| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: windows defender-warnung Adware: win32/PriceGongWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.02.2013, 11:35
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  windows defender-warnung Adware: win32/PriceGong Eine Kontrolle mit OTL bitte:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
01.02.2013, 11:59
| #17 |
 | windows defender-warnung Adware: win32/PriceGongCode:
ATTFilter OTL logfile created on: 01.02.2013 11:43:32 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\User\Desktop Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,87 Gb Total Physical Memory | 1,23 Gb Available Physical Memory | 65,91% Memory free 3,75 Gb Paging File | 2,96 Gb Available in Paging File | 78,94% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 186,21 Gb Total Space | 162,63 Gb Free Space | 87,34% Space Free | Partition Type: NTFS Computer Name: USER-PC | User Name: User | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\User\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_5_502_146.exe (Adobe Systems, Inc.) PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - c:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) PRC - c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.) PRC - C:\Windows\System32\lxbkcoms.exe ( ) ========== Modules (No Company Name) ========== MOD - C:\Programme\Mozilla Firefox\mozjs.dll () MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_5_502_146.dll () MOD - C:\Programme\Brother\BrUtilities\BrLogAPI.dll () ========== Services (SafeList) ========== SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (NisSrv) -- c:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) SRV - (MsMpSvc) -- c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (lxbk_device) -- C:\Windows\System32\lxbkcoms.exe ( ) ========== Driver Services (SafeList) ========== DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation) DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation) DRV - (dmvsc) -- C:\Windows\System32\drivers\dmvsc.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 66 9B BF 18 6A 6A CD 01 [binary data] IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\..\SearchScopes\{0768B102-C597-4F9A-9897-6466689E368D}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^VK^DE&apn_uid=ff7705f4-8b55-4db8-841f-5e7f1abcb143&apn_sauid=55A49354-A2CE-4D8E-919D-F3EEEDFF2C4A IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Google" FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.19 08:28:27 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.19 08:28:27 | 000,000,000 | ---D | M] [2012.10.28 08:31:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Extensions [2013.01.31 22:43:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions [2012.10.30 17:47:26 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} [2012.10.28 13:00:02 | 000,000,000 | ---D | M] (Search-Results Toolbar) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions\{f34c9277-6577-4dff-b2d7-7d58092f272f} [2012.11.19 21:59:24 | 000,000,000 | ---D | M] ("Savings Sidekick") -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions\crossriderapp5060@crossrider.com [2012.11.19 21:59:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions\crossriderapp5060@crossrider.com\chrome\content\extensionCode [2013.01.28 14:08:39 | 000,002,413 | ---- | M] () -- C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\ru8rp87g.default\searchplugins\askcom.xml [2012.10.28 08:31:49 | 000,002,687 | ---- | M] () -- C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\ru8rp87g.default\searchplugins\Search_Results.xml [2013.01.19 08:28:23 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2013.01.19 08:28:27 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.07.14 01:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.09 23:35:46 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.07.14 01:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.07.14 01:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.14 01:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.14 01:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{02F5E2CD-156A-49A5-9211-1461C4C16440}: DhcpNameServer = 192.168.2.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.02.01 00:23:42 | 000,000,000 | ---D | C] -- C:\Users\User\Neuer Ordner (2) [2013.01.30 12:20:26 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\User\Desktop\aswMBR.exe [2013.01.29 23:15:39 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\mbar-1.01.0.1017 [2013.01.29 23:15:06 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR [2013.01.29 23:15:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR [2013.01.29 23:13:18 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\WinRAR [2013.01.29 23:12:59 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR [2013.01.29 09:33:16 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe [2013.01.28 20:38:17 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client [2013.01.27 21:23:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Sophos [2013.01.27 19:59:47 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\DoNotTrackPlus [2013.01.27 18:15:14 | 000,000,000 | ---D | C] -- C:\Program Files\Emsisoft Anti-Malware [2013.01.27 15:37:41 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Malwarebytes [2013.01.27 15:37:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.01.27 15:37:10 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\Programs [2013.01.27 14:50:35 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\Wajam [2013.01.26 21:12:15 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\TuneUp Software [2013.01.26 21:11:35 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software [2013.01.26 21:11:21 | 000,000,000 | -HSD | C] -- C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} [2013.01.26 21:11:21 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2013.01.26 20:37:56 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\SpeedMaxPc [2013.01.26 20:37:56 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\DriverCure [2013.01.26 20:37:47 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedMaxPc [2013.01.19 08:28:23 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013.01.14 15:11:14 | 000,000,000 | ---D | C] -- C:\Users\User\Neuer Ordner [2013.01.09 22:25:08 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2013.01.09 22:24:53 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe [2013.01.09 22:24:53 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll [2013.01.09 22:24:53 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll [2013.01.09 22:24:53 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll [2013.01.09 22:24:53 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll [2013.01.09 22:24:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll [2013.01.09 22:24:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll [2013.01.09 22:24:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll [2013.01.09 22:24:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll [2013.01.09 22:24:52 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll [2013.01.09 22:24:52 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll [2013.01.09 22:24:52 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll [2013.01.09 22:24:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll [2013.01.09 22:24:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll [2013.01.09 22:24:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll [2013.01.09 22:24:31 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\System32\fpb.rs [2013.01.09 22:24:31 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\System32\oflc-nz.rs [2013.01.09 22:24:31 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\System32\pegibbfc.rs [2013.01.09 22:24:31 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\System32\csrr.rs [2013.01.09 22:24:31 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\System32\cob-au.rs [2013.01.09 22:24:31 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\System32\djctq.rs [2013.01.09 22:24:30 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll [2013.01.09 22:24:30 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wpc.dll [2013.01.09 22:24:30 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\System32\usk.rs [2013.01.09 22:24:30 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\System32\grb.rs [2013.01.09 22:24:30 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi-pt.rs [2013.01.09 22:24:30 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi.rs [2013.01.09 22:24:29 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\System32\cero.rs [2013.01.09 22:24:29 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\System32\esrb.rs [2013.01.09 22:24:29 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\System32\oflc.rs [2013.01.09 22:24:29 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi-fi.rs [2013.01.09 22:24:20 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll [2013.01.09 22:24:19 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe ========== Files - Modified Within 30 Days ========== [2013.02.01 10:49:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.02.01 09:52:48 | 000,021,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.02.01 09:52:48 | 000,021,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.02.01 09:45:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.02.01 09:45:26 | 1508,761,600 | -HS- | M] () -- C:\hiberfil.sys [2013.01.31 22:34:27 | 000,580,235 | ---- | M] () -- C:\Users\User\Desktop\adwcleaner.exe [2013.01.31 17:50:28 | 000,047,176 | ---- | M] () -- C:\Users\User\AppData\Local\recently-used.xbel [2013.01.30 12:21:33 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\User\Desktop\aswMBR.exe [2013.01.30 11:53:21 | 000,232,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2013.01.30 11:31:28 | 000,365,568 | ---- | M] () -- C:\Users\User\Desktop\gmer_2.0.18454.exe [2013.01.29 23:09:21 | 001,609,146 | ---- | M] () -- C:\Users\User\Desktop\wrar420d.exe [2013.01.29 22:57:33 | 013,562,257 | ---- | M] () -- C:\Users\User\Desktop\mbar-1.01.0.1017.zip [2013.01.29 09:33:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe [2013.01.28 23:20:25 | 000,001,134 | ---- | M] () -- C:\Users\User\Desktop\Windows Update Troubleshooting Info.lnk [2013.01.28 20:38:36 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif [2013.01.20 14:48:00 | 008,800,730 | ---- | M] () -- C:\Users\User\Desktop\DSCI0706 - Kopie.xcf [2013.01.14 22:17:39 | 012,860,560 | ---- | M] () -- C:\Users\User\Desktop\DSCI0706.xcf [2013.01.14 20:27:24 | 002,366,224 | ---- | M] () -- C:\Users\User\Desktop\DSCI0719.JPG [2013.01.14 20:26:36 | 002,242,184 | ---- | M] () -- C:\Users\User\Desktop\DSCI0717.JPG [2013.01.14 18:31:48 | 002,171,030 | ---- | M] () -- C:\Users\User\Desktop\DSCI0706.JPG [2013.01.14 18:31:48 | 002,171,030 | ---- | M] () -- C:\Users\User\Desktop\DSCI0706 - Kopie.JPG [2013.01.14 16:33:09 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.01.14 16:33:09 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.01.14 16:33:09 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.01.14 16:33:09 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.01.10 10:31:30 | 000,295,272 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013.01.08 22:49:12 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013.01.08 22:49:12 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2013.01.05 12:21:00 | 002,181,667 | ---- | M] () -- C:\Users\User\Desktop\DSCI0617.JPG [2013.01.05 12:10:34 | 002,358,966 | ---- | M] () -- C:\Users\User\Desktop\DSCI0621.JPG ========== Files Created - No Company Name ========== [2013.01.31 22:34:17 | 000,580,235 | ---- | C] () -- C:\Users\User\Desktop\adwcleaner.exe [2013.01.31 17:50:28 | 000,047,176 | ---- | C] () -- C:\Users\User\AppData\Local\recently-used.xbel [2013.01.31 17:49:13 | 002,303,493 | ---- | C] () -- C:\Users\User\Desktop\DSCI0026.JPG [2013.01.30 11:31:25 | 000,365,568 | ---- | C] () -- C:\Users\User\Desktop\gmer_2.0.18454.exe [2013.01.29 23:09:19 | 001,609,146 | ---- | C] () -- C:\Users\User\Desktop\wrar420d.exe [2013.01.29 22:43:38 | 013,562,257 | ---- | C] () -- C:\Users\User\Desktop\mbar-1.01.0.1017.zip [2013.01.28 23:20:24 | 000,001,134 | ---- | C] () -- C:\Users\User\Desktop\Windows Update Troubleshooting Info.lnk [2013.01.28 20:38:24 | 000,002,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk [2013.01.28 19:34:25 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif [2013.01.24 20:58:01 | 002,242,184 | ---- | C] () -- C:\Users\User\Desktop\DSCI0717.JPG [2013.01.24 20:57:54 | 002,366,224 | ---- | C] () -- C:\Users\User\Desktop\DSCI0719.JPG [2013.01.20 14:48:00 | 008,800,730 | ---- | C] () -- C:\Users\User\Desktop\DSCI0706 - Kopie.xcf [2013.01.14 22:17:39 | 012,860,560 | ---- | C] () -- C:\Users\User\Desktop\DSCI0706.xcf [2013.01.14 17:33:17 | 002,171,030 | ---- | C] () -- C:\Users\User\Desktop\DSCI0706 - Kopie.JPG [2013.01.14 16:33:20 | 002,171,030 | ---- | C] () -- C:\Users\User\Desktop\DSCI0706.JPG [2013.01.05 12:05:17 | 002,358,966 | ---- | C] () -- C:\Users\User\Desktop\DSCI0621.JPG [2013.01.05 10:09:59 | 002,181,667 | ---- | C] () -- C:\Users\User\Desktop\DSCI0617.JPG [2012.12.14 08:26:19 | 000,019,120 | ---- | C] () -- C:\Users\User\Pflegeplanung Fr. Dringenberg (sich kleiden).odt [2012.12.13 22:28:51 | 000,022,118 | ---- | C] () -- C:\Users\User\Pflegeplanung Fr. Dringenberg 2.odt [2012.08.31 19:48:15 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI [2012.08.31 19:45:43 | 000,000,050 | ---- | C] () -- C:\Windows\System32\bridf08b.dat [2012.08.31 19:43:14 | 000,031,864 | ---- | C] () -- C:\Windows\maxlink.ini [2012.08.29 17:22:59 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\lxbkserv.dll [2012.08.29 17:22:59 | 000,991,232 | ---- | C] ( ) -- C:\Windows\System32\lxbkusb1.dll [2012.08.29 17:22:59 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\lxbkhbn3.dll [2012.08.29 17:22:59 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxbkcomc.dll [2012.08.29 17:22:59 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\lxbkpmui.dll [2012.08.29 17:22:59 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\lxbklmpm.dll [2012.08.29 17:22:59 | 000,537,256 | ---- | C] ( ) -- C:\Windows\System32\lxbkcoms.exe [2012.08.29 17:22:59 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\lxbkcomm.dll [2012.08.29 17:22:59 | 000,413,696 | ---- | C] () -- C:\Windows\System32\lxbkutil.dll [2012.08.29 17:22:59 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\lxbkinpa.dll [2012.08.29 17:22:59 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\lxbkiesc.dll [2012.08.29 17:22:59 | 000,385,704 | ---- | C] ( ) -- C:\Windows\System32\lxbkih.exe [2012.08.29 17:22:59 | 000,381,608 | ---- | C] ( ) -- C:\Windows\System32\lxbkcfg.exe [2012.08.29 17:22:59 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\LXBKhcp.dll [2012.08.29 17:22:59 | 000,274,432 | ---- | C] () -- C:\Windows\System32\LXBKinst.dll [2012.08.29 17:22:59 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\lxbkprox.dll [2012.08.29 17:22:59 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\lxbkpplc.dll [2012.07.25 12:27:06 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.07.25 12:27:06 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2012.07.02 19:28:06 | 000,112,640 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2012.06.09 18:21:56 | 000,178,688 | ---- | C] () -- C:\Windows\System32\unrar.dll [2012.05.30 10:52:20 | 004,305,920 | ---- | C] () -- C:\Windows\System32\x264vfw.dll [2012.05.21 17:28:58 | 000,155,648 | ---- | C] () -- C:\Windows\System32\mlc.dll [2011.12.07 22:32:24 | 000,216,064 | ---- | C] ( ) -- C:\Windows\System32\lagarith.dll [2011.06.10 05:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll ========== ZeroAccess Check ========== [2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 22:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both < End of report > Code:
ATTFilter OTL Extras logfile created on: 01.02.2013 11:43:33 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\User\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,87 Gb Total Physical Memory | 1,23 Gb Available Physical Memory | 65,91% Memory free
3,75 Gb Paging File | 2,96 Gb Available in Paging File | 78,94% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 186,21 Gb Total Space | 162,63 Gb Free Space | 87,34% Space Free | Partition Type: NTFS
Computer Name: USER-PC | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-496433643-2467896711-3733903686-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DB9C6DF-38D7-45BC-840D-D02CC5AEAB4C}" = lport=10243 | protocol=6 | dir=in | app=system |
"{1498069B-5CA0-4A9E-82B5-A7EB2862F941}" = lport=445 | protocol=6 | dir=in | app=system |
"{224FD338-A0A1-4C16-A4CB-95F9C41F47FF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2C11CDA8-29E1-40B6-AB2B-2E493349A491}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3C07EA9A-AAA2-4F25-BDF5-90D9A9D35B04}" = lport=137 | protocol=17 | dir=in | app=system |
"{43D776CC-C1B6-4D28-8AB1-DA8932A5D0F5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{494A2B3C-1B95-4819-BC29-493CF8C118FF}" = rport=139 | protocol=6 | dir=out | app=system |
"{52BB2A13-801B-407D-9687-4F456C358631}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7ED175E4-BE40-42AC-9662-ED14F44636FC}" = lport=139 | protocol=6 | dir=in | app=system |
"{9287E2AB-863E-49EF-9532-06675FFB38A9}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AEB22FA9-348F-4DD7-B67D-6D0C06BDEBBD}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B3EADA9A-54A4-4F24-9823-50905BC50D46}" = rport=445 | protocol=6 | dir=out | app=system |
"{C6EEECAD-FB9E-4A81-96E7-AEB92B246277}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C965E518-D55E-491D-BDDE-A7F811B94CE9}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CB98CD8C-2881-4821-AB5B-AB346E8297A0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CE44A170-F091-4FAE-A455-2EBEEF82D4B5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CFE35158-6962-46B3-954A-F9876AA1AAFB}" = rport=10243 | protocol=6 | dir=out | app=system |
"{DB3B42F2-C44D-438C-AD2F-4D8E921A2DC6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{E01C9863-95FF-487C-9897-C3628F3EE346}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{E5C0EE1C-7A33-4E80-8A2D-C30EC328B3B1}" = lport=138 | protocol=17 | dir=in | app=system |
"{F731C5FC-DD8C-48C7-86CB-9291F386F265}" = rport=138 | protocol=17 | dir=out | app=system |
"{FD0CA052-899A-43A6-8D3F-C848117723C3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FEE68C10-08DB-4346-BE24-5966887DE19C}" = rport=137 | protocol=17 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{245AB4E7-7641-469C-A4B8-F5D32B8D088D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{26EBD43C-5774-4B40-835A-21DB3DA2446B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{2AC4D246-A478-43B6-9597-715F64BE48FF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{31C77F40-CD3E-478F-8BB8-5040843DA83B}" = protocol=6 | dir=in | app=c:\windows\system32\lxbkcoms.exe |
"{32471F73-F49C-48EB-94E7-354124B7A214}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{348A7A5E-949A-4374-A1F8-D4836462D2C6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{55184736-EC02-40E3-970E-FDA80BD2580D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{63A66F03-236A-4C95-A10A-AD0003353824}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{713DF4F3-4312-44E8-966E-1228A0CFCA88}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{7240B8A2-F865-45A1-94AD-2F6AECA7728B}" = protocol=6 | dir=out | app=system |
"{87CEA4FE-192E-478E-BBE2-2DEAA0537329}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3CC0DC-833C-4CD9-AB04-306B54657C18}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{ADE93D21-B62C-4B0E-B362-60C12F7C883D}" = protocol=17 | dir=in | app=c:\windows\system32\lxbkcoms.exe |
"{BCA07F97-97F4-4542-9447-583891F43125}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E5B11030-CDB7-4584-BB55-D2B1F95BE7D2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F02244AA-6469-4CBE-82A5-7DF828FD9274}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FA9CA164-4199-4D61-8CD6-B83E9398C024}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{FC662D9D-9810-4F1B-9455-1F8DCD29AA31}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}" = ScanSoft PaperPort 11
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{26A24AE4-039D-4CA4-87B4-2F83217010FF}" = Java 7 Update 10
"{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}" = OpenOffice.org 3.4
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{6BF66AED-3EA4-4106-B240-5CE96C9B76B0}" = Brother MFL-Pro Suite DCP-195C
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C0CAA7A-3272-4991-A808-2C7559DE3409}" = Win7codecs
"{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}" = Microsoft Security Client
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.5) - Deutsch
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"GIMP-2_is1" = GIMP 2.8.0
"Lexmark X1100 Series" = Lexmark X1100 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"VLC media player" = VLC media player 2.0.0-rc1-20120127-0244
"WinRAR archiver" = WinRAR 4.20 (32-Bit)
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 31.01.2013 00:12:19 | Computer Name = User-PC | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/01/31 05:12:19.649]: [00001700]: CUsbScnDev: DeviceIoControl()
failed. ErrorCode = 5
Error - 31.01.2013 00:12:20 | Computer Name = User-PC | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/01/31 05:12:20.649]: [00001700]: CUsbScnDev: DeviceIoControl()
failed. ErrorCode = 5
Error - 31.01.2013 00:50:56 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 31.01.2013 02:22:13 | Computer Name = User-PC | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/01/31 07:22:13.234]: [00001912]: CUsbScnDev: DeviceIoControl()
failed. ErrorCode = 5
Error - 31.01.2013 02:33:00 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 31.01.2013 11:06:23 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 31.01.2013 16:07:16 | Computer Name = User-PC | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/01/31 21:07:16.500]: [00001760]: CUsbScnDev: DeviceIoControl()
failed. ErrorCode = 5
Error - 31.01.2013 17:41:47 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 31.01.2013 19:36:39 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 01.02.2013 04:47:18 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 26.11.2012 17:18:25 | Computer Name = User-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 27.11.2012 00:11:31 | Computer Name = User-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 27.11.2012 02:06:59 | Computer Name = User-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst ShellHWDetection erreicht.
Error - 27.11.2012 11:41:47 | Computer Name = User-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 27.11.2012 18:00:03 | Computer Name = User-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst AntiVirSchedulerService erreicht.
Error - 28.11.2012 03:05:27 | Computer Name = User-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 28.11.2012 03:11:02 | Computer Name = User-PC | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error - 28.11.2012 03:19:28 | Computer Name = User-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80070643 fehlgeschlagen: Definition Update for Windows Defender - KB915597
(Definition 1.141.523.0)
Error - 28.11.2012 08:43:20 | Computer Name = User-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 28.11.2012 17:07:13 | Computer Name = User-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst ShellHWDetection erreicht.
< End of report >
|
|
01.02.2013, 12:03
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | windows defender-warnung Adware: win32/PriceGongFixen mit OTL
Code:
ATTFilter :OTL
IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\..\SearchScopes\{0768B102-C597-4F9A-9897-6466689E368D}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^VK^DE&apn_uid=ff7705f4-8b55-4db8-841f-5e7f1abcb143&apn_sauid=55A49354-A2CE-4D8E-919D-F3EEEDFF2C4A
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.startup.homepage: "http://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE"
FF - user.js - File not found
[2012.10.30 17:47:26 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
[2012.10.28 13:00:02 | 000,000,000 | ---D | M] (Search-Results Toolbar) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions\{f34c9277-6577-4dff-b2d7-7d58092f272f}
[2012.11.19 21:59:24 | 000,000,000 | ---D | M] ("Savings Sidekick") -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions\crossriderapp5060@crossrider.com
[2013.01.28 14:08:39 | 000,002,413 | ---- | M] () -- C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\ru8rp87g.default\searchplugins\askcom.xml
[2012.10.28 08:31:49 | 000,002,687 | ---- | M] () -- C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\ru8rp87g.default\searchplugins\Search_Results.xml
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
__________________ |
|
01.02.2013, 12:28
| #19 |
| | windows defender-warnung Adware: win32/PriceGong Hallo...habe alles so gemacht wie du gesagt hast...nach neustart ist kein texdukoment zu finden...soll ich FIXEN mit OTL wiederholen????? "textdokument"  |
|
01.02.2013, 13:40
| #20 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | windows defender-warnung Adware: win32/PriceGong Selbstverständlich hast du auch manuell nachgesehen? Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.02.2013, 13:49
| #21 |
| | windows defender-warnung Adware: win32/PriceGong Jeep...habe ich ---> ES wurden keine Suchergebnisse gefunden. Mache das jetzt gleich nochmal....fixen mit OTL.... so jetzt ging es Code:
ATTFilter All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-496433643-2467896711-3733903686-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0768B102-C597-4F9A-9897-6466689E368D}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0768B102-C597-4F9A-9897-6466689E368D}\ not found.
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE" removed from browser.startup.homepage
Folder C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\ not found.
Folder C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions\{f34c9277-6577-4dff-b2d7-7d58092f272f}\ not found.
Folder C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions\crossriderapp5060@crossrider.com\ not found.
File C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\ru8rp87g.default\searchplugins\askcom.xml not found.
File C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\ru8rp87g.default\searchplugins\Search_Results.xml not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\User\Desktop\cmd.bat deleted successfully.
C:\Users\User\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Public
User: User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 9534259 bytes
->Flash cache emptied: 492 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3064 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 9,00 mb
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.69.0 log created on 02012013_135033
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
XML-Verarbeitungsfehler: Adresse: file:///C:/Users/User/Desktop/Sitzungswiederherstellung.xht Zeile Nr. 247, Spalte 300: <tree xmlns="hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="tabList" flex="1" seltype="single" hidecolumnpicker="true" onclick="onListClick(event);" onkeydown="onListKeyDown(event);" _window_label="Fenster %S" hidevscroll="true" hidehscroll="true" clickthrough="never"> -------------------------------------------------------------------------------------------------- da war noch ein Fenster ...da stand irgenwas von Trojaner...und PriceGong (ist plötzlich verschwunden...finde ich nicht mehr) was is das denn jetzt schon wieder  |
|
06.02.2013, 10:38
| #22 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | windows defender-warnung Adware: win32/PriceGong Eine neue Kontrolle mit OTL bitte:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.02.2013, 10:52
| #23 |
| | windows defender-warnung Adware: win32/PriceGong Hallo...das ging aber schnell  Ay, ay, Käpt'n Cosinus...geht gleich los  Code:
ATTFilter OTL logfile created on: 06.02.2013 10:54:38 - Run 4 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\User\Desktop Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,87 Gb Total Physical Memory | 1,38 Gb Available Physical Memory | 73,61% Memory free 3,75 Gb Paging File | 3,09 Gb Available in Paging File | 82,42% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 186,21 Gb Total Space | 162,57 Gb Free Space | 87,30% Space Free | Partition Type: NTFS Computer Name: USER-PC | User Name: User | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\User\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - c:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) PRC - c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.) PRC - C:\Windows\System32\lxbkcoms.exe ( ) ========== Modules (No Company Name) ========== MOD - C:\Programme\Brother\BrUtilities\BrLogAPI.dll () ========== Services (SafeList) ========== SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (NisSrv) -- c:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) SRV - (MsMpSvc) -- c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (lxbk_device) -- C:\Windows\System32\lxbkcoms.exe ( ) ========== Driver Services (SafeList) ========== DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation) DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation) DRV - (dmvsc) -- C:\Windows\System32\drivers\dmvsc.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 66 9B BF 18 6A 6A CD 01 [binary data] IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-496433643-2467896711-3733903686-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Google" FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.search.order.1: "" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.06 06:52:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.06 06:52:33 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.10.28 08:31:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Extensions [2013.02.01 12:12:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\ru8rp87g.default\extensions [2013.02.06 06:51:52 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2013.02.06 06:52:33 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.07.14 01:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.09 23:35:46 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.07.14 01:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.07.14 01:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.14 01:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.14 01:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2013.02.01 13:50:36 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{02F5E2CD-156A-49A5-9211-1461C4C16440}: DhcpNameServer = 192.168.2.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.02.06 06:51:52 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013.02.01 12:12:43 | 000,000,000 | ---D | C] -- C:\_OTL [2013.02.01 00:23:42 | 000,000,000 | ---D | C] -- C:\Users\User\Trojaner- Board [2013.01.30 12:20:26 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\User\Desktop\aswMBR.exe [2013.01.29 23:15:06 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR [2013.01.29 23:15:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR [2013.01.29 23:13:18 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\WinRAR [2013.01.29 23:12:59 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR [2013.01.29 09:33:16 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe [2013.01.28 20:38:17 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client [2013.01.27 21:23:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Sophos [2013.01.27 19:59:47 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\DoNotTrackPlus [2013.01.27 18:15:14 | 000,000,000 | ---D | C] -- C:\Program Files\Emsisoft Anti-Malware [2013.01.27 15:37:41 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Malwarebytes [2013.01.27 15:37:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.01.27 15:37:10 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\Programs [2013.01.27 14:50:35 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\Wajam [2013.01.26 21:12:15 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\TuneUp Software [2013.01.26 21:11:35 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software [2013.01.26 21:11:21 | 000,000,000 | -HSD | C] -- C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} [2013.01.26 21:11:21 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2013.01.26 20:37:56 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\SpeedMaxPc [2013.01.26 20:37:56 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\DriverCure [2013.01.26 20:37:47 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedMaxPc [2013.01.14 15:11:14 | 000,000,000 | ---D | C] -- C:\Users\User\Neuer Ordner [2013.01.09 22:25:08 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2013.01.09 22:24:53 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe [2013.01.09 22:24:53 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll [2013.01.09 22:24:53 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll [2013.01.09 22:24:53 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll [2013.01.09 22:24:53 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll [2013.01.09 22:24:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll [2013.01.09 22:24:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll [2013.01.09 22:24:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll [2013.01.09 22:24:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll [2013.01.09 22:24:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll [2013.01.09 22:24:52 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll [2013.01.09 22:24:52 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll [2013.01.09 22:24:52 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll [2013.01.09 22:24:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll [2013.01.09 22:24:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll [2013.01.09 22:24:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll [2013.01.09 22:24:31 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\System32\fpb.rs [2013.01.09 22:24:31 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\System32\oflc-nz.rs [2013.01.09 22:24:31 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\System32\pegibbfc.rs [2013.01.09 22:24:31 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\System32\csrr.rs [2013.01.09 22:24:31 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\System32\cob-au.rs [2013.01.09 22:24:31 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\System32\djctq.rs [2013.01.09 22:24:30 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll [2013.01.09 22:24:30 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wpc.dll [2013.01.09 22:24:30 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\System32\usk.rs [2013.01.09 22:24:30 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\System32\grb.rs [2013.01.09 22:24:30 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi-pt.rs [2013.01.09 22:24:30 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi.rs [2013.01.09 22:24:29 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\System32\cero.rs [2013.01.09 22:24:29 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\System32\esrb.rs [2013.01.09 22:24:29 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\System32\oflc.rs [2013.01.09 22:24:29 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi-fi.rs [2013.01.09 22:24:20 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll [2013.01.09 22:24:19 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe ========== Files - Modified Within 30 Days ========== [2013.02.06 10:49:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.02.06 10:05:54 | 000,280,760 | ---- | M] () -- C:\Users\User\Desktop\j-altenpfleger.jpg [2013.02.06 09:24:07 | 000,021,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.02.06 09:24:07 | 000,021,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.02.06 09:16:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.02.06 09:16:50 | 1508,761,600 | -HS- | M] () -- C:\hiberfil.sys [2013.02.02 10:23:53 | 000,047,169 | ---- | M] () -- C:\Users\User\AppData\Local\recently-used.xbel [2013.02.01 13:50:36 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts [2013.01.31 22:34:27 | 000,580,235 | ---- | M] () -- C:\Users\User\Desktop\adwcleaner.exe [2013.01.30 12:21:33 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\User\Desktop\aswMBR.exe [2013.01.30 11:53:21 | 000,232,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2013.01.30 11:31:28 | 000,365,568 | ---- | M] () -- C:\Users\User\Desktop\gmer_2.0.18454.exe [2013.01.29 23:09:21 | 001,609,146 | ---- | M] () -- C:\Users\User\Desktop\wrar420d.exe [2013.01.29 22:57:33 | 013,562,257 | ---- | M] () -- C:\Users\User\Desktop\mbar-1.01.0.1017.zip [2013.01.29 09:33:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe [2013.01.28 23:20:25 | 000,001,134 | ---- | M] () -- C:\Users\User\Desktop\Windows Update Troubleshooting Info.lnk [2013.01.28 20:38:36 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif [2013.01.14 16:33:09 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.01.14 16:33:09 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.01.14 16:33:09 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.01.14 16:33:09 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.01.10 10:31:30 | 000,295,272 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013.01.08 22:49:12 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013.01.08 22:49:12 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl ========== Files Created - No Company Name ========== [2013.02.06 10:05:53 | 000,280,760 | ---- | C] () -- C:\Users\User\Desktop\j-altenpfleger.jpg [2013.02.02 10:23:53 | 000,047,169 | ---- | C] () -- C:\Users\User\AppData\Local\recently-used.xbel [2013.01.31 22:34:17 | 000,580,235 | ---- | C] () -- C:\Users\User\Desktop\adwcleaner.exe [2013.01.30 11:31:25 | 000,365,568 | ---- | C] () -- C:\Users\User\Desktop\gmer_2.0.18454.exe [2013.01.29 23:09:19 | 001,609,146 | ---- | C] () -- C:\Users\User\Desktop\wrar420d.exe [2013.01.29 22:43:38 | 013,562,257 | ---- | C] () -- C:\Users\User\Desktop\mbar-1.01.0.1017.zip [2013.01.28 23:20:24 | 000,001,134 | ---- | C] () -- C:\Users\User\Desktop\Windows Update Troubleshooting Info.lnk [2013.01.28 20:38:24 | 000,002,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk [2013.01.28 19:34:25 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif [2012.12.14 08:26:19 | 000,019,120 | ---- | C] () -- C:\Users\User\Pflegeplanung Fr. Dringenberg (sich kleiden).odt [2012.12.13 22:28:51 | 000,022,118 | ---- | C] () -- C:\Users\User\Pflegeplanung Fr. Dringenberg 2.odt [2012.08.31 19:48:15 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI [2012.08.31 19:45:43 | 000,000,050 | ---- | C] () -- C:\Windows\System32\bridf08b.dat [2012.08.31 19:43:14 | 000,031,864 | ---- | C] () -- C:\Windows\maxlink.ini [2012.08.29 17:22:59 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\lxbkserv.dll [2012.08.29 17:22:59 | 000,991,232 | ---- | C] ( ) -- C:\Windows\System32\lxbkusb1.dll [2012.08.29 17:22:59 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\lxbkhbn3.dll [2012.08.29 17:22:59 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxbkcomc.dll [2012.08.29 17:22:59 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\lxbkpmui.dll [2012.08.29 17:22:59 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\lxbklmpm.dll [2012.08.29 17:22:59 | 000,537,256 | ---- | C] ( ) -- C:\Windows\System32\lxbkcoms.exe [2012.08.29 17:22:59 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\lxbkcomm.dll [2012.08.29 17:22:59 | 000,413,696 | ---- | C] () -- C:\Windows\System32\lxbkutil.dll [2012.08.29 17:22:59 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\lxbkinpa.dll [2012.08.29 17:22:59 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\lxbkiesc.dll [2012.08.29 17:22:59 | 000,385,704 | ---- | C] ( ) -- C:\Windows\System32\lxbkih.exe [2012.08.29 17:22:59 | 000,381,608 | ---- | C] ( ) -- C:\Windows\System32\lxbkcfg.exe [2012.08.29 17:22:59 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\LXBKhcp.dll [2012.08.29 17:22:59 | 000,274,432 | ---- | C] () -- C:\Windows\System32\LXBKinst.dll [2012.08.29 17:22:59 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\lxbkprox.dll [2012.08.29 17:22:59 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\lxbkpplc.dll [2012.07.25 12:27:06 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.07.25 12:27:06 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2012.07.02 19:28:06 | 000,112,640 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2012.06.09 18:21:56 | 000,178,688 | ---- | C] () -- C:\Windows\System32\unrar.dll [2012.05.30 10:52:20 | 004,305,920 | ---- | C] () -- C:\Windows\System32\x264vfw.dll [2012.05.21 17:28:58 | 000,155,648 | ---- | C] () -- C:\Windows\System32\mlc.dll [2011.12.07 22:32:24 | 000,216,064 | ---- | C] ( ) -- C:\Windows\System32\lagarith.dll [2011.06.10 05:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll ========== ZeroAccess Check ========== [2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 22:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both < End of report > Code:
ATTFilter OTL Extras logfile created on: 06.02.2013 10:54:39 - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\User\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,87 Gb Total Physical Memory | 1,38 Gb Available Physical Memory | 73,61% Memory free
3,75 Gb Paging File | 3,09 Gb Available in Paging File | 82,42% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 186,21 Gb Total Space | 162,57 Gb Free Space | 87,30% Space Free | Partition Type: NTFS
Computer Name: USER-PC | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-496433643-2467896711-3733903686-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DB9C6DF-38D7-45BC-840D-D02CC5AEAB4C}" = lport=10243 | protocol=6 | dir=in | app=system |
"{1498069B-5CA0-4A9E-82B5-A7EB2862F941}" = lport=445 | protocol=6 | dir=in | app=system |
"{224FD338-A0A1-4C16-A4CB-95F9C41F47FF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2C11CDA8-29E1-40B6-AB2B-2E493349A491}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3C07EA9A-AAA2-4F25-BDF5-90D9A9D35B04}" = lport=137 | protocol=17 | dir=in | app=system |
"{43D776CC-C1B6-4D28-8AB1-DA8932A5D0F5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{494A2B3C-1B95-4819-BC29-493CF8C118FF}" = rport=139 | protocol=6 | dir=out | app=system |
"{52BB2A13-801B-407D-9687-4F456C358631}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7ED175E4-BE40-42AC-9662-ED14F44636FC}" = lport=139 | protocol=6 | dir=in | app=system |
"{9287E2AB-863E-49EF-9532-06675FFB38A9}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AEB22FA9-348F-4DD7-B67D-6D0C06BDEBBD}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B3EADA9A-54A4-4F24-9823-50905BC50D46}" = rport=445 | protocol=6 | dir=out | app=system |
"{C6EEECAD-FB9E-4A81-96E7-AEB92B246277}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C965E518-D55E-491D-BDDE-A7F811B94CE9}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CB98CD8C-2881-4821-AB5B-AB346E8297A0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CE44A170-F091-4FAE-A455-2EBEEF82D4B5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CFE35158-6962-46B3-954A-F9876AA1AAFB}" = rport=10243 | protocol=6 | dir=out | app=system |
"{DB3B42F2-C44D-438C-AD2F-4D8E921A2DC6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{E01C9863-95FF-487C-9897-C3628F3EE346}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{E5C0EE1C-7A33-4E80-8A2D-C30EC328B3B1}" = lport=138 | protocol=17 | dir=in | app=system |
"{F731C5FC-DD8C-48C7-86CB-9291F386F265}" = rport=138 | protocol=17 | dir=out | app=system |
"{FD0CA052-899A-43A6-8D3F-C848117723C3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FEE68C10-08DB-4346-BE24-5966887DE19C}" = rport=137 | protocol=17 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{245AB4E7-7641-469C-A4B8-F5D32B8D088D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{26EBD43C-5774-4B40-835A-21DB3DA2446B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{2AC4D246-A478-43B6-9597-715F64BE48FF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{31C77F40-CD3E-478F-8BB8-5040843DA83B}" = protocol=6 | dir=in | app=c:\windows\system32\lxbkcoms.exe |
"{32471F73-F49C-48EB-94E7-354124B7A214}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{348A7A5E-949A-4374-A1F8-D4836462D2C6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{55184736-EC02-40E3-970E-FDA80BD2580D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{63A66F03-236A-4C95-A10A-AD0003353824}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{713DF4F3-4312-44E8-966E-1228A0CFCA88}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{7240B8A2-F865-45A1-94AD-2F6AECA7728B}" = protocol=6 | dir=out | app=system |
"{87CEA4FE-192E-478E-BBE2-2DEAA0537329}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3CC0DC-833C-4CD9-AB04-306B54657C18}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{ADE93D21-B62C-4B0E-B362-60C12F7C883D}" = protocol=17 | dir=in | app=c:\windows\system32\lxbkcoms.exe |
"{BCA07F97-97F4-4542-9447-583891F43125}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E5B11030-CDB7-4584-BB55-D2B1F95BE7D2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F02244AA-6469-4CBE-82A5-7DF828FD9274}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FA9CA164-4199-4D61-8CD6-B83E9398C024}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{FC662D9D-9810-4F1B-9455-1F8DCD29AA31}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}" = ScanSoft PaperPort 11
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{26A24AE4-039D-4CA4-87B4-2F83217010FF}" = Java 7 Update 10
"{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}" = OpenOffice.org 3.4
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{6BF66AED-3EA4-4106-B240-5CE96C9B76B0}" = Brother MFL-Pro Suite DCP-195C
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C0CAA7A-3272-4991-A808-2C7559DE3409}" = Win7codecs
"{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}" = Microsoft Security Client
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.5) - Deutsch
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"GIMP-2_is1" = GIMP 2.8.0
"Lexmark X1100 Series" = Lexmark X1100 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 18.0.2 (x86 de)" = Mozilla Firefox 18.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"VLC media player" = VLC media player 2.0.0-rc1-20120127-0244
"WinRAR archiver" = WinRAR 4.20 (32-Bit)
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 04.02.2013 00:05:09 | Computer Name = User-PC | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/02/04 05:05:09.609]: [00001724]: CUsbScnDev: DeviceIoControl()
failed. ErrorCode = 5
Error - 04.02.2013 08:21:27 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 04.02.2013 10:03:41 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 04.02.2013 16:12:58 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 04.02.2013 23:14:25 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 05.02.2013 08:04:50 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 05.02.2013 10:08:35 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 05.02.2013 14:15:17 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 06.02.2013 00:37:41 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 06.02.2013 04:18:43 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 27.11.2012 00:11:31 | Computer Name = User-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 27.11.2012 02:06:59 | Computer Name = User-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst ShellHWDetection erreicht.
Error - 27.11.2012 11:41:47 | Computer Name = User-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 27.11.2012 18:00:03 | Computer Name = User-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst AntiVirSchedulerService erreicht.
Error - 28.11.2012 03:05:27 | Computer Name = User-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 28.11.2012 03:11:02 | Computer Name = User-PC | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error - 28.11.2012 03:19:28 | Computer Name = User-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80070643 fehlgeschlagen: Definition Update for Windows Defender - KB915597
(Definition 1.141.523.0)
Error - 28.11.2012 08:43:20 | Computer Name = User-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 28.11.2012 17:07:13 | Computer Name = User-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst ShellHWDetection erreicht.
Error - 29.11.2012 14:32:51 | Computer Name = User-PC | Source = DCOM | ID = 10010
Description =
< End of report >
|
|
06.02.2013, 11:37
| #24 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | windows defender-warnung Adware: win32/PriceGong Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.02.2013, 12:34
| #25 |
| | windows defender-warnung Adware: win32/PriceGong kurze Frage...muss "Microsoft Security Essentials" auch aus??? Wenn ja...einfach nur den Echtzeitschutz ausschalten, oder  meinte jetzt beim ESET Malwarebytes Anti-Malware (Test) 1.70.0.1100 www.malwarebytes.org Datenbank Version: v2013.02.06.04 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 User :: USER-PC [Administrator] Schutz: Aktiviert 06.02.2013 12:18:09 mbam-log-2013-02-06 (12-18-09).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 194418 Laufzeit: 3 Minute(n), 51 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
06.02.2013, 12:52
| #26 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | windows defender-warnung Adware: win32/PriceGong Nochmal: Die Logs bitte in CODE-Tags!! 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.02.2013, 12:59
| #27 |
| | windows defender-warnung Adware: win32/PriceGong ups...sorry  Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.70.0.1100 www.malwarebytes.org Datenbank Version: v2013.02.06.04 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 User :: USER-PC [Administrator] Schutz: Aktiviert 06.02.2013 12:18:09 mbam-log-2013-02-06 (12-18-09).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 194418 Laufzeit: 3 Minute(n), 51 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
06.02.2013, 14:14
| #28 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | windows defender-warnung Adware: win32/PriceGong Ok  was ist mit ESET?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.02.2013, 14:26
| #29 | |
| | windows defender-warnung Adware: win32/PriceGong der ESET Online Scanner ist durchgelaufen (ca 30 min.)...aber leider ist kein gespeichertes Log zu finden...auch nicht unter: C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt)  Ich versuch es heute Abend noch einmal...muss jetzt zur Arbeit..... Vielen Dank schon mal für deine Hilfe  sorry...ich kann dir das Log von ESET leider nicht posten...obwohl ich alles nach Anleitung gemacht habe ---> erster Suchlauf heut Nachmittag (ca. 30 min.) , danach konnte ich nirgends ein gespeichertes Log finden. ---> habe heute Abend nochmal einen Scan gemacht auch ca. 30 min...nach Finish drücken ist das Fenster verschwunden und just...ein ein neues Fenster hat sich geöffnet und mir mitgeteilt: „Das Programm wurde nicht richtig installiert.“ Ich muss schon sagen....dass ist ja wirklich früh aufgefallen!!! Und ein Log ist auch nirgends zu finden. Hab das ESET deinstalliert und neu gedownloadet . ---> der Scan lief wie gehabt ca 30 min.  leider auch kein Log zu finden.... Zitat:
|
|
08.02.2013, 22:37
| #30 |
| | windows defender-warnung Adware: win32/PriceGong Hallo Cosinus...wollte grad Eset deinstallieren...aber es funzt nicht  deinstalliert sich ESET von selbst???? Es es öffnet sich beim Versuch immer ein Fenster: Bei der Deinstallation von ESET Online Scanner v3 ist ein Fehler aufgetreten. Möglicherweise wurde es bereits deinstalliert. ---> ich bins nicht gewesen!!!! Möchten Sie ESET ESET Online Scanner v3 aus der Liste Programme und Funktionen entfernen? Erst rückt es keine Logs raus (s.o. letzter Eintrag) und jetzt bekomme ich es nicht weg  ist das normal????kann ich es einfach aus der Liste löschen????...oder ist da wieder was kaputt??? Ich sag schon mal Geändert von Daydream (08.02.2013 um 22:53 Uhr) |
|
| Themen zu windows defender-warnung Adware: win32/PriceGong |
| adware, anti, anweisung, arten, bereinigen, emsisoft, entfernen, erschein, erscheint, folge, folgendes, gefunde, gelöscht, html/framer.do.78, malware, malwarebytes, melde, meldet, meldung, starte, starten, tagen, warnmeldung, win32/pricegong, windows |
Textbox. 
Linear-Darstellung
