherungen [2013.01.16 18:02:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2013.01.16 18:02:25 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2013.01.16 11:13:23 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\TeamViewer [2013.01.14 21:01:54 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Ykers [2013.01.14 21:01:54 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Uzcav [2013.01.14 21:01:54 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Hidi [2013.01.14 14:34:15 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Fuocer [2013.01.14 14:34:15 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Eholex [2013.01.14 14:34:15 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Azriwo [2013.01.14 14:00:08 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Impy [2013.01.14 14:00:08 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Fuby [2013.01.14 14:00:08 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Feop [2013.01.13 22:59:00 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Utefa [2013.01.13 22:59:00 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Cogoe [2013.01.13 22:59:00 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Afduym [2013.01.13 20:37:11 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Xeoge [2013.01.13 20:37:11 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Qyiwg [2013.01.13 20:37:11 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Efib [2013.01.11 23:38:10 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Zawuna [2013.01.11 23:38:10 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Elkiyb [2013.01.11 23:38:10 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Avyf [2013.01.10 18:07:34 | 000,000,000 | ---D | C] -- C:\Windows\Sun [2013.01.10 17:25:33 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\.minecraft [2013.01.10 17:25:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2013.01.09 16:52:51 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Local\Logitech [2013.01.09 16:47:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Logitech [2013.01.03 17:30:18 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\Documents\Witcher 2 [2013.01.03 17:30:18 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Local\The Witcher 2 [2012.12.29 23:35:49 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\Documents\GTA San Andreas User Files [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.01.18 17:16:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.01.18 16:37:00 | 000,001,122 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.01.18 10:01:11 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.01.18 10:01:11 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.01.18 09:52:40 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.01.18 09:52:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.01.18 09:52:04 | 3168,137,216 | -HS- | M] () -- C:\hiberfil.sys [2013.01.17 09:05:55 | 000,001,070 | ---- | M] () -- C:\Users\Andreas Dorn\Desktop\TeamSpeak 3 Client.lnk [2013.01.16 18:48:05 | 000,051,496 | ---- | M] (Windows (R) Win 7 DDK provider) -- C:\Windows\SysNative\drivers\stflt.sys [2013.01.16 18:48:04 | 000,001,002 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Terminator 2012.lnk [2013.01.10 18:06:16 | 000,263,186 | ---- | M] () -- C:\Users\Andreas Dorn\Desktop\Minecraft.exe [2013.01.09 18:21:32 | 000,343,816 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.01.09 18:13:39 | 001,620,114 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013.01.09 18:13:39 | 000,707,566 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.01.09 18:13:39 | 000,661,144 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.01.09 18:13:39 | 000,153,126 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.01.09 18:13:39 | 000,125,334 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.01.09 18:13:32 | 001,620,114 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.01.17 09:05:55 | 000,001,070 | ---- | C] () -- C:\Users\Andreas Dorn\Desktop\TeamSpeak 3 Client.lnk [2013.01.16 18:48:04 | 000,001,002 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Terminator 2012.lnk [2013.01.10 18:06:13 | 000,263,186 | ---- | C] () -- C:\Users\Andreas Dorn\Desktop\Minecraft.exe [2012.09.28 02:29:54 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.09.28 02:29:54 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2012.05.02 13:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.09.05 13:40:40 | 000,000,100 | ---- | C] () -- C:\Users\Andreas Dorn\AppData\Local\fusioncache.dat [2011.09.03 16:09:37 | 001,620,114 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.09.03 16:05:55 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2011.09.03 16:05:55 | 000,103,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.09.03 16:05:55 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.08.20 19:30:45 | 000,000,412 | ---- | C] () -- C:\Windows\SIERRA.INI [2011.08.20 19:29:25 | 000,086,528 | ---- | C] () -- C:\Windows\bnetunin.exe [2011.07.11 17:03:02 | 000,007,597 | ---- | C] () -- C:\Users\Andreas Dorn\AppData\Local\Resmon.ResmonCfg [2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.04.02 15:31:27 | 000,231,510 | ---- | C] () -- C:\Windows\hpoins49.dat [2010.08.05 20:41:12 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.04.19 11:36:21 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2010.10.29 13:36:11 | 000,000,000 | -HSD | M] -- C:\Users\Andreas Dorn\AppData\Roaming\.# [2013.01.10 19:47:06 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\.minecraft [2010.08.13 15:36:35 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Acreon [2013.01.16 14:54:09 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Afduym [2012.02.02 20:08:05 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\AMS [2013.01.11 23:38:10 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Avyf [2013.01.14 14:34:15 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Azriwo [2013.01.16 18:13:42 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Azureus [2013.01.13 22:59:00 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Cogoe [2010.07.24 14:34:50 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2013.01.13 20:37:11 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Efib [2013.01.14 14:34:15 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Eholex [2013.01.17 20:32:02 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Elkiyb [2013.01.14 14:00:08 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Feop [2013.01.14 14:00:08 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Fuby [2013.01.14 14:34:15 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Fuocer [2013.01.16 07:18:16 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Hidi [2013.01.14 14:00:08 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Impy [2012.07.25 10:15:43 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Leadertech [2012.03.06 11:34:54 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Merscom [2012.09.11 17:53:26 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Origin [2013.01.13 20:37:11 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Qyiwg [2013.01.16 18:48:05 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Spyware Terminator [2013.01.16 11:13:23 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\TeamViewer [2011.01.08 14:19:19 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Touchstone [2013.01.17 15:19:33 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\TS3Client [2013.01.17 20:36:59 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Utefa [2013.01.16 07:18:28 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Uzcav [2011.06.21 20:36:42 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\wargaming.net [2013.01.16 10:55:06 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Xeoge [2013.01.14 21:01:54 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Ykers [2013.01.16 07:18:28 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Yqijg [2013.01.17 20:37:00 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Zawuna ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2010.10.02 07:32:38 | 000,000,000 | ---- | M] () -- C:\BnetLog.txt [2010.04.19 12:10:50 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK [2010.12.24 14:51:20 | 000,000,042 | ---- | M] () -- C:\cmdlog.txt [2010.03.11 02:20:26 | 000,878,818 | ---- | M] () -- C:\D2DV_IX86_112a_113c.mpq [2012.03.06 11:32:08 | 000,000,000 | ---- | M] () -- C:\GameCenterResultLog.txt [2013.01.18 09:52:04 | 3168,137,216 | -HS- | M] () -- C:\hiberfil.sys [2006.12.01 22:37:14 | 000,904,704 | ---- | M] (Microsoft Corporation) -- C:\msdia80.dll [2013.01.18 09:52:12 | 4224,184,320 | -HS- | M] () -- C:\pagefile.sys [2010.04.28 01:31:37 | 000,002,264 | ---- | M] () -- C:\RHDSetup.log [2010.04.28 01:42:30 | 000,000,190 | ---- | M] () -- C:\Webcam.log < %systemroot%\system32\*.wt > < %systemroot%\system32\*.ruy > < %systemroot%\Fonts\*.com > [2009.07.14 06:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont [2009.07.14 06:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont [2009.07.14 06:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont [2009.07.14 06:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > [2009.06.10 21:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini < %systemroot%\Fonts\*.ini2 > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.scr > [2009.07.10 12:10:44 | 000,307,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > [2009.07.14 05:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\user32.dll /md5 > [2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\system32\user32.dll < %systemroot%\system32\ws2_32.dll /md5 > [2010.11.20 13:21:38 | 000,206,848 | ---- | M] (Microsoft Corporation) MD5=7FF15A4F092CD4A96055BA69F903E3E9 -- C:\Windows\system32\ws2_32.dll < %systemroot%\system32\ws2help.dll /md5 > [2009.07.14 02:11:26 | 000,004,608 | ---- | M] (Microsoft Corporation) MD5=808AABDF9337312195CAFF76D1804786 -- C:\Windows\system32\ws2help.dll < MD5 for: EXPLORER.EXE > [2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe [2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2010.02.04 11:49:48 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2010.02.04 11:49:48 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2010.02.04 11:49:48 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe [2010.02.04 11:49:48 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: WININIT.EXE > [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2012.12.14 16:49:28 | 000,216,424 | ---- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < > [2009.07.14 06:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT [2009.07.14 06:08:49 | 000,032,640 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.11.11 17:37:27 | 000,001,118 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job [2011.11.11 17:37:27 | 000,001,122 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job [2012.10.15 09:48:50 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job < End of report > |
|
18.01.2013, 17:43
| #4 |
| | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 18.01.2013 17:09:21 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Andreas Dorn\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,93 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 61,40% Memory free
7,87 Gb Paging File | 5,96 Gb Available in Paging File | 75,80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 584,07 Gb Total Space | 325,98 Gb Free Space | 55,81% Space Free | Partition Type: NTFS
Drive D: | 1,36 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: ANDREASDORN-PC | User Name: Andreas Dorn | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A743921-9CE3-4BA8-8CCB-EC5E5078C3D9}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{118A2077-7D26-48A2-B776-F2A04FE5D0A7}" = lport=139 | protocol=6 | dir=in | app=system |
"{19748D0D-4127-48AD-BC6B-E6FA1C924C30}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{19BF1148-CB07-47C2-9376-248498B2AF28}" = lport=80 | protocol=6 | dir=in | name=allow port 80 |
"{24AD2350-09D0-4C28-A26F-E0C99F37137B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4829CC21-7AA9-4A76-BF48-05649A43C293}" = rport=10243 | protocol=6 | dir=out | app=system |
"{49463B9E-8589-4BC5-969F-A52DD6811916}" = rport=138 | protocol=17 | dir=out | app=system |
"{4F55E1C7-D174-4781-83B4-8141C2105BD8}" = lport=137 | protocol=17 | dir=in | app=system |
"{5115D59C-D8DC-4FEC-8743-45B038C7A6DF}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |
"{5731C1E0-07D9-4146-A297-AA8AF7C2B5D7}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5E5D4AF6-125C-475D-88F6-05E1AD68AD57}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5E689219-E193-4B96-98A2-6E6AA0036D80}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6A893D5E-284D-404F-80DF-1A2441536F89}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{71C7E273-E4C9-47AC-B835-F7736D0AA01E}" = lport=1119 | protocol=6 | dir=in | name=allow port 1119 |
"{831789A5-AF15-40FA-BAC8-3863E20B3C22}" = lport=6113 | protocol=6 | dir=in | name=allow port 6113 |
"{8411D198-D363-4906-9414-4D8E76177EE4}" = lport=6999 | protocol=6 | dir=in | name=allow port 6999 |
"{91B97063-F839-4AC1-A72D-E5DCBF858D7A}" = rport=137 | protocol=17 | dir=out | app=system |
"{A2316F65-B473-4EDF-BA2A-38C21D70B3D7}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |
"{A827EAF9-1441-4EA9-8099-850FC802945B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A9466B53-FB4B-48E5-A4D4-D1D15DED47D0}" = lport=138 | protocol=17 | dir=in | app=system |
"{AEB4A343-8EFB-4FF9-8DC9-EB713A19DA35}" = lport=6114 | protocol=6 | dir=in | name=allow port 6114 |
"{B08B8502-5186-4A51-B14D-B70737EBB84B}" = lport=3724 | protocol=6 | dir=in | name=allow port 3724 |
"{B67D01CB-94EC-46CB-90D8-EB5B290BE779}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{BB095B3F-D84D-451B-9D1E-7C24BA017C9F}" = rport=139 | protocol=6 | dir=out | app=system |
"{C06BDE89-D614-425C-8384-EEBD334B3BC0}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C42369F6-0149-4CC9-83CC-8631883A8C4E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{C8BC716F-A919-48D3-93AB-FD642709DD66}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CF85ED8A-EE5C-4635-94EB-96856104382C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D0D15D30-D224-4CE0-8894-AC52CA2F35EA}" = lport=4000 | protocol=6 | dir=in | name=allow port 4000 |
"{D1F5641D-F93E-4376-917E-66E74F6BFC5B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D4D543A2-4AEC-4E31-975A-778003CAF096}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DAEE974D-5DED-406E-9BE2-AD962B3A34A8}" = rport=445 | protocol=6 | dir=out | app=system |
"{F074D2CB-2E79-42B0-ABBD-19C4AC7F1DD7}" = lport=6112 | protocol=6 | dir=in | name=allow port 6112 |
"{F38CE66E-8195-4300-B13D-429FDADB964D}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F3A6F790-1F3F-4CB3-B01F-2C7DC98363E4}" = lport=6881 | protocol=6 | dir=in | name=allow port 6881 |
"{F7907417-F2FD-40B5-97D6-C5734B1A1D0E}" = lport=1120 | protocol=6 | dir=in | name=allow port 1120 |
"{FEF93EAB-1219-4145-96E8-D9E0217EBE87}" = lport=445 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05411995-8188-45B2-93B0-78132C63C73E}" = protocol=6 | dir=in | app=c:\program files (x86)\spyware terminator\spywareterminator.exe |
"{0A5253AD-5325-4DE5-9AE3-C39D2E4926E5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\amboss227\condition zero\hl.exe |
"{0B772F6B-1039-438C-83CB-6A5F48BEC35A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\stronghold3\bin\win32_release\stronghold3.exe |
"{0C4F837E-6621-452B-A0A9-90E6F16C3D3A}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{0CB48AEF-D50F-4607-99FB-221D98075F01}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0E3AD269-F07C-4AB5-B85A-B507526BE7F0}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe |
"{11EF1E5E-2406-4A24-AF8B-48A0239565FF}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013.exe |
"{1236D324-6180-4812-A1AF-7C6425AF2492}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{12CD12EF-30CC-444F-BC37-F2862AEEC541}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dishonored\binaries\win32\dishonored.exe |
"{13F334BC-5F0A-4610-895E-80767E2616FB}" = protocol=6 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{15F41015-59E6-42BD-A9D3-E3F6BB990B08}" = protocol=17 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{1C02DCC4-285F-4728-8041-8E8F1479C6B9}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe |
"{1C11C627-4E1D-48C8-966A-87261B4326BB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1D338E92-BF7E-4275-B238-AD7312280D55}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{1E2633AF-8F34-48CF-B9DF-30153AF971DB}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013game.exe |
"{1ECA2000-653F-48DC-A11D-23E838A4CB48}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{20F8DDF8-E0B8-4839-A8C1-B8BA15A25CAF}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mafia ii\pc\mafia2.exe |
"{228CDD39-38A2-4CE5-8B6E-B237616D531E}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{22F2D9BF-5100-489D-A890-116E6100156F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\doom 3 bfg edition\doom3bfg.exe |
"{2511DD9B-F59A-47A8-BD68-ED5821C6CC37}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\stronghold3\bin\win32_release\stronghold3.exe |
"{26441760-206B-47EB-8211-7639E198B84D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\stronghold3\bin\win32_release\mapeditor.exe |
"{2FA5CD28-0D1B-492D-915E-F9199953D943}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{33B0966A-E448-45D8-9B56-AEE4058F468C}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{350E8786-2291-46D4-9685-8B4264AA3665}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe |
"{3574FCDC-945B-4DD4-A1C6-17E7D2DBC47D}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base15405\sc2.exe |
"{364BF1FF-E9EB-4718-B756-1F448E2AAA4D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{39D71E7B-6EB9-421E-871D-9C5C80048027}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magicka\magicka.exe |
"{3B31541F-9BD7-4DDD-85B1-D0E0C1E7ED7E}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013.exe |
"{3B63C0F1-EEF1-487F-8323-965CFFFE989A}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{3E98420C-465E-4E4D-8C8E-55E934B447CC}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011\farmingsimulator2011.exe |
"{405D7124-9432-42D0-A1E2-6C67DB2F4219}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\batman arkham city goty\binaries\win32\batmanac.exe |
"{4A347E95-5D19-48BA-93ED-8FF015F04B32}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011\game.exe |
"{4A7F2715-2DEF-48A0-AD43-EB86C8E97D86}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe |
"{4B8FD9A1-4EBA-4200-B60F-CADF9C673A33}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\amboss227\condition zero\hl.exe |
"{4C4FBF6E-D68C-478B-834D-71B55A523C3E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{4D722A3E-4F83-42FA-8A82-6838AB04EBD6}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{4DB87AD6-65ED-40C4-8E3B-281BCFFE2E4E}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{52B8C972-B951-4E6B-ACFC-F90E64C1B1A8}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{53687911-0234-409C-AB47-5B1D20883D41}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe |
"{5397195C-F45D-49B9-83ED-76F8DD38B470}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe |
"{54809D21-01FC-45EA-AEA3-A7B617F07C2E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mafia ii\pc\mafia2.exe |
"{588BA475-B77E-432E-A0D1-9E1D3BEA2637}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe |
"{5A2709B3-750B-459F-AC25-6E42B44D2F1C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{5A690A86-4C33-4ECB-B29B-5A8EBC21AEA5}" = dir=in | app=d:\setup\hpznui40.exe |
"{5B112E6E-7A05-4EB7-9382-3F66E8129213}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe |
"{5D043D36-C8A8-4129-9D34-F26838DEF5E3}" = protocol=6 | dir=in | app=e:\andi\spiele\wow\launcher.exe |
"{60DCB3E3-3118-45C2-876E-9798EEFF3077}" = protocol=6 | dir=in | app=c:\program files (x86)\ptc\productview express\i486_nt\obj\productview.exe |
"{61EB002F-265D-49CA-B609-73E1DDE95D5B}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{65ADF815-EA23-45F2-A2B7-95A3B685D5E5}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\batman arkham city goty\runlauncher.bat |
"{679D6767-ADF9-4AF9-956D-BF2D390A386F}" = protocol=17 | dir=in | app=c:\program files (x86)\agrar simulator 2012\farm2012.dll |
"{6F15F6C8-A17E-44DA-87B7-FAC3B4B71149}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe |
"{70014957-438A-4258-AFC5-10349D2984E8}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{7020BAD4-2E10-46FC-B008-7A41DC143464}" = protocol=6 | dir=out | app=system |
"{70519228-996F-46A5-88DE-4EAE3FC04DC2}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{738724A6-6B82-43DE-BAF3-C387C6E9F6A8}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe |
"{743683C0-1E64-4D47-BBFF-44024BB7D05A}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{744EB514-FB49-4E30-B3FA-DA3C85910D8F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{753D624F-099D-4F22-B446-154CC063B47A}" = protocol=17 | dir=in | app=c:\program files (x86)\agrar simulator 2012\iupdate.dll |
"{75CCB17E-2BAE-4EBC-8F35-F04B54B4BDED}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011\game.exe |
"{79E2544A-AA28-4860-9A03-ED70445061D5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grand theft auto san andreas\gta-sa.exe |
"{7B7B1C1D-35A6-42C7-976B-52E3F58B1C7D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{7F17779E-1ED0-4BAA-8030-AA02441EC45A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\stronghold3\bin\win32_release\stronghold3.exe |
"{802CCCDE-BCB6-4E55-BD41-5924FA21F19D}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{803E025F-E470-4229-A8B3-04B52621287E}" = protocol=17 | dir=in | app=c:\program files (x86)\spyware terminator\spywareterminatorupdate.exe |
"{81211E96-68FA-4FA3-AD5F-7FA74C970689}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{84270D67-659F-4EFB-9947-DF3D6807BF46}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magicka\magicka.exe |
"{84311755-AC86-4056-B3AB-96B11121B6AF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{84EE206B-7572-430D-AD62-065EB93F6057}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe |
"{852AD54A-8E66-478E-B4AB-C7D0C02518DC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\batman arkham city goty\runlauncher.bat |
"{880106A7-2735-4655-A361-0F1EB3D76BB0}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe |
"{8B779E02-1299-406A-969D-B6A805D277E3}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{8C0542F1-0157-4517-BFAE-39D366FCCA40}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe |
"{8DAB0104-1D01-4319-979B-EDE91314438E}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{92496FB1-B989-4567-89E6-A6BC839E86EE}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe |
"{941FEF0A-3446-4A5B-AE71-5BFB7D75CA6F}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe |
"{96D85BBB-528A-44B0-9F0D-115293FF9364}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{997E3DDA-8D83-47A5-B0A4-DCE7E3A778E0}" = protocol=6 | dir=in | app=c:\program files (x86)\agrar simulator 2012\iupdate.dll |
"{9AD8DEE1-AB94-4884-B925-B84F31812D0E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the witcher 2\launcher.exe |
"{9B074DF4-979C-4103-AF27-56C8EF7AB424}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe |
"{9D8C3C99-75C0-44A8-BF4C-6BEC25A4EF30}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9E152A7A-A2A4-423D-92D2-129EC6B0F3DA}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe |
"{9F99A706-ACC9-48B2-A4C7-F5BC4963B6CA}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magicka\magicka.exe |
"{A1E6CF3C-2422-4ACD-8AA6-BF8CFF9F8C5C}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe |
"{A2F45FAA-0DCE-4C62-8CB8-FB2CAECF7F06}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe |
"{A399DB09-FFDB-4B28-B476-84CEB7F8275A}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{A5893FC0-C622-4C0D-A79E-B242758F4505}" = protocol=6 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\backupsvc.exe |
"{A5F33BF3-AD62-4D3E-BA45-96FD8409AFB1}" = protocol=17 | dir=in | app=c:\program files (x86)\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe |
"{AC1DFD39-CFDA-4865-8647-A655AF95CCDB}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{AD5D722C-AA73-49E3-A0CD-819BBD9A048E}" = protocol=17 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\backupsvc.exe |
"{AE62AE0C-29DD-4EE6-BD08-C18EA50A676E}" = protocol=6 | dir=in | app=c:\program files (x86)\agrar simulator 2012\farm2012.dll |
"{AFC26BEE-5993-44B5-9782-4DEA9950B38E}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B0C4878F-E051-4FA5-9B6E-354CFC445353}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grand theft auto san andreas\gta-sa.exe |
"{B4215CDF-AEC2-428D-8751-54356AEE45D9}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{B553EA10-BCD3-4F80-9EEF-DF76992638B4}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\amboss227\counter-strike\hl.exe |
"{B6CA3183-1A1F-410B-A2B0-B0C7252A8E71}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\amboss227\counter-strike\hl.exe |
"{BA516AD7-DAE3-470D-81D9-1C28553DBDB5}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base15405\sc2.exe |
"{BB5196E7-8E6F-4C6F-8061-6CA15F2B31EC}" = protocol=17 | dir=in | app=e:\andi\spiele\wow\launcher.exe |
"{BCCE9B7D-8686-4735-845A-9952F0C26771}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{BCE35833-8B31-437B-8BB8-784D37F22D76}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dishonored\binaries\win32\dishonored.exe |
"{BE65B467-7772-4452-91CF-AB9668F214C0}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011\farmingsimulator2011.exe |
"{BED396C3-7359-43FD-85E9-EFACDADDD191}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\doom 3 bfg edition\doom3bfg.exe |
"{C18FB62F-2C4E-4D46-8EC6-C80888FAF66B}" = protocol=17 | dir=in | app=c:\program files (x86)\ptc\productview express\i486_nt\obj\productview.exe |
"{C190F826-05B9-4678-AE18-9DB849CAFF16}" = protocol=17 | dir=in | app=e:\andi\spiele\wow\blizzard downloader.exe |
"{C3436E14-4360-4396-9351-9A3165A3321F}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe |
"{C54CD7E6-5870-4D4C-ABD3-5749E295527C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C78439CC-0898-4AA6-8FE0-1B352DF777DC}" = protocol=6 | dir=in | app=c:\program files (x86)\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe |
"{C9BBCA1D-E2ED-46E7-A75F-95AF61ECA149}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{CB2112AA-F9DF-42D8-862D-98D95518BF2A}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe |
"{CB36B500-CE63-4708-871C-ED4AD99A3D65}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\batman arkham city goty\binaries\win32\batmanac.exe |
"{CBBADDED-BE52-42E8-979B-1E7497F4EC12}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{CC5A70D6-1F96-4F6E-8942-1ADF81F717CE}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{CFB40CFF-32EE-44DC-A01D-0664B4B7348A}" = protocol=17 | dir=in | app=c:\program files (x86)\spyware terminator\spywareterminator.exe |
"{CFE13A6E-1501-4B7E-9873-CC71215B1917}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{D20F6071-BF98-4FD7-9EF3-23CD6F102432}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{D27EA817-DD3A-4B71-943A-ACABDC8A4D72}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{D2C87143-B7C6-4704-BB1A-3757729E901B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{D47B5778-3C5E-4136-84C0-4FB09E3B044A}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013game.exe |
"{D67D55AE-57EB-43FC-8EDE-A0385BE12983}" = protocol=6 | dir=in | app=e:\andi\spiele\wow\launcher.patch.exe |
"{D6EE36DB-F6A6-4582-9B3D-93C2041E76FC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{DB4E1659-0EFE-43EE-82A2-5B062D650AC4}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{DEC0736D-501A-4179-ABA3-A95C2A937F90}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{DF38629C-8217-4974-A9B5-2942AD81EC10}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe |
"{E37AB6B7-A264-42A5-AED2-67E2849C514E}" = protocol=17 | dir=in | app=e:\andi\spiele\wow\launcher.patch.exe |
"{E43F925F-E194-4CD0-AE53-2495C74BA11E}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe |
"{E598700C-AC91-4E94-ACD0-AD7AFE2E0330}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{E5D06922-44CD-48D6-989D-5A43D3EAAE41}" = protocol=6 | dir=in | app=c:\program files (x86)\spyware terminator\spywareterminatorupdate.exe |
"{E787FA7C-BEFE-4D5F-A61E-FBDF899AA788}" = protocol=6 | dir=in | app=e:\andi\spiele\wow\blizzard downloader.exe |
"{E896720E-209D-4008-A523-E64081B39243}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EA7D1C0E-5F21-4569-9F8C-DCEA6CE2A75D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{EE476305-B1AB-4530-8E3E-945B698628F8}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the witcher 2\launcher.exe |
"{F20E3328-AE71-46BC-874E-C23152053E60}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magicka\magicka.exe |
"{F3CC8F9C-F9E6-44E8-BD8E-C73B278D184A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\stronghold3\bin\win32_release\stronghold3.exe |
"{F8DFF0E1-C460-476C-A179-E0D7312A9FF2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FC3DD98B-F61B-476F-8330-6A311DA04743}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\stronghold3\bin\win32_release\mapeditor.exe |
"TCP Query User{016DB54A-346E-4EBE-87C0-7A0337C3B8FF}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe |
"TCP Query User{0F783C55-68D2-43EE-97FA-943E48A6ACF0}G:\andi\world_of_tanks\worldoftanks.exe" = protocol=6 | dir=in | app=g:\andi\world_of_tanks\worldoftanks.exe |
"TCP Query User{101F23D3-914A-409C-941C-4D5F5E3E6D19}G:\andi\spiele\wow\temp\wow-4.2.1.2727-enus-tools-downloader.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.2.1.2727-enus-tools-downloader.exe |
"TCP Query User{1310700D-8571-483E-ADCD-6A59E7E0909C}G:\andi\spiele\wow\launcher.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\launcher.exe |
"TCP Query User{1418543C-DE20-43E5-AAFE-47D459B9A59F}C:\users\andreas dorn\downloads\diablo-iii-8370-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\andreas dorn\downloads\diablo-iii-8370-dede-installer-downloader.exe |
"TCP Query User{18BF9B74-C010-4B3B-B734-DA697CDB5D81}E:\andi\spiele\wow\backgrounddownloader.exe" = protocol=6 | dir=in | app=e:\andi\spiele\wow\backgrounddownloader.exe |
"TCP Query User{19243D8C-18E6-4232-9EA8-A0618603C274}E:\andi\spiele\wow\wow-2.1.1.1897-engb-tools-downloader.exe" = protocol=6 | dir=in | app=e:\andi\spiele\wow\wow-2.1.1.1897-engb-tools-downloader.exe |
"TCP Query User{19B906D0-1571-4406-BC3F-80D6EC04C616}E:\andi\spiele\wow\blizzard downloader.exe" = protocol=6 | dir=in | app=e:\andi\spiele\wow\blizzard downloader.exe |
"TCP Query User{1A8CFEB6-2FF0-47C7-B136-D9FCA01553BB}G:\andi\world_of_tanks\wotlauncher.exe" = protocol=6 | dir=in | app=g:\andi\world_of_tanks\wotlauncher.exe |
"TCP Query User{1B8DAA68-3665-4E34-953E-7DC0399DA565}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"TCP Query User{1BEBAD39-04DC-4825-8C3F-D38BF38421C7}C:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe |
"TCP Query User{23097362-D22F-4B7C-BE99-77FEB2A58B2C}C:\users\andreas dorn\documents\world_of_tanks\wotlauncher.exe" = protocol=6 | dir=in | app=c:\users\andreas dorn\documents\world_of_tanks\wotlauncher.exe |
"TCP Query User{2474576A-0229-48F1-87B8-9A802545CA52}C:\program files (x86)\starcraft ii\versions\base16605\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16605\sc2.exe |
"TCP Query User{27E5D7CE-D972-41D0-A299-56157AF446F1}C:\program files (x86)\starcraft ii\versions\base18092\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18092\sc2.exe |
"TCP Query User{2D31FD5A-2DB1-469A-9D49-A32E35729568}G:\andi\spiele\wow\temp\wow-4.2.1.2706-enus-tools-downloader.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.2.1.2706-enus-tools-downloader.exe |
"TCP Query User{31EE23D8-7640-41F5-8C69-99CBB9E2F77E}C:\program files (x86)\starcraft ii\versions\base16561\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16561\sc2.exe |
"TCP Query User{3FC0B173-6357-432B-B1EA-D4E9BDC01462}C:\program files (x86)\starcraft ii\versions\base16939\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16939\sc2.exe |
"TCP Query User{40DD54B1-9255-4779-A6CC-E9A562DF166D}G:\andi\spiele\wow\temp\wow-4.2.1.2730-enus-tools-downloader.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.2.1.2730-enus-tools-downloader.exe |
"TCP Query User{42C56C9C-FE78-42A5-BC7C-ECCC5E270449}C:\users\andreas dorn\appdata\roaming\zawuna\lodo.exe" = protocol=6 | dir=in | app=c:\users\andreas dorn\appdata\roaming\zawuna\lodo.exe |
"TCP Query User{455B1410-4D82-4593-80A0-ABB8B9889204}C:\program files (x86)\starcraft ii\versions\base16755\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16755\sc2.exe |
"TCP Query User{5A5F262E-753A-4C79-BD43-BFDCF9B63B8E}C:\users\andreas dorn\appdata\roaming\utefa\segis.exe" = protocol=6 | dir=in | app=c:\users\andreas dorn\appdata\roaming\utefa\segis.exe |
"TCP Query User{5AE57E1A-EC30-47F3-8070-30B97CBDC3E0}C:\program files (x86)\starcraft ii\versions\base19679\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base19679\sc2.exe |
"TCP Query User{5CE9E154-6412-41E9-9A6F-3A0206D7CF0A}G:\andi\spiele\wow\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.2.1.2736-enus-tools-downloader.exe |
"TCP Query User{634B3F2B-AF88-43D5-BF0C-93FA6A99AD26}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe |
"TCP Query User{65FCB10E-8125-41E2-ADF3-6C293258C2A6}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe |
"TCP Query User{661398F9-D4A7-4AEE-895A-75D0C5640D43}C:\program files (x86)\starcraft ii\versions\base16755\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16755\sc2.exe |
"TCP Query User{717B7DC7-CF46-4228-8AE1-EC239CF23AD6}G:\andi\spiele\wow\temp\wow-4.0.0.1807-to-4.0.0.2072-enus-tools-downloader.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.0.0.1807-to-4.0.0.2072-enus-tools-downloader.exe |
"TCP Query User{75E421E6-BFE1-4E44-8749-D6DB63ADFC52}C:\program files (x86)\agrar simulator 2011\farm.dll" = protocol=6 | dir=in | app=c:\program files (x86)\agrar simulator 2011\farm.dll |
"TCP Query User{78958CFF-4372-4670-BE1B-826310F7559F}G:\andi\world_of_tanks\wotlauncher.exe" = protocol=6 | dir=in | app=g:\andi\world_of_tanks\wotlauncher.exe |
"TCP Query User{7A8E7DFE-407E-4D87-8671-0206207A9CB7}G:\andi\spiele\cryptic studios\star trek online\live\gameclient.exe" = protocol=6 | dir=in | app=g:\andi\spiele\cryptic studios\star trek online\live\gameclient.exe |
"TCP Query User{7B3F204E-E749-47B0-93DD-196CEC06D2F3}C:\program files (x86)\starcraft ii\versions\base19132\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base19132\sc2.exe |
"TCP Query User{7C39F802-6928-4FB7-B0C6-3FF28214EBC1}G:\andi\world_of_tanks\worldoftanks.exe" = protocol=6 | dir=in | app=g:\andi\world_of_tanks\worldoftanks.exe |
"TCP Query User{80D450B0-6330-4F3E-8936-F2A6D73D864F}G:\andi\spiele\wow\backgrounddownloader.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\backgrounddownloader.exe |
"TCP Query User{8401B1D3-C9A6-4BA1-8054-D34A28ADA99F}G:\andi\spiele\wow\blizzard downloader.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\blizzard downloader.exe |
"TCP Query User{8CF3AC00-8204-4C53-BF10-770D7EC9822F}G:\andi\spiele\wow\launcher.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\launcher.exe |
"TCP Query User{8D8ACA40-279C-488F-A7D4-0DEF490D5363}E:\andi\spiele\wow\backgrounddownloader.exe" = protocol=6 | dir=in | app=e:\andi\spiele\wow\backgrounddownloader.exe |
"TCP Query User{9BA4CA01-E8F7-47FB-8093-07B46748481B}C:\users\andreas dorn\appdata\roaming\zawuna\lodo.exe" = protocol=6 | dir=in | app=c:\users\andreas dorn\appdata\roaming\zawuna\lodo.exe |
"TCP Query User{A676687D-FD60-422F-AD33-41CD1600F000}C:\program files (x86)\spyware terminator\spywareterminatorupdate.exe" = protocol=6 | dir=in | app=c:\program files (x86)\spyware terminator\spywareterminatorupdate.exe |
"TCP Query User{AD782818-FC66-464B-88CE-8A3704FF38DD}C:\program files (x86)\starcraft ii\versions\base18574\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18574\sc2.exe |
"TCP Query User{B450A207-D023-4DD6-861A-81BF6CE84AD4}C:\program files (x86)\world_of_tanks\worldoftanks.exe" = protocol=6 | dir=in | app=c:\program files (x86)\world_of_tanks\worldoftanks.exe |
"TCP Query User{B575C0B4-6372-47BC-B769-B15256325B6F}G:\andi\spiele\wow\launcher.patch.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\launcher.patch.exe |
"TCP Query User{B6E7CBB5-0EA6-4F6D-802E-1C12EAEF8492}C:\program files (x86)\starcraft ii\starcraft ii.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"TCP Query User{B76A1596-0257-4DE6-87CA-68072AE6011B}G:\andi\spiele\cryptic studios\star trek online\live\gameclient.exe" = protocol=6 | dir=in | app=g:\andi\spiele\cryptic studios\star trek online\live\gameclient.exe |
"TCP Query User{BA22550C-9C08-4DA4-BF50-E328A1FCFE18}C:\program files (x86)\starcraft ii\versions\base17326\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base17326\sc2.exe |
"TCP Query User{C95A9F0A-8425-4295-BFF7-8EBB2893688C}G:\andi\spiele\wow\temp\wow-4.3-5.0.15890-enus-downloader.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.3-5.0.15890-enus-downloader.exe |
"TCP Query User{CDC0E9B8-A38C-4F18-AC0B-1EC922702A69}C:\users\andreas dorn\appdata\roaming\utefa\segis.exe" = protocol=6 | dir=in | app=c:\users\andreas dorn\appdata\roaming\utefa\segis.exe |
"TCP Query User{D00BEFA2-B3E2-458A-85EB-E0C308B3A09F}C:\program files (x86)\world_of_tanks\wotlauncher.exe" = protocol=6 | dir=in | app=c:\program files (x86)\world_of_tanks\wotlauncher.exe |
"TCP Query User{D232EB22-D9C0-4F62-A3D5-B2A166F098FF}C:\users\andreas dorn\documents\world_of_tanks\worldoftanks.exe" = protocol=6 | dir=in | app=c:\users\andreas dorn\documents\world_of_tanks\worldoftanks.exe |
"TCP Query User{D5C827B9-349B-456A-AD89-311BF796A357}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe |
"TCP Query User{DC75B362-46F3-40BD-A547-65986581908E}G:\andi\spiele\wow\launcher.patch.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\launcher.patch.exe |
"TCP Query User{DD588CC7-9CEB-4D08-8F4F-4BF2D591ED55}C:\program files (x86)\starcraft ii\versions\base16939\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16939\sc2.exe |
"TCP Query User{E2955FE9-5234-454E-A4AB-B9A8FD15954E}G:\andi\spiele\wow\temp\wow-4.2.1.2685-enus-tools-downloader.exe" = protocol=6 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.2.1.2685-enus-tools-downloader.exe |
"TCP Query User{E2B647A5-F291-492F-A0FC-256ED53F1D5C}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe |
"TCP Query User{E7CDFDE3-D105-4FE7-BE81-94856DF5351F}C:\program files (x86)\diablo iii\diablo iii.exe" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"TCP Query User{F32061C8-0183-4129-8877-6E126BB149CD}E:\andi\spiele\wow\wow-3.3.5.12340-x86-win-dede-bkgnd-downloader.exe" = protocol=6 | dir=in | app=e:\andi\spiele\wow\wow-3.3.5.12340-x86-win-dede-bkgnd-downloader.exe |
"TCP Query User{F4C5AE7E-8FA0-4DA4-860E-603C16A5F011}E:\andi\spiele\wow\launcher.exe" = protocol=6 | dir=in | app=e:\andi\spiele\wow\launcher.exe |
"TCP Query User{F5E9A57D-FF60-44C3-B9DC-99B3AAD7F2E1}C:\program files (x86)\starcraft ii\versions\base18574\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18574\sc2.exe |
"TCP Query User{FDF1DAAC-D3DB-4E34-962A-12BB5465A877}C:\program files (x86)\starcraft ii\versions\base15405\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base15405\sc2.exe |
"TCP Query User{FEF06343-34E1-4CA0-A4DA-F29AEC827D6C}C:\program files (x86)\starcraft ii\versions\base19679\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base19679\sc2.exe |
"UDP Query User{013E49E2-4F31-4FFE-AE43-751E7073E644}C:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe |
"UDP Query User{06820AC0-D926-4A4B-BFFF-9264903CF8BD}G:\andi\spiele\wow\temp\wow-4.2.1.2706-enus-tools-downloader.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.2.1.2706-enus-tools-downloader.exe |
"UDP Query User{0E912057-2CBC-4DF8-8A55-C41E424EC1BE}C:\program files (x86)\starcraft ii\versions\base18092\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18092\sc2.exe |
"UDP Query User{178F81CF-F2DD-4FF4-9CEF-08DAAB3C19AE}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{1B3FAB04-304F-4322-90D6-76F72A9BDE37}G:\andi\spiele\wow\blizzard downloader.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\blizzard downloader.exe |
"UDP Query User{1C095D57-CD54-4474-A130-AD06473C0223}G:\andi\spiele\wow\temp\wow-4.3-5.0.15890-enus-downloader.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.3-5.0.15890-enus-downloader.exe |
"UDP Query User{1CA7CE0D-8284-4472-B55B-7667710AFA2B}C:\program files (x86)\starcraft ii\starcraft ii.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"UDP Query User{208569EC-9F91-4101-A938-DA59EAFD1B1C}C:\program files (x86)\starcraft ii\versions\base19679\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base19679\sc2.exe |
"UDP Query User{22F48B8E-8E3F-4F12-9CBB-34A4BB987603}C:\program files (x86)\spyware terminator\spywareterminatorupdate.exe" = protocol=17 | dir=in | app=c:\program files (x86)\spyware terminator\spywareterminatorupdate.exe |
"UDP Query User{23D3F0FC-9103-445B-860C-B408036E3878}G:\andi\world_of_tanks\worldoftanks.exe" = protocol=17 | dir=in | app=g:\andi\world_of_tanks\worldoftanks.exe |
"UDP Query User{263B96D7-E427-44BD-898B-C95385F496C2}C:\users\andreas dorn\documents\world_of_tanks\wotlauncher.exe" = protocol=17 | dir=in | app=c:\users\andreas dorn\documents\world_of_tanks\wotlauncher.exe |
"UDP Query User{2CE2252D-A184-4811-BA3C-4FB35AE1B74D}C:\users\andreas dorn\downloads\diablo-iii-8370-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\andreas dorn\downloads\diablo-iii-8370-dede-installer-downloader.exe |
"UDP Query User{2D47D8F9-9065-4E81-92CE-56E97FB9D42A}G:\andi\world_of_tanks\wotlauncher.exe" = protocol=17 | dir=in | app=g:\andi\world_of_tanks\wotlauncher.exe |
"UDP Query User{35A063EB-17C3-4E62-A09C-7EFF398BDC6B}G:\andi\spiele\wow\launcher.patch.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\launcher.patch.exe |
"UDP Query User{3CC307D7-F4DD-4DB2-B2CE-62F5DF6670EB}C:\program files (x86)\starcraft ii\versions\base16755\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16755\sc2.exe |
"UDP Query User{3CF787D2-8E06-4A86-81B0-DDCCC559186F}C:\program files (x86)\starcraft ii\versions\base19679\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base19679\sc2.exe |
"UDP Query User{3D47EE19-92A4-439F-B5FA-071CBB6AADEA}C:\program files (x86)\starcraft ii\versions\base16939\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16939\sc2.exe |
"UDP Query User{3E1F0168-4A44-436D-9412-67C52F6D12BE}C:\users\andreas dorn\appdata\roaming\utefa\segis.exe" = protocol=17 | dir=in | app=c:\users\andreas dorn\appdata\roaming\utefa\segis.exe |
"UDP Query User{406D059C-CE20-4EE9-A82F-C976D819B9AE}C:\program files (x86)\world_of_tanks\worldoftanks.exe" = protocol=17 | dir=in | app=c:\program files (x86)\world_of_tanks\worldoftanks.exe |
"UDP Query User{413F6014-9E08-4A71-8A0F-5D95537965C3}C:\program files (x86)\starcraft ii\versions\base15405\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base15405\sc2.exe |
"UDP Query User{450213DF-7AE0-464B-BF16-3A8592012771}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe |
"UDP Query User{47AAEBFA-98E0-43A6-9B3F-42506047D65E}G:\andi\spiele\wow\temp\wow-4.2.1.2727-enus-tools-downloader.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.2.1.2727-enus-tools-downloader.exe |
"UDP Query User{525C395A-CAD6-455D-9C53-19E47AFBA2AB}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe |
"UDP Query User{56D08FFD-89AE-4422-BD90-610F70F6E694}C:\users\andreas dorn\appdata\roaming\zawuna\lodo.exe" = protocol=17 | dir=in | app=c:\users\andreas dorn\appdata\roaming\zawuna\lodo.exe |
"UDP Query User{57BA13FA-449E-4765-AAF2-1AF08CD09E4F}E:\andi\spiele\wow\wow-3.3.5.12340-x86-win-dede-bkgnd-downloader.exe" = protocol=17 | dir=in | app=e:\andi\spiele\wow\wow-3.3.5.12340-x86-win-dede-bkgnd-downloader.exe |
"UDP Query User{5E165BDC-1325-4E2F-A474-3BEF3FED4BC5}C:\users\andreas dorn\appdata\roaming\utefa\segis.exe" = protocol=17 | dir=in | app=c:\users\andreas dorn\appdata\roaming\utefa\segis.exe |
"UDP Query User{5FA70499-E1A0-4D1B-83FE-4117B4F1D49B}G:\andi\spiele\wow\temp\wow-4.0.0.1807-to-4.0.0.2072-enus-tools-downloader.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.0.0.1807-to-4.0.0.2072-enus-tools-downloader.exe |
"UDP Query User{66A60BC7-106E-4BFB-B5B8-ED3C320C8BAD}C:\program files (x86)\starcraft ii\versions\base16755\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16755\sc2.exe |
"UDP Query User{68E9493F-5BAD-4ADB-9E69-D537B6C9C19E}C:\program files (x86)\agrar simulator 2011\farm.dll" = protocol=17 | dir=in | app=c:\program files (x86)\agrar simulator 2011\farm.dll |
"UDP Query User{8B579263-566C-49A1-B261-3C9917F28C62}G:\andi\spiele\wow\backgrounddownloader.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\backgrounddownloader.exe |
"UDP Query User{8C09A1E6-C6FB-4A7A-9D2A-D4879C69FC90}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe |
"UDP Query User{91A668C2-BCA8-45C3-9F41-90EFBC571D88}G:\andi\world_of_tanks\worldoftanks.exe" = protocol=17 | dir=in | app=g:\andi\world_of_tanks\worldoftanks.exe |
"UDP Query User{9764EF0A-0343-49A2-8610-2FDAE27144D2}G:\andi\spiele\cryptic studios\star trek online\live\gameclient.exe" = protocol=17 | dir=in | app=g:\andi\spiele\cryptic studios\star trek online\live\gameclient.exe |
"UDP Query User{9B41ADD1-1772-40FC-AACF-69BFDF3535B1}C:\program files (x86)\world_of_tanks\wotlauncher.exe" = protocol=17 | dir=in | app=c:\program files (x86)\world_of_tanks\wotlauncher.exe |
"UDP Query User{A001B441-8A4F-4022-A6F2-32F7B2751116}G:\andi\spiele\wow\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.2.1.2736-enus-tools-downloader.exe |
"UDP Query User{A2E4A2F3-A0EF-43C5-BB16-3A5DE998F662}C:\program files (x86)\starcraft ii\versions\base17326\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base17326\sc2.exe |
"UDP Query User{A3669582-1593-4C39-BED3-4A1A87324F5C}E:\andi\spiele\wow\blizzard downloader.exe" = protocol=17 | dir=in | app=e:\andi\spiele\wow\blizzard downloader.exe |
"UDP Query User{B03428A3-6949-47E0-9B7D-7D87F801CDA8}G:\andi\spiele\wow\launcher.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\launcher.exe |
"UDP Query User{B14A9FBF-9E2F-4D6F-AD69-575AC0DEE6DA}G:\andi\spiele\wow\launcher.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\launcher.exe |
"UDP Query User{B3BD6FBE-47A9-4A11-B599-A3271C1F840B}E:\andi\spiele\wow\backgrounddownloader.exe" = protocol=17 | dir=in | app=e:\andi\spiele\wow\backgrounddownloader.exe |
"UDP Query User{B516670C-4AB2-40EE-A73C-D39A651208BD}C:\users\andreas dorn\documents\world_of_tanks\worldoftanks.exe" = protocol=17 | dir=in | app=c:\users\andreas dorn\documents\world_of_tanks\worldoftanks.exe |
"UDP Query User{B722229A-BBB5-4268-B05C-E78A286BE582}G:\andi\world_of_tanks\wotlauncher.exe" = protocol=17 | dir=in | app=g:\andi\world_of_tanks\wotlauncher.exe |
"UDP Query User{BD84DAC4-FC1B-4F9A-9C07-670BB61AEF9C}C:\program files (x86)\starcraft ii\versions\base16561\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16561\sc2.exe |
"UDP Query User{C3A20688-82B1-4957-BB42-23C78A204CCB}C:\program files (x86)\starcraft ii\versions\base18574\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18574\sc2.exe |
"UDP Query User{C688147C-9B82-44BB-9800-F1AE963E4360}C:\program files (x86)\starcraft ii\versions\base16605\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16605\sc2.exe |
"UDP Query User{C81CBCFF-FB09-442D-8C23-AC493F6325C2}E:\andi\spiele\wow\backgrounddownloader.exe" = protocol=17 | dir=in | app=e:\andi\spiele\wow\backgrounddownloader.exe |
"UDP Query User{CE19CD9F-2EBC-4E05-8FB6-D0F619320E8D}C:\program files (x86)\starcraft ii\versions\base18574\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18574\sc2.exe |
"UDP Query User{D51A0111-6DF1-4E5B-A0B3-C6DF01A40777}C:\program files (x86)\starcraft ii\versions\base16939\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16939\sc2.exe |
"UDP Query User{D9BD39FF-C0D8-45DF-95D2-E4A1B862E073}E:\andi\spiele\wow\wow-2.1.1.1897-engb-tools-downloader.exe" = protocol=17 | dir=in | app=e:\andi\spiele\wow\wow-2.1.1.1897-engb-tools-downloader.exe |
"UDP Query User{DD530685-3813-43EE-8062-11AD78EA1AB2}E:\andi\spiele\wow\launcher.exe" = protocol=17 | dir=in | app=e:\andi\spiele\wow\launcher.exe |
"UDP Query User{E0187D03-5F64-4357-A7B9-7BE382DE435E}C:\program files (x86)\starcraft ii\versions\base19132\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base19132\sc2.exe |
"UDP Query User{E1A12971-E577-4624-A187-CBDB5B7F6AEE}G:\andi\spiele\wow\temp\wow-4.2.1.2685-enus-tools-downloader.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.2.1.2685-enus-tools-downloader.exe |
"UDP Query User{E66AB6F9-A36A-40F9-AE9D-069EDEF77824}G:\andi\spiele\wow\launcher.patch.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\launcher.patch.exe |
"UDP Query User{EB44BC41-1D27-46B0-BA2A-8FBD2B5797EC}G:\andi\spiele\wow\temp\wow-4.2.1.2730-enus-tools-downloader.exe" = protocol=17 | dir=in | app=g:\andi\spiele\wow\temp\wow-4.2.1.2730-enus-tools-downloader.exe |
"UDP Query User{ECFC9FA3-BFAE-4EB4-9226-DEF44532885B}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe |
"UDP Query User{EFA628AA-EBE1-4123-8DCB-D12EFBDF62B4}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe |
"UDP Query User{F394CF4A-923B-4C58-8D95-4B0150A0A6E6}G:\andi\spiele\cryptic studios\star trek online\live\gameclient.exe" = protocol=17 | dir=in | app=g:\andi\spiele\cryptic studios\star trek online\live\gameclient.exe |
"UDP Query User{F76A4DB6-5469-475C-8EAA-5887609BD855}C:\program files (x86)\diablo iii\diablo iii.exe" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"UDP Query User{FE341057-E8CB-4679-9A04-1596DCCD883B}C:\users\andreas dorn\appdata\roaming\zawuna\lodo.exe" = protocol=17 | dir=in | app=c:\users\andreas dorn\appdata\roaming\zawuna\lodo.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1444D2EE-C7AD-44A8-844F-2634B49353D1}" = Logitech Gaming Software 5.10
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}" = Überwachungstool für die Intel® Turbo-Boost-Technik
"{48C0866E-57EB-444C-8371-8E4321066BC3}" = Network64
"{4E484899-4F93-4086-88BA-56BDDF47A776}" = HP Photosmart Prem C310 All-In-One Driver Software 14.0 Rel. 7
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6BFAB6C1-6D46-46DB-A538-A269907C9F2F}" = Network64
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{852B1308-4E5A-B54D-637D-F710D92C6930}" = AMD Accelerated Video Transcoding
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{91C4D79C-3579-48E8-ADFA-8818042AEB73}" = Logitech G930
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{ABFC0970-7FDF-9E49-C049-5D24CB1F150E}" = AMD Catalyst Install Manager
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{DE7BAEF8-C639-381A-D835-95BD517ED602}" = AMD Media Foundation Decoders
"{E88AD18B-D467-F11F-C431-99DE36FCACC7}" = ccc-utility64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F972FD73-47FC-55F7-5EF1-8CA5311FF96E}" = AMD Drag and Drop Transcoding
"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer
"CCleaner" = CCleaner
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Shop for HP Supplies" = Shop for HP Supplies
"SynTPDeinstKey" = Synaptics Pointing Device Driver
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{08D9CAD3-48A1-4033-B794-82E97BE8E9CC}" = Arbortext IsoView 7.1
"{1087CF8A-F5B0-4E86-BE76-DB085EDFD834}" = Aion
"{11210BD7-A8EF-79EE-D18F-021D1E04A689}" = CCC Help Dutch
"{118AD615-8BCF-11D6-1700-B6763A0EA713}" = CCC Help Polish
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{145238D6-1ADD-15DD-4499-744215DCCD18}" = Catalyst Control Center InstallProxy
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{15DEA4E9-E4AD-2A1A-4B59-89CA65D5075B}" = CCC Help Finnish
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1AFD9DDB-FB24-F8C4-E792-03901C50490D}" = CCC Help Swedish
"{1B0FF612-0E07-4AB2-DD95-EB7651AEB3A1}" = CCC Help Italian
"{1CAC7A41-583B-4483-9FA5-3E5465AFF8C2}" = Microsoft Default Manager
"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1" = World of Tanks v.0.6.5
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{376A622B-F0FA-DDAB-9635-05D9F3F634D6}" = CCC Help Norwegian
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{46ED2B64-85C7-4E1F-920C-A555B21F2E4C}" = NVIDIA PhysX
"{48BA11B4-3E38-FA74-2D5A-003475844AA3}" = CCC Help Spanish
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4DD75A56-D9DA-DD49-3507-470C7CA7B43F}" = CCC Help Chinese Standard
"{4E79A60F-15D2-4BEC-91AD-E41EC42E61B0}" = Batman: Arkham Asylum
"{565E7B0E-B76B-4EAD-9753-F1E72A5CF12E}" = HPAppStudio
"{56736259-613E-4A3B-B428-6235F2E76F44}_is1" = Spyware Terminator 2012
"{582BA1F1-FAB4-41AD-A5E3-4A9535343461}" = PS_AIO_07_C310_SW_Min
"{5B025634-7D5B-4B8D-BE2A-7943C1CF2D5D}" = Status
"{5DB24244-5ABE-A87B-5FB1-95CF09F801A8}" = CCC Help German
"{5F0FF70C-5828-2178-4642-206D9F3B681F}" = Catalyst Control Center InstallProxy
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{61D73C02-EF3F-45D2-7F01-DCC4B1B39CC3}" = CCC Help Korean
"{62F7DA7E-CCCB-439C-A760-00C3926E761F}" = Microsoft Works
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6DDC515D-1FE6-C5FC-E872-24D1B8B4C1A1}" = CCC Help Russian
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{7427941A-51A3-E2EB-BCD2-A1981DBCA4AD}" = Catalyst Control Center Graphics Previews Common
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7760D94E-B1B5-40A0-9AA0-ABF942108755}" = Acer Crystal Eye Webcam
"{79A16F82-9F79-E47E-C6D4-206E7CC1D593}" = CCC Help Czech
"{7F4E3B2E-E724-464B-B11D-F3810B18D8D4}" = ProductView Express 9.1
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{8153BA0E-719E-3829-3B06-DC1412933BD6}" = CCC Help Japanese
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8B7D9B66-1B53-D729-FD0C-ED38629FA407}" = CCC Help Greek
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0017-0407-0000-0000000FF1CE}" = Microsoft Office SharePoint Designer MUI (German) 2007
"{90120000-0017-0407-0000-0000000FF1CE}_OMUI.de-de_{2733AA87-26FC-41B0-9D2F-3092345BC370}" = Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_OMUI.de-de_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_OMUI.de-de_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_OMUI.de-de_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_OMUI.de-de_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_OMUI.de-de_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_OMUI.de-de_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0100-0407-0000-0000000FF1CE}" = Microsoft Office O MUI (German) 2007
"{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0101-0407-0000-0000000FF1CE}" = Microsoft Office X MUI (German) 2007
"{90120000-0101-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{93B1814F-A37C-44B5-8988-7C6379FF5CF6}" = Document Express DjVu Plug-in
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A4A550A8-4EEF-8577-1C15-E3C914FF4AD9}" = CCC Help Portuguese
"{A866F37D-0E46-1812-3E3C-9778D4A458B2}" = Catalyst Control Center
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AAF7FFC8-20C4-CB57-4982-68EB410EBBC7}" = CCC Help Danish
"{ABEE079E-648E-488B-8301-0C3DB48C1BCE}_is1" = Acer GameZone Console
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.5.3 MUI
"{AC838E60-C5DB-3127-1743-E6789CC26C74}" = PX Profile Update
"{AD4B6B20-11CE-2C81-9615-2DCAABF15966}" = CCC Help French
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BC5DD87B-0143-4D14-AAE6-97109614DC6B}" = SolutionCenter
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{D1931310-EEF5-3B7A-0C57-01127888E4E4}" = CCC Help Turkish
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}" = DIE SIEDLER - Aufstieg eines Königreichs
"{D54640A3-2C2B-4CB1-9666-01E55F54E7F5}" = NCsoft Launcher
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}" = eBay Worldwide
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{E5EABF66-F9C4-430C-B97D-3CF28A58D50B}" = Alcor Micro USB Card Reader
"{E72F1051-B87E-4EF4-AE9F-8FDD229CC438}" = Catalyst Control Center - Branding
"{E7A94CD8-526B-FDD3-E16F-CB40A0747C70}" = CCC Help Chinese Traditional
"{E91BD0CF-EFA8-477C-8207-A026E70BBED9}" = CCC Help English
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{ECD4DCC1-C03F-8CC2-432B-317ECB9D6A09}" = Catalyst Control Center Localization All
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F9F07F00-FF55-7752-7FF8-F512AF641BA9}" = CCC Help Thai
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{FE651900-D014-482F-AEBC-2928F57D1FB0}" = C310
"{FFE0A7EE-0627-307D-F102-519B5B367703}" = CCC Help Hungarian
"7-Zip" = 7-Zip 9.20
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agrar Simulator 2011" = Agrar Simulator 2011
"Agrar Simulator 2012" = Agrar Simulator 2012
"Avira AntiVir Desktop" = Avira Free Antivirus
"Battle.net" = Battle.net
"Diablo III" = Diablo III
"FarmingSimulator2011DE_is1" = Landwirtschafts Simulator 2011
"FarmingSimulator2013DE_is1" = Landwirtschafts Simulator 2013
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Identity Card" = Identity Card
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{E5EABF66-F9C4-430C-B97D-3CF28A58D50B}" = Alcor Micro USB Card Reader
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"OMUI.de-de" = Microsoft Office Language Pack 2007 - German/Deutsch
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"StarCraft II" = StarCraft II
"Steam App 10" = Counter-Strike
"Steam App 200260" = Batman: Arkham City GOTY
"Steam App 205100" = Dishonored
"Steam App 208200" = DOOM 3: BFG Edition
"Steam App 20920" = The Witcher 2: Assassins of Kings Enhanced Edition
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Steam App 42910" = Magicka
"Steam App 47400" = Stronghold 3
"Steam App 50130" = Mafia II
"Steam App 72850" = The Elder Scrolls V: Skyrim
"Steam App 80" = Counter-Strike: Condition Zero
"Surf & E-Mail-Stick" = Surf & E-Mail-Stick
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"World of Warcraft" = World of Warcraft
"World of Warcraft Beta" = World of Warcraft Beta
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"TeamSpeak 3 Client" = TeamSpeak 3 Client
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 22.12.2012 10:31:18 | Computer Name = AndreasDorn-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files
(x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
AIR.dll" in Zeile 3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error - 22.12.2012 10:34:08 | Computer Name = AndreasDorn-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 22.12.2012 17:23:43 | Computer Name = AndreasDorn-PC | Source = MsiInstaller | ID = 11609
Description =
Error - 29.12.2012 18:00:30 | Computer Name = AndreasDorn-PC | Source = MsiInstaller | ID = 11609
Description =
Error - 04.01.2013 07:02:26 | Computer Name = AndreasDorn-PC | Source = RasClient | ID = 20227
Description =
Error - 04.01.2013 07:02:56 | Computer Name = AndreasDorn-PC | Source = RasClient | ID = 20227
Description =
Error - 04.01.2013 09:03:12 | Computer Name = AndreasDorn-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files
(x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
AIR.dll" in Zeile 3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error - 04.01.2013 09:05:36 | Computer Name = AndreasDorn-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 06.01.2013 16:09:47 | Computer Name = AndreasDorn-PC | Source = Application Hang | ID = 1002
Description = Programm launcher.exe, Version 0.9.0.822 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1e38 Startzeit:
01cdec49a4be52f8 Endzeit: 7 Anwendungspfad: C:\Program Files (x86)\Steam\steamapps\common\the
witcher 2\launcher.exe Berichts-ID:
Error - 07.01.2013 03:28:29 | Computer Name = AndreasDorn-PC | Source = MsiInstaller | ID = 11609
Description =
[ Media Center Events ]
Error - 11.11.2012 05:28:20 | Computer Name = AndreasDorn-PC | Source = MCUpdate | ID = 0
Description = 10:28:20 - Fehler beim Herstellen der Internetverbindung. 10:28:20
- Serververbindung konnte nicht hergestellt werden..
Error - 11.11.2012 05:28:36 | Computer Name = AndreasDorn-PC | Source = MCUpdate | ID = 0
Description = 10:28:26 - Fehler beim Herstellen der Internetverbindung. 10:28:26
- Serververbindung konnte nicht hergestellt werden..
[ System Events ]
Error - 16.01.2013 02:27:36 | Computer Name = AndreasDorn-PC | Source = DCOM | ID = 10010
Description =
Error - 16.01.2013 02:27:39 | Computer Name = AndreasDorn-PC | Source = DCOM | ID = 10010
Description =
Error - 16.01.2013 02:27:07 | Computer Name = AndreasDorn-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst eventlog erreicht.
Error - 16.01.2013 02:33:05 | Computer Name = AndreasDorn-PC | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error - 16.01.2013 11:44:46 | Computer Name = AndreasDorn-PC | Source = DCOM | ID = 10010
Description =
Error - 16.01.2013 12:12:47 | Computer Name = AndreasDorn-PC | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error - 16.01.2013 13:31:04 | Computer Name = AndreasDorn-PC | Source = Service Control Manager | ID = 7024
Description = Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem
Fehler beendet: %%-1073473535.
Error - 16.01.2013 13:31:04 | Computer Name = AndreasDorn-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits
1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt:
Neustart des Diensts.
Error - 16.01.2013 14:10:16 | Computer Name = AndreasDorn-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
CLHNServiceForPowerDVD12 erreicht.
Error - 16.01.2013 14:10:16 | Computer Name = AndreasDorn-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "CLHNServiceForPowerDVD12" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
< End of report >
He danke für die schnelle Antwort.. Mir ist klar, dass es nicht mal eben mit 5 Minuten getan ist, um die Dinger wieder los zu werden. Ich bin nur froh, dass es so ein Board wie eures gibt.. Lg |
|
19.01.2013, 15:28
| #5 | |
| /// Malwareteam | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 Schritt 1
Code:
ATTFilter :OTL
[2013.01.14 21:01:54 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Ykers
[2013.01.14 21:01:54 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Uzcav
[2013.01.14 21:01:54 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Hidi
[2013.01.14 14:34:15 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Fuocer
[2013.01.14 14:34:15 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Eholex
[2013.01.14 14:34:15 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Azriwo
[2013.01.14 14:00:08 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Impy
[2013.01.14 14:00:08 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Fuby
[2013.01.14 14:00:08 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Feop
[2013.01.13 22:59:00 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Utefa
[2013.01.13 22:59:00 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Cogoe
[2013.01.13 22:59:00 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Afduym
[2013.01.13 20:37:11 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Xeoge
[2013.01.13 20:37:11 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Qyiwg
[2013.01.13 20:37:11 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Efib
[2013.01.11 23:38:10 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Zawuna
[2013.01.11 23:38:10 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Elkiyb
[2013.01.11 23:38:10 | 000,000,000 | ---D | C] -- C:\Users\Andreas Dorn\AppData\Roaming\Avyf
[2013.01.17 20:36:59 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Utefa
[2013.01.16 07:18:28 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Uzcav
[2013.01.16 10:55:06 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Xeoge
[2013.01.14 21:01:54 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Ykers
[2013.01.16 07:18:28 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Yqijg
[2013.01.17 20:37:00 | 000,000,000 | ---D | M] -- C:\Users\Andreas Dorn\AppData\Roaming\Zawuna
:services
:files
C:\users\andreas dorn\appdata\roaming\zawuna\lodo.exe
C:\users\andreas dorn\appdata\roaming\utefa\segis.ex
:reg
:Commands
[purity]
[emptytemp]
Schritt 2 Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
|
|
19.01.2013, 20:28
| #6 |
| | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1Code:
ATTFilter All processes killed
========== OTL ==========
C:\Users\Andreas Dorn\AppData\Roaming\Ykers folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Uzcav folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Hidi folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Fuocer folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Eholex folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Azriwo folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Impy folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Fuby folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Feop folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Utefa folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Cogoe folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Afduym folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Xeoge folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Qyiwg folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Efib folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Zawuna folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Elkiyb folder moved successfully.
C:\Users\Andreas Dorn\AppData\Roaming\Avyf folder moved successfully.
Folder C:\Users\Andreas Dorn\AppData\Roaming\Utefa\ not found.
Folder C:\Users\Andreas Dorn\AppData\Roaming\Uzcav\ not found.
Folder C:\Users\Andreas Dorn\AppData\Roaming\Xeoge\ not found.
Folder C:\Users\Andreas Dorn\AppData\Roaming\Ykers\ not found.
C:\Users\Andreas Dorn\AppData\Roaming\Yqijg folder moved successfully.
Folder C:\Users\Andreas Dorn\AppData\Roaming\Zawuna\ not found.
========== SERVICES/DRIVERS ==========
========== FILES ==========
File\Folder C:\users\andreas dorn\appdata\roaming\zawuna\lodo.exe not found.
File\Folder C:\users\andreas dorn\appdata\roaming\utefa\segis.ex not found.
========== REGISTRY ==========
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Andreas Dorn
->Temp folder emptied: 42892496 bytes
->Temporary Internet Files folder emptied: 250654291 bytes
->Java cache emptied: 467729 bytes
->Flash cache emptied: 3172552 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 356352 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 783125 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50300 bytes
RecycleBin emptied: 3569 bytes
Total Files Cleaned = 285,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 01192013_201816
Files\Folders moved on Reboot...
C:\Users\Andreas Dorn\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Andreas Dorn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CP6BU7YG\129730-trojanische-pferd-tr-agent-57344-tr-spy-zbot-ifjz-1-a[1].htm moved successfully.
C:\Users\Andreas Dorn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CP6BU7YG\ads[1].htm moved successfully.
C:\Users\Andreas Dorn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CP6BU7YG\ads[2].htm moved successfully.
C:\Users\Andreas Dorn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Combofix Logfile: Code:
ATTFilter ComboFix 13-01-17.04 - Andreas Dorn 19.01.2013 20:34:25.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4028.2289 [GMT 1:00]
ausgeführt von:: c:\users\Andreas Dorn\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\users\Andreas Dorn\AppData\Local\._Revolution_
c:\users\Andreas Dorn\AppData\Local\assembly\tmp
c:\users\Andreas Dorn\AppData\Roaming\.#
c:\windows\IsUn0407.exe
c:\windows\SysWow64\URTTemp
c:\windows\SysWow64\URTTemp\regtlib.exe
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-12-19 bis 2013-01-19 ))))))))))))))))))))))))))))))
.
.
2013-01-19 19:43 . 2013-01-19 19:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-01-19 19:18 . 2013-01-19 19:18 -------- d-----w- C:\_OTL
2013-01-18 09:08 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{828B5ABC-B1E6-45F4-8ECE-F429CA43DA21}\mpengine.dll
2013-01-17 20:36 . 2013-01-17 20:36 -------- d-----w- c:\users\Andreas Dorn\AppData\Roaming\Malwarebytes
2013-01-17 20:35 . 2013-01-17 20:35 -------- d-----w- c:\programdata\Malwarebytes
2013-01-17 20:35 . 2013-01-17 20:35 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-01-17 20:35 . 2012-12-14 15:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-01-17 20:35 . 2013-01-17 20:35 -------- d-----w- c:\users\Andreas Dorn\AppData\Local\Programs
2013-01-17 08:05 . 2013-01-17 08:05 -------- d-----w- c:\program files (x86)\TeamSpeak3
2013-01-16 18:02 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2013-01-16 18:02 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys
2013-01-16 18:02 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll
2013-01-16 18:02 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll
2013-01-16 18:02 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll
2013-01-16 18:02 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2013-01-16 18:02 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2013-01-16 17:48 . 2013-01-18 15:01 -------- d-----w- c:\programdata\Spyware Terminator
2013-01-16 17:48 . 2013-01-16 17:48 51496 ----a-w- c:\windows\system32\drivers\stflt.sys
2013-01-16 17:48 . 2013-01-16 17:48 -------- d-----w- c:\users\Andreas Dorn\AppData\Roaming\Spyware Terminator
2013-01-16 17:47 . 2013-01-16 17:48 -------- d-----w- c:\program files (x86)\Spyware Terminator
2013-01-16 17:02 . 2013-01-16 17:02 -------- d-----w- c:\program files\CCleaner
2013-01-16 10:13 . 2013-01-16 10:13 -------- d-----w- c:\users\Andreas Dorn\AppData\Roaming\TeamViewer
2013-01-10 17:07 . 2013-01-10 17:07 -------- d-----w- c:\windows\Sun
2013-01-10 16:25 . 2013-01-10 18:47 -------- d-----w- c:\users\Andreas Dorn\AppData\Roaming\.minecraft
2013-01-10 16:25 . 2013-01-12 02:30 859552 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-01-10 16:25 . 2013-01-12 02:30 780192 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-01-09 15:52 . 2013-01-09 15:52 -------- d-----w- c:\users\Andreas Dorn\AppData\Local\Logitech
2013-01-09 15:47 . 2013-01-09 15:47 -------- d-----w- c:\program files\Common Files\Logitech
2013-01-09 08:57 . 2012-12-07 11:20 20480 ----a-w- c:\windows\system32\pegi-fi.rs
2013-01-09 08:57 . 2012-12-07 11:19 51712 ----a-w- c:\windows\system32\esrb.rs
2013-01-09 08:57 . 2012-12-07 10:46 20480 ----a-w- c:\windows\SysWow64\pegi-fi.rs
2013-01-09 08:57 . 2012-12-07 10:46 51712 ----a-w- c:\windows\SysWow64\esrb.rs
2013-01-09 08:57 . 2012-12-07 11:20 23552 ----a-w- c:\windows\system32\oflc.rs
2013-01-09 08:57 . 2012-12-07 11:19 55296 ----a-w- c:\windows\system32\cero.rs
2013-01-09 08:57 . 2012-12-07 10:46 23552 ----a-w- c:\windows\SysWow64\oflc.rs
2013-01-09 08:57 . 2012-12-07 10:46 55296 ----a-w- c:\windows\SysWow64\cero.rs
2013-01-09 08:52 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe
2013-01-09 08:51 . 2012-11-23 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys
2013-01-03 16:30 . 2013-01-03 16:30 -------- d-----w- c:\users\Andreas Dorn\AppData\Local\The Witcher 2
2012-12-20 21:41 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-20 21:41 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-20 21:41 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-20 21:41 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-09 18:16 . 2012-10-15 08:48 697864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-01-09 18:16 . 2011-10-04 14:42 74248 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-01-09 17:05 . 2010-07-23 20:44 67599240 ----a-w- c:\windows\system32\MRT.exe
2012-12-11 18:21 . 2012-11-03 16:57 99912 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-12-11 18:21 . 2012-11-03 16:57 129216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-11-30 04:45 . 2013-01-09 08:54 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2012-11-14 07:06 . 2012-12-13 19:33 17811968 ----a-w- c:\windows\system32\mshtml.dll
2012-11-14 06:32 . 2012-12-13 19:33 10925568 ----a-w- c:\windows\system32\ieframe.dll
2012-11-14 06:11 . 2012-12-13 19:33 2312704 ----a-w- c:\windows\system32\jscript9.dll
2012-11-14 06:04 . 2012-12-13 19:33 1346048 ----a-w- c:\windows\system32\urlmon.dll
2012-11-14 06:04 . 2012-12-13 19:33 1392128 ----a-w- c:\windows\system32\wininet.dll
2012-11-14 06:02 . 2012-12-13 19:33 1494528 ----a-w- c:\windows\system32\inetcpl.cpl
2012-11-14 06:02 . 2012-12-13 19:33 237056 ----a-w- c:\windows\system32\url.dll
2012-11-14 05:59 . 2012-12-13 19:33 85504 ----a-w- c:\windows\system32\jsproxy.dll
2012-11-14 05:58 . 2012-12-13 19:33 816640 ----a-w- c:\windows\system32\jscript.dll
2012-11-14 05:57 . 2012-12-13 19:33 599040 ----a-w- c:\windows\system32\vbscript.dll
2012-11-14 05:57 . 2012-12-13 19:33 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2012-11-14 05:55 . 2012-12-13 19:33 2144768 ----a-w- c:\windows\system32\iertutil.dll
2012-11-14 05:55 . 2012-12-13 19:33 729088 ----a-w- c:\windows\system32\msfeeds.dll
2012-11-14 05:53 . 2012-12-13 19:33 96768 ----a-w- c:\windows\system32\mshtmled.dll
2012-11-14 05:52 . 2012-12-13 19:33 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-11-14 05:46 . 2012-12-13 19:33 248320 ----a-w- c:\windows\system32\ieui.dll
2012-11-14 02:09 . 2012-12-13 19:33 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-11-14 01:58 . 2012-12-13 19:33 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2012-11-14 01:57 . 2012-12-13 19:33 1129472 ----a-w- c:\windows\SysWow64\wininet.dll
2012-11-14 01:49 . 2012-12-13 19:33 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-11-14 01:48 . 2012-12-13 19:33 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-11-14 01:44 . 2012-12-13 19:33 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-11-11 10:29 . 2012-09-15 18:02 893552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-11-11 10:29 . 2012-09-15 18:02 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-11-09 05:45 . 2012-12-12 22:00 2048 ----a-w- c:\windows\system32\tzres.dll
2012-11-09 04:42 . 2012-12-12 22:00 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2012-11-02 05:59 . 2012-12-12 21:59 478208 ----a-w- c:\windows\system32\dpnet.dll
2012-11-02 05:11 . 2012-12-12 21:59 376832 ----a-w- c:\windows\SysWow64\dpnet.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-12-24 284696]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-03-08 260608]
"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-28 642728]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-12-11 384800]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-03-03 1300560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-10-02 3064000]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-05-27 40448]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-11-06 50432]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 sxuptp;SXUPTP Driver;c:\windows\system32\DRIVERS\sxuptp.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-09-24 27800]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-09-28 239616]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-12-11 85280]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-03-03 325200]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-03-17 866336]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-12-24 13336]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-03-08 250368]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-11-06 144640]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys [2013-01-16 51496]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files (x86)\Spyware Terminator\st_rsser64.exe [2013-01-14 1149104]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-11-02 13784]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-01-18 75304]
S3 LADF_BakerCOnly;BakerC Filter Driver;c:\windows\system32\DRIVERS\ladfBakerCamd64.sys [2011-03-18 410184]
S3 LADF_BakerROnly;BakerR Filter Driver;c:\windows\system32\DRIVERS\ladfBakerRamd64.sys [2011-03-18 335688]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2013-01-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-15 18:16]
.
2013-01-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-11 16:37]
.
2013-01-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-11 16:37]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-03-17 860704]
"SpywareTerminatorShield"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe" [2013-01-14 2777736]
"SpywareTerminatorUpdater"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" [2013-01-14 3674248]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/ig?hl=de
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7745g&r=27360710s416l0423z145t45i1l785
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7745g&r=27360710s416l0423z145t45i1l785
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: amazon.de\www
Trusted Zone: cat.com\login
Trusted Zone: cat.com\sis
Trusted Zone: modhoster.de\www
Trusted Zone: uploaded.to
TCP: DhcpNameServer = 192.168.0.1
DPF: {865B2280-2B71-11D1-BC01-006097AC382A} - hxxps://sis.cat.com/sisfiles/plugin/isoview/isoview7.cab
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{795828a9-f271-43a8-8536-4484bb991d3d} - (no file)
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-PlayNC Launcher - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Toolbar-Locked - (no file)
WebBrowser-{795828A9-F271-43A8-8536-4484BB991D3D} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-01-19 20:46:11
ComboFix-quarantined-files.txt 2013-01-19 19:46
.
Vor Suchlauf: 10 Verzeichnis(se), 358.342.553.600 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 358.189.252.608 Bytes frei
.
- - End Of File - - 6CB2315F0468334D7B93EB06285254C5
|
|
20.01.2013, 11:06
| #7 |
| /// Malwareteam | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 Wie läuft die Kiste? Noch Probleme? |
|
21.01.2013, 08:15
| #8 |
| | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 Also wir haben heute Nacht noch mal einen kompletten AntiVir - Test durchlaufen lassen und danach noch einen Quick Scan mit Malwarebytes und es wurde nichts gefunden. Ich denk wir sind wieder clean  Danke dir!! Lg Achso.. die beiden Programme - OTL und Combofix kann ich wieder entfernen? Bekommst du was für deine Hilfe? |
|
21.01.2013, 11:16
| #9 | ||
| /// Malwareteam | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1ESET Online Scanner
Zitat:
 Zitat:
|
|
24.01.2013, 05:42
| #10 |
| | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 Ha und ich dachte schon wir sind am Schluss.. denkste.. das Programm hat was gefunden... Code:
ATTFilter C:\_OTL\MovedFiles\01192013_201816\C_Users\Andreas Dorn\AppData\Roaming\Eholex\geviw.exe a variant of Win32/Kryptik.ASDF trojan
C:\_OTL\MovedFiles\01192013_201816\C_Users\Andreas Dorn\AppData\Roaming\Feop\kexe.exe a variant of Win32/Kryptik.ASDF trojan
|
|
24.01.2013, 17:52
| #11 |
| /// Malwareteam | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 Ja das sind die Dateien welche bereits durch uns in die OTL Quarantäne geschossen wurden Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann. |
|
30.01.2013, 22:04
| #12 |
| | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 Ich habe alles gem. deinen Anweisungen gemacht. Ich werd auf jeden Fall deine Software-Ratschläge beherzigen. Ich persönlich nutze auch den Mozilla Firefox als Browser - mal sehen, ob ich meinen Freund überreden kann sein "Interface" noch mal unter dem neuen Browser aufzusetzen  Bez. registry cleaner - was hälst du von ccCleaner? Das Programm haben wir beide drauf.. Tja ansonsten sag ich nur vielen vielen Dank. Ich bin froh, dass es dieses Board gibt und Leute, bei denen man sich sicher aufgehoben fühlt. Lg Conny |
|
31.01.2013, 09:09
| #13 |
| /// Malwareteam | Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 Hallo und Danke für die netten Worte. cCleaner nutze ich persönlich auch. Aber ich würde auch damit nicht die Registry bereinigen. Es ist einfach viel zu heikel. |
|
| Themen zu Trojanische Pferd TR/Agent.57344, TR/Spy.ZBot.ifjz.1 |
| administrator, autostart, avira, cc cleaner, ccc.exe, dateien, desktop, dllhost.exe, explorer, explorer.exe, home, iexplore.exe, lsass.exe, löschen, malwarebytes, microsoft, mom.exe, namen, online banking, programm, service.exe, services.exe, software, spyware, svchost.exe, taskhost.exe, temp, tr/spy.zbot.ifjz.1, trojanische pferd tr/agent.57344, virus, winlogon.exe, wmp |
Textbox.
Linear-Darstellung
