| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrtWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.04.2013, 18:40
| #1 |
 |  Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Hallo zusammen, ich habe ein rießiges Problem ,ich war in Internet und habe etwas gesurft und dan kam ... kein Internetzugang mehr diese Meldung habe ich geschlossen bin auf das x gegangen und paar Sekunden später kommt noch eine Meldung von der GVU ich hätte ein Gesetzt gebrochen von den Urhebern und muss nun eine Strafe von 100 € zahlen innerhalb von 72 stunden oder ich werde Strafrechtlich verfolgt und muss zusätzlich nochmals eine Strafe zahlen . Diese Seite sieht ziemlich echt aus mit dem Logo der Bundespolizei und dem Logo des Deutschen Adlers von der GVU und von Interpol und natürlich von dem zahlungscode da steht paysafecard anfordern von netto, shell, edeka, Rossmann usw.im Wert von 100 € und ein Feld wo ich den Gutscheincode eingeben muss. Ich kann nichts mehr machen wenn ich meinen PC hochfahre kommt kurz meine Anmeldung für diesen PC (Passwort) und mein Hintergrundbild bevor alles weiß wird und die Strafseite erscheint kann danach nichts mehr machen . Schreibe gerade von dem PC meiner Schwester und wir haben uns etwas umgehört im Web und haben erfahren das es eventuell ein Trojanischer Virus ist und die GVU rät auf ihrer Homepage wir sollen auf keinen Fall zahlen.Also kann uns jemand weiterhelfen ich habe etwas bammel. Ich habe windows7 lg nicco hxxp://blog.botfrei.de/2012/03/gvu-trojaner-ihr-computer-wurde-von-der-gvu-gesperrt/ So sieht es wage aus damit ihr es euch etwas vorstellen könnt: hxxp://www.google.de/imgres?q=virus+gvu+entfernen&um=1&hl=de&sa=N&biw=1280&bih=643&tbm=isch&tbnid=nZZFaSJw6MYTSM:&imgrefurl=hxxp://www.popscreen.com/v/66twL/BundespolizeiBKAVirus-GEMAGVUTrojaner-entfernen-CHIP&docid=9fujhwZJTyYeEM&imgurl=hxxp://v014o.popscreen.com/S3VScWY4QnhyY1kx_o_bundespolizeibka-virus-gemagvu-trojaner-entfernen-chip.jpg&w=480&h=360&ei=ZwBjUaK2I4X54QSp_oGoCg&zoom=1&iact=rc&dur=124&page=1&tbnh=133&tbnw=178&start=0&ndsp=19&ved=1t:429,r:15,s:0,i:127&tx=92&ty=49 Geändert von Nicco (08.04.2013 um 18:59 Uhr) |
|
08.04.2013, 19:02
| #2 |
| /// Malwareteam   |  Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Mein Name ist Heiko.  Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen. Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies kann bis zu 24h dauern... Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst. Ich bedanke mich für deine Geduld  Handelt es sich um eine 32bit oder 64 bit Version von Windows? Da brauchst du keinen bammel haben oder treibt dich das "schlechte" Gewissen ...
__________________ Geändert von Aneri (08.04.2013 um 19:18 Uhr) |
|
08.04.2013, 19:22
| #3 |
| | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Guten Abend Heiko,
__________________ich danke dir für die schnelle Rückmeldung. Mein Laptop hat die 64bit Version von Windows 7 Home. Allerdings muss ich gestehen das ich nicht wirklich viel Ahnung von PC/Laptops habe, wie man die wieder auf die Reihe bekommt ist für mich reines chinesisch. Nur das du Bescheid weißt, falls ich öffters Mal eventuell nachfragen muss, was gemeint ist.  Liebe Grüße Nicco |
|
08.04.2013, 19:28
| #4 |
| /// Malwareteam | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Keine Sorge, meine Antwort an dich ist bei meinem Ausbilder zur Freigabe |
|
08.04.2013, 19:33
| #5 |
| | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Vielen Dank noch einmal ! LG Nicco |
|
08.04.2013, 20:35
| #6 |
| /// Malwareteam | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrtDie Bereinigung deines Systems ist individuell auf dich zugeschnitten und mitunter mit viel Arbeit für uns beide verbunden. Bitte Lesen:Regeln für die Bereinigung Eine Bereinigung beinhaltet nebst dem Entfernen von Malware auch das Schließn von Sicherheitslücken und sollte gründlich durchgeführt werden. Sie erfolgt deshalb in mehreren Schritten und bedeutet einigen Aufwand für dich. Beachte: Das Verschwinden der offensichtlichen Symptome bedeutet nicht, dass das System schon sauber ist. Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du mit der abarbeitung der Schritte beginnst.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg. Dann fangen wir mal mit Schritt 1 an:
__________________ --> Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt |
|
09.04.2013, 06:56
| #7 |
| | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Guten Morgen erstmal nun ich habe mir das gründlich durchgelesen und werde es versuchen ,werde erst am Abend wieder Posten oder wenn schwierigkeiten auftauchen und danke für die nette hilfe lg nicco also habe es heruntergeladen und uf stick gezogen bin in Modus drinen aber wenn es um das öffnen des stickes geht bzw die datei funktioniert das nicht 4. Starten des Scans mit FRST In den Systemwiederherstellungsoptionen haben wir auch verschiedene Möglichkeiten. Wenn du es nicht getan hast, verbinde jetzt deinen präparierten Stick mit dem Computer und warte einen Moment bis er erkannt wurde. Zum Starten von FRST wähle Eingabeaufforderung (rote Markierung). Es öffnet sich ein schwarzes Fenster mit weißer Schrift. Du mußt nun den Laufwerksbuchstaben des USB-Sticks raten. C: ist normalerweise deine Festplatte. Gib D: ein und drücke Enter. Hat der Laufwerkswechsel nicht geklappt erhälst du einen Fehler. Probiere dann den nächst höheren Buchstaben aus. Hast du den Stick gefunden, starte FRST durch Eingabe von frst (enter) oder frst64 (enter) je nach Variante (eine wird funktionieren). das geht nicht ´sobald ich D:_/>frst.exe oder frst64.exe eingebe kommt immer der Satz "Der Befehl so und so ist falsch konnte nicht gefunden werden " was nun ? |
|
09.04.2013, 10:56
| #8 |
| /// Malwareteam | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Hallo Nicco das Laufwerk wechselst du mit dem Befehl (falls du unter d: nicht fündig wirst must du den nächsten Buchstaben versuchen... wir können dir nicht sagen unter welchem Buchstaben du das Laufwerk findest...) Code:
ATTFilter d:
gib dann im zweiten Schritt folgenden Befehl ein Code:
ATTFilter frst64.exe
|
|
09.04.2013, 17:31
| #9 |
| | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Guten Abend Heiko, anbei die FRST-Textdatei, hoffe das es dich weiterbringt und ich es richtig gemacht habe! LG Nicco Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 13-03-2013 (ATTENTION: FRST version is 27 days old)
Ran by SYSTEM at 09-04-2013 18:25:06
Running from G:\
Windows 7 Home Premium (X64) OS Language: German Standard
The current controlset is ControlSet001
==================== Registry (Whitelisted) ===================
HKLM\...\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-26] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [10920552 2010-06-22] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [337264 2010-05-26] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d [201584 2010-03-10] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" [407920 2010-03-10] (Egis Technology Inc.)
HKLM-x32\...\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-02-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k [265984 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.)
HKLM-x32\...\Run: [UIExec] "C:\Users\nicole\Desktop\bilder\Join Air\UIExec.exe" [132608 2009-08-31] ()
HKLM-x32\...\Run: [] [x]
HKLM-x32\...\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" [1568976 2012-06-20] (Ask)
HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.)
HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-01-14] ()
HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-01-14] ()
HKU\nicole\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized [17418928 2012-07-13] (Skype Technologies S.A.)
HKU\nicole\...\Run: [LightShot] C:\Users\nicole\AppData\Local\Skillbrains\lightshot\LightShot.exe Flags: uninsdeletevalue [195072 2011-03-16] ()
HKU\nicole\...\Winlogon: [Shell] explorer.exe,C:\Users\nicole\AppData\Roaming\skype.dat [72704 2011-11-16] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-01-14] ()
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
AppInit_DLLs: C:\Windows\system32\nvinitx.dll
Startup: C:\ProgramData\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
==================== Services (Whitelisted) ===================
2 AntiVirSchedulerService; "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" [86224 2012-05-01] (Avira Operations GmbH & Co. KG)
2 AntiVirService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" [110032 2012-05-01] (Avira Operations GmbH & Co. KG)
2 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE" [465360 2012-05-01] (Avira Operations GmbH & Co. KG)
2 BrowserProtect; C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [2550224 2013-01-16] ()
3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-26] (Egis Technology Inc.)
2 NOBU; "C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" SERVICE [2804568 2010-06-01] (Symantec Corporation)
2 UI Assistant Service; C:\Users\nicole\Desktop\bilder\Join Air\AssistantServices.exe [241664 2009-08-31] ()
==================== Drivers (Whitelisted) =====================
2 avgntflt; C:\Windows\System32\Drivers\avgntflt.sys [98848 2012-04-24] (Avira GmbH)
1 avipbb; C:\Windows\System32\Drivers\avipbb.sys [132832 2012-04-27] (Avira GmbH)
1 avkmgr; C:\Windows\System32\Drivers\avkmgr.sys [27760 2012-05-02] (Avira GmbH)
2 TurboB; C:\Windows\System32\Drivers\TurboB.sys [13784 2009-11-02] ()
==================== NetSvcs (Whitelisted) ====================
==================== One Month Created Files and Folders ========
2013-04-09 18:25 - 2013-04-09 18:25 - 00000000 ____D C:\FRST
2013-04-09 08:32 - 2013-04-09 08:33 - 00000000 ____A C:\Recovery.txt
2013-04-08 08:47 - 2013-04-08 09:59 - 00000004 ____A C:\Users\nicole\AppData\Roaming\skype.ini
2013-03-27 01:11 - 2013-02-11 20:12 - 00019968 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usb8023.sys
2013-03-13 14:27 - 2013-02-01 23:31 - 17815040 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-03-13 14:27 - 2013-02-01 22:58 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-03-13 14:27 - 2013-02-01 22:57 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-03-13 14:27 - 2013-02-01 22:48 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-03-13 14:27 - 2013-02-01 22:47 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-03-13 14:27 - 2013-02-01 22:47 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-03-13 14:27 - 2013-02-01 22:46 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-03-13 14:27 - 2013-02-01 22:43 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-03-13 14:27 - 2013-02-01 22:42 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-03-13 14:27 - 2013-02-01 22:42 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-03-13 14:27 - 2013-02-01 22:41 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-03-13 14:27 - 2013-02-01 22:40 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-03-13 14:27 - 2013-02-01 22:39 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-03-13 14:27 - 2013-02-01 22:38 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-03-13 14:27 - 2013-02-01 22:38 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-03-13 14:27 - 2013-02-01 22:34 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-03-13 14:27 - 2013-02-01 20:09 - 12321792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-03-13 14:27 - 2013-02-01 19:42 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-03-13 14:27 - 2013-02-01 19:38 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-03-13 14:27 - 2013-02-01 19:31 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-03-13 14:27 - 2013-02-01 19:30 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-03-13 14:27 - 2013-02-01 19:30 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-03-13 14:27 - 2013-02-01 19:29 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-03-13 14:27 - 2013-02-01 19:27 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-03-13 14:27 - 2013-02-01 19:26 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-03-13 14:27 - 2013-02-01 19:26 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-03-13 14:27 - 2013-02-01 19:26 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-03-13 14:27 - 2013-02-01 19:25 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-03-13 14:27 - 2013-02-01 19:23 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-03-13 14:27 - 2013-02-01 19:23 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-03-13 14:27 - 2013-02-01 19:23 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-03-13 14:27 - 2013-02-01 19:20 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-03-13 14:26 - 2013-03-13 14:26 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-03-13 14:26 - 2013-03-13 14:26 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
==================== One Month Modified Files and Folders =======
2013-04-09 18:25 - 2013-04-09 18:25 - 00000000 ____D C:\FRST
2013-04-09 08:33 - 2013-04-09 08:32 - 00000000 ____A C:\Recovery.txt
2013-04-09 08:32 - 2011-06-29 02:37 - 00000000 __SHD C:\Recovery
2013-04-08 09:59 - 2013-04-08 08:47 - 00000004 ____A C:\Users\nicole\AppData\Roaming\skype.ini
2013-04-08 09:59 - 2011-03-07 05:20 - 01803602 ____A C:\Windows\WindowsUpdate.log
2013-04-08 09:46 - 2012-03-30 11:11 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-04-08 09:25 - 2011-07-27 04:50 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-04-08 08:59 - 2009-07-13 20:45 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-04-08 08:59 - 2009-07-13 20:45 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-04-08 08:56 - 2011-03-07 14:11 - 00654844 ____A C:\Windows\System32\perfh007.dat
2013-04-08 08:56 - 2011-03-07 14:11 - 00130426 ____A C:\Windows\System32\perfc007.dat
2013-04-08 08:56 - 2009-07-13 21:13 - 01500254 ____A C:\Windows\System32\PerfStringBackup.INI
2013-04-08 08:53 - 2011-07-27 04:50 - 00000000 ____D C:\Users\nicole\AppData\Roaming\Skype
2013-04-08 08:52 - 2011-07-27 04:50 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-04-08 08:52 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-04-08 08:52 - 2009-07-13 20:51 - 00082894 ____A C:\Windows\setupact.log
2013-04-08 08:05 - 2011-12-19 08:43 - 00000390 ____A C:\Windows\Tasks\update-sys.job
2013-04-08 07:36 - 2011-12-19 08:43 - 00000390 ____A C:\Windows\Tasks\update-S-1-5-21-1901242933-2799301050-1033824700-1001.job
2013-04-04 23:41 - 2011-07-27 04:52 - 00002187 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-03-27 01:22 - 2009-07-13 21:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-03-19 08:27 - 2013-01-07 08:56 - 00000000 ____D C:\Users\nicole\Desktop\Neuer Ordner (2)
2013-03-13 14:29 - 2012-07-13 09:59 - 72013344 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-03-13 14:29 - 2012-01-09 13:00 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-03-13 14:26 - 2013-03-13 14:26 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-03-13 14:26 - 2013-03-13 14:26 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-03-13 08:46 - 2013-02-18 08:46 - 00000286 ____A C:\Windows\Tasks\PC Performer_UPDATES.job
2013-03-13 06:02 - 2013-02-18 08:46 - 00000278 ____A C:\Windows\Tasks\PC Performer_DEFAULT.job
2013-03-13 05:50 - 2012-03-30 11:11 - 00693976 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-03-13 05:50 - 2011-11-20 06:09 - 00073432 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-03-11 15:10 - 2012-07-13 10:25 - 00282744 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
==================== Known DLLs (Whitelisted) =================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-02-25 02:42:08
Restore point made on: 2013-02-25 02:45:37
Restore point made on: 2013-02-25 03:38:30
Restore point made on: 2013-03-03 10:00:33
Restore point made on: 2013-03-03 10:13:27
Restore point made on: 2013-03-04 11:48:07
Restore point made on: 2013-03-04 11:59:41
Restore point made on: 2013-03-10 12:10:41
Restore point made on: 2013-03-10 12:26:25
Restore point made on: 2013-03-13 14:25:06
Restore point made on: 2013-03-19 08:10:44
Restore point made on: 2013-03-19 08:27:03
Restore point made on: 2013-03-25 09:54:59
Restore point made on: 2013-03-27 01:11:25
Restore point made on: 2013-03-29 04:32:01
Restore point made on: 2013-04-04 23:16:42
Restore point made on: 2013-04-04 23:18:03
Restore point made on: 2013-04-08 09:02:35
==================== Memory info ===========================
Percentage of memory in use: 18%
Total physical RAM: 3766.71 MB
Available physical RAM: 3059.3 MB
Total Pagefile: 3764.86 MB
Available Pagefile: 3041.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB
==================== Partitions =============================
1 Drive c: (Acer) (Fixed) (Total:451.66 GB) (Free:395.47 GB) NTFS
2 Drive e: (PQSERVICE) (Fixed) (Total:14 GB) (Free:2.06 GB) NTFS
4 Drive g: () (Removable) (Total:7.45 GB) (Free:7.45 GB) FAT32
5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
6 Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Datentr„ger ### Status Gr”áe Frei Dyn GPT
--------------- ------------- ------- ------- --- ---
Datentr„ger 0 Online 465 GB 0 B
Datentr„ger 1 Online 7650 MB 0 B
Partitions of Disk 0:
===============
Datentr„ger-ID: 71BFAD9D
Partition ### Typ GrӇe Offset
------------- ---------------- ------- -------
Partition 1 Wiederherstellun 14 GB 1024 KB
Partition 2 Prim„r 100 MB 14 GB
Partition 3 Prim„r 451 GB 14 GB
==================================================================================
Disk: 0
Partition 1
Typ : 27
Versteckt: Ja
Aktiv : Nein
Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E PQSERVICE NTFS Partition 14 GB Fehlerfre Versteck
=========================================================
Disk: 0
Partition 2
Typ : 07
Versteckt: Nein
Aktiv : Ja
Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y SYSTEM RESE NTFS Partition 100 MB Fehlerfre
=========================================================
Disk: 0
Partition 3
Typ : 07
Versteckt: Nein
Aktiv : Nein
Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C Acer NTFS Partition 451 GB Fehlerfre
=========================================================
Partitions of Disk 1:
===============
Datentr„ger-ID: C3072E18
Partition ### Typ GrӇe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 7646 MB 3180 KB
==================================================================================
Disk: 1
Partition 1
Typ : 0C
Versteckt: Nein
Aktiv : Ja
Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 G FAT32 Wechselmed 7646 MB Fehlerfre
=========================================================
============================== MBR Partition Table ==================
==============================
Partitions of Disk 0:
===============
Disk ID: 71BFAD9D
Partition 1:
=========
Hex: 0020210027FEFFFF000800000000C001
Active: NO
Type: 27
Size: 14 GB
Partition 2:
=========
Hex: 80FEFFFF07FEFFFF0008C00100200300
Active: YES
Type: 07 (NTFS)
Size: 100 MB
Partition 3:
=========
Hex: 00FEFFFF07FEFFFF0028C30100307538
Active: NO
Type: 07 (NTFS)
Size: 452 GB
==============================
Partitions of Disk 1:
===============
Disk ID: C3072E18
Partition 1:
=========
Hex: 800101000CFFEDCBD818000028F7EE00
Active: YES
Type: 0C
Size: 7 GB
Last Boot: 2013-04-05 00:01
==================== End Of Log =============================
|
|
09.04.2013, 21:25
| #10 |
| /// Malwareteam | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Du hast alles richtig gemacht.  Der Schritt sollte den Rechner entsperren. Alles weitere machen wir dann nach dem Reboot wenn dein Windows wieder entsperrt ist.. Sag mir bitte bescheid. Schritt 1 Drücke auf einem Zweitrechner bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument: Code:
ATTFilter HKU\nicole\...\Winlogon: [Shell] explorer.exe,C:\Users\nicole\AppData\Roaming\skype.dat [72704 2011-11-16] ()
2013-04-08 08:47 - 2013-04-08 09:59 - 00000004 ____A C:\Users\nicole\AppData\Roaming\skype.ini
C:\Users\nicole\AppData\Roaming\skype.dat
|
|
10.04.2013, 15:11
| #11 |
| | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Hallo, so anbei die fixlist.txt bzw. der fixlog.txt. LG Nicco Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2013
Ran by SYSTEM at 2013-04-10 16:09:58 Run:1
Running from G:\
==============================================
HKEY_USERS\nicole\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully.
C:\Users\nicole\AppData\Roaming\skype.ini moved successfully.
C:\Users\nicole\AppData\Roaming\skype.dat moved successfully.
==== End of Fixlog ====
|
|
10.04.2013, 18:49
| #12 |
| /// Malwareteam | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Wunderbar... ist der Rechner entsperrt? Teile es mir bitte mit. Wenn ja machen wir weiter... |
|
11.04.2013, 15:15
| #13 |
| | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt Hallo Heiko, also so wie es aussieht ist der Computer entsperrt. Der Desktophintergrund erscheint wieder wie gewohnt und die GVU Seite öffnet sich auch nicht mehr. LG Nicco |
|
12.04.2013, 05:39
| #14 |
| /// Malwareteam | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt na das hört sich mal richtig gut an Damit ich mir ein Bild vom restlichen Befall deines Rechners machen kann arbeite bitte folgende Schritt ab: Schritt1: Bitte lade dir  GMER herunter: (Dateiname zufällig)
Tauchen Probleme auf?
Schritt2: Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden ).
|
|
12.04.2013, 14:31
| #15 |
| | Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt So Heiko anbei die Dateien GMER OTL 1 OTL EXTRA Kannst du mir auch vielleicht ein sehr gutes Anrivir Programm empfehlen, welches im privaten und geschäftlichem Segment sehr gut schützt? LG Nicco GMER: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-04-12 15:03:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\nicole\AppData\Local\Temp\uxdiqpog.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe[1736] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1924] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1304] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2404] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2404] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [2404] entry point in ".rdata" section 000000006fc771e6
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2848] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe[4048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe[4048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\Skype\Phone\Skype.exe[4248] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Skype\Phone\Skype.exe[4248] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Skype\Phone\Skype.exe[4248] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4792] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe[4836] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe[4836] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe[4836] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe[4864] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe[4864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe[4864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4880] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4880] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4880] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Users\nicole\Desktop\bilder\Join Air\UIExec.exe[4888] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4896] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4912] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[5064] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[5064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[5064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Windows\SysWOW64\RunDll32.exe[5080] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Windows\SysWOW64\RunDll32.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Windows\SysWOW64\RunDll32.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe[4780] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe[4780] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe[4780] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1380] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2216] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[2444] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[2444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[2444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe[2716] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
.text C:\Users\nicole\Desktop\gmer_2.1.19163.exe[4932] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076e6cfca 5 bytes JMP 0000000173b346c0
.text C:\Users\nicole\Desktop\gmer_2.1.19163.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077061465 2 bytes [06, 77]
.text C:\Users\nicole\Desktop\gmer_2.1.19163.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770614bb 2 bytes [06, 77]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [3332:2052] 000007fef24b9688
---- Processes - GMER 2.1 ----
Library c:\eedabc294aa7a76d70a929c4710af0\MpMiniSigStub.exe (*** suspicious ***) @ c:\eedabc294aa7a76d70a929c4710af0\MpMiniSigStub.exe [1840] 000000013f950000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\90004eff79f8
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\90004eff79f8 (not active ControlSet)
---- EOF - GMER 2.1 ----
OTL 1: Code:
ATTFilter OTL logfile created on: 12.04.2013 15:08:00 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\nicole\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,68 Gb Total Physical Memory | 1,92 Gb Available Physical Memory | 52,13% Memory free 7,36 Gb Paging File | 5,55 Gb Available in Paging File | 75,49% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 451,66 Gb Total Space | 394,36 Gb Free Space | 87,31% Space Free | Partition Type: NTFS Computer Name: NICOLE-PC | User Name: nicole | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\nicole\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Users\nicole\Desktop\gmer_2.1.19163.exe () PRC - C:\Users\nicole\AppData\Local\Skillbrains\lightshot\3.4.0.0\LightShot.exe (Skillbrains) PRC - C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe () PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\program files (x86)\avira\antivir desktop\avcenter.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe (Microsoft Corporation.) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.) PRC - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) PRC - C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.) PRC - C:\Program Files (x86)\Launch Manager\LMworker.exe (Dritek System Inc.) PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.) PRC - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) PRC - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.) PRC - C:\Programme\Acer\Acer Updater\UpdaterService.exe (Acer Group) PRC - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated) PRC - C:\Users\nicole\Desktop\bilder\Join Air\AssistantServices.exe () PRC - C:\Users\nicole\Desktop\bilder\Join Air\UIExec.exe () ========== Modules (No Company Name) ========== MOD - C:\Users\nicole\Desktop\gmer_2.1.19163.exe () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll () MOD - C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe () MOD - C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\8ee98383179eca974083a41a8ca0c213\IAStorUtil.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll () MOD - C:\Users\nicole\Desktop\bilder\Join Air\UIExec.exe () MOD - C:\Program Files (x86)\Launch Manager\CdDirIo.dll () ========== Services (SafeList) ========== SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (BrowserProtect) -- C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe () SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (BBUpdate) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe (Microsoft Corporation.) SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe (Microsoft Corporation.) SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (DsiWMIService) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.) SRV - (NTI IScheduleSvc) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.) SRV - (btwdins) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.) SRV - (ePowerSvc) -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) SRV - (NOBU) -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation) SRV - (MWLService) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe (Egis Technology Inc.) SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (Updater Service) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe (Acer Group) SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) SRV - (GREGService) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated) SRV - (TurboBoost) -- C:\Programme\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation) SRV - (UI Assistant Service) -- C:\Users\nicole\Desktop\bilder\Join Air\AssistantServices.exe () SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation) DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation) DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation) DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (UBHelper) -- C:\Windows\SysNative\drivers\UBHelper.sys (NTI Corporation) DRV:64bit: - (btwampfl) -- C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.) DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.) DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.) DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.) DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.) DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation) DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation) DRV:64bit: - (k57nd60a) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation) DRV:64bit: - (NTIDrvr) -- C:\Windows\SysNative\drivers\NTIDrvr.sys (NTI Corporation) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys () DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (mwlPSDVDisk) -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.) DRV:64bit: - (mwlPSDFilter) -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.) DRV:64bit: - (mwlPSDNServ) -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.) DRV:64bit: - (massfilter) -- C:\Windows\SysNative\drivers\massfilter.sys (ZTE Incorporated) DRV:64bit: - (ZTEusbnmea) -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys (ZTE Incorporated) DRV:64bit: - (ZTEusbser6k) -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys (ZTE Incorporated) DRV:64bit: - (ZTEusbmdm6k) -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys (ZTE Incorporated) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) IE - HKCU\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www.delta-search.com/?q={searchTerms}&affID=119649&babsrc=SP_ss&mntrId=6468d09100000000000018f46a5029ec IE - HKCU\..\SearchScopes\{553634F2-964B-4BBB-A29D-9E83C3D22EB2}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=2264295e-eb70-4db0-acb8-071af92b98ca&apn_sauid=12BFFA15-CA8B-48B6-A744-34549FAF0D10 IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{58bd07eb-0ee0-4df0-8121-dc9b693373df}: C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension [2013.02.18 18:46:45 | 000,000,000 | ---D | M] [2013.02.18 18:46:29 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions ========== Chrome ========== CHR - homepage: hxxp://www.delta-search.com/?affID=119649&babsrc=HP_ss&mntrId=6468d09100000000000018f46a5029ec CHR - Extension: No name found = C:\Users\nicole\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.137.7_0\ CHR - Extension: No name found = C:\Users\nicole\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0\ CHR - Extension: No name found = C:\Users\nicole\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgafcinpmmpklohkojmllohdhomoefph\1.0\ O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (delta Helper Object) - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.10.0\bh\delta.dll (Delta-search.com) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Delta Toolbar) - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.10.0\deltaTlbr.dll (Delta-search.com) O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation) O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.) O4 - HKLM..\Run: [UIExec] C:\Users\nicole\Desktop\bilder\Join Air\UIExec.exe () O4 - HKCU..\Run: [LightShot] C:\Users\nicole\AppData\Local\Skillbrains\lightshot\LightShot.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\nicole\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\nicole\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Free YouTube Download - C:\Users\nicole\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\nicole\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000020 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://javadl-esd.oracle.com/update/1.6.0/jinstall-6u29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2BBF362A-5071-4870-A0F1-C45F008E5255}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (c:\progra~3\browse~1\261095~1.52\{c16c1~1\browse~1.dll) - c:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll () O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{56e9e085-2baa-11e1-83c8-1c7508dc8a46}\Shell - "" = AutoRun O33 - MountPoints2\{56e9e085-2baa-11e1-83c8-1c7508dc8a46}\Shell\AutoRun\command - "" = F:\Setup.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.04.12 14:43:51 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\nicole\Desktop\OTL.exe [2013.04.10 04:25:03 | 000,000,000 | ---D | C] -- C:\FRST [2013.03.27 11:11:03 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usb8023.sys [2013.03.14 00:27:37 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2013.03.14 00:27:37 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2013.03.14 00:27:36 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.03.14 00:27:36 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2013.03.14 00:27:36 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2013.03.14 00:27:36 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.03.14 00:27:36 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2013.03.14 00:27:36 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2013.03.14 00:27:35 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.03.14 00:27:35 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2013.03.14 00:27:35 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2013.03.14 00:27:35 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.03.14 00:27:33 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.03.14 00:27:33 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2013.03.14 00:27:32 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.03.14 00:27:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2013.03.14 00:26:34 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2013.03.14 00:26:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.04.12 15:02:22 | 000,000,278 | ---- | M] () -- C:\Windows\tasks\PC Performer_DEFAULT.job [2013.04.12 14:46:29 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.04.12 14:45:42 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.04.12 14:45:42 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.04.12 14:45:20 | 001,500,254 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.04.12 14:45:20 | 000,654,844 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.04.12 14:45:20 | 000,616,686 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.04.12 14:45:20 | 000,130,426 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.04.12 14:45:20 | 000,106,808 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.04.12 14:43:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\nicole\Desktop\OTL.exe [2013.04.12 14:42:04 | 000,377,856 | ---- | M] () -- C:\Users\nicole\Desktop\gmer_2.1.19163.exe [2013.04.12 14:38:27 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.04.12 14:37:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.04.12 14:37:43 | 2962,259,968 | -HS- | M] () -- C:\hiberfil.sys [2013.04.08 19:25:04 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.04.08 18:05:00 | 000,000,390 | ---- | M] () -- C:\Windows\tasks\update-sys.job [2013.04.08 17:36:00 | 000,000,390 | ---- | M] () -- C:\Windows\tasks\update-S-1-5-21-1901242933-2799301050-1033824700-1001.job [2013.04.05 11:05:55 | 006,488,972 | ---- | M] () -- C:\Users\nicole\Desktop\Ronan - Taylor Swift - Lyrics - NEW SONG.mp3 [2013.04.05 11:00:34 | 008,088,920 | ---- | M] () -- C:\Users\nicole\Desktop\Phil Collins-In the air tonight (Deutsch.mp3 [2013.04.05 09:41:43 | 000,002,187 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2013.04.05 09:28:45 | 006,267,036 | ---- | M] () -- C:\Users\nicole\Desktop\P!nk - Just Give Me A Reason Lyrics [ HD ].mp3 [2013.03.19 18:26:39 | 006,105,285 | ---- | M] () -- C:\Users\nicole\Desktop\Passenger - Let Her Go (Official Video).mp3 [2013.03.13 18:46:15 | 000,000,286 | ---- | M] () -- C:\Windows\tasks\PC Performer_UPDATES.job [2013.03.13 15:50:08 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013.03.13 15:50:08 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.04.12 14:42:03 | 000,377,856 | ---- | C] () -- C:\Users\nicole\Desktop\gmer_2.1.19163.exe [2013.04.05 11:05:33 | 006,488,972 | ---- | C] () -- C:\Users\nicole\Desktop\Ronan - Taylor Swift - Lyrics - NEW SONG.mp3 [2013.04.05 11:00:31 | 008,088,920 | ---- | C] () -- C:\Users\nicole\Desktop\Phil Collins-In the air tonight (Deutsch.mp3 [2013.04.05 09:27:53 | 006,267,036 | ---- | C] () -- C:\Users\nicole\Desktop\P!nk - Just Give Me A Reason Lyrics [ HD ].mp3 [2013.03.19 18:26:39 | 006,105,285 | ---- | C] () -- C:\Users\nicole\Desktop\Passenger - Let Her Go (Official Video).mp3 [2012.04.10 15:02:33 | 000,000,032 | ---- | C] () -- C:\Windows\CD_Start.INI [2011.12.19 18:43:43 | 000,001,010 | ---- | C] () -- C:\Users\nicole\AppData\Local\UserProducts.xml [2011.07.19 15:36:42 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat [2011.06.29 12:49:25 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.11.17 15:30:01 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== Alternate Data Streams ========== @Alternate Data Stream - 149 bytes -> C:\ProgramData\Temp:93EB7685 @Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:CDFF58FE @Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:0B9176C0 @Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:4D066AD2 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:E3C56885 < End of report > OTL EXTRA: Code:
ATTFilter OTL Extras logfile created on: 12.04.2013 15:08:00 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\nicole\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,68 Gb Total Physical Memory | 1,92 Gb Available Physical Memory | 52,13% Memory free
7,36 Gb Paging File | 5,55 Gb Available in Paging File | 75,49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 451,66 Gb Total Space | 394,36 Gb Free Space | 87,31% Space Free | Partition Type: NTFS
Computer Name: NICOLE-PC | User Name: nicole | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- "C:\Program Files (x86)\File Scout\filescout.exe" /open "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- "C:\Program Files (x86)\File Scout\filescout.exe" /open "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03369904-DC98-49A2-9C1A-26080FFFC8F2}" = rport=445 | protocol=6 | dir=out | app=system |
"{19984E28-4164-491D-8A6A-B48973E7A472}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1B7CE26B-1028-442E-A97B-CCD8D8A76B5A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2CBBF427-D13E-4FA0-A997-66E9D8ED33B9}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{3EB8ADBF-6511-41AE-ACB6-1AF6A20CFADD}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{40E0F172-1980-4790-ABB9-BC052D7080D7}" = lport=138 | protocol=17 | dir=in | app=system |
"{56A90B84-F776-451D-AFEB-D342E17DE8B2}" = lport=139 | protocol=6 | dir=in | app=system |
"{57045079-563F-4B47-9E02-F761B57A8B23}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{6F9C9D56-BEDA-49C7-9296-1650F63911EE}" = rport=137 | protocol=17 | dir=out | app=system |
"{89F38A36-FC47-45DC-B241-E9673FB2A453}" = lport=10243 | protocol=6 | dir=in | app=system |
"{8A6FA608-89BF-4633-9E2C-45F9ABA916A7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8DA58EC1-BA58-4C98-858A-725E99192176}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8E328890-BEFD-42BF-97A6-5E035D9DD1E6}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{8F55C5E9-7858-4720-BA1D-DE6BC8EE0FC2}" = rport=138 | protocol=17 | dir=out | app=system |
"{944AA23B-6700-49A8-88FC-DA75C95BF185}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B15BB29E-E863-4AF6-9656-1248B923E28D}" = lport=137 | protocol=17 | dir=in | app=system |
"{B8818613-8009-4E63-8EF1-680BDC973479}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{C146CF0D-84F5-4F29-87A5-D6100A833E7C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C6E83421-3B79-4B20-8446-B11BA13F5806}" = lport=445 | protocol=6 | dir=in | app=system |
"{EB3A193E-40EF-4589-85CF-475A0590CE81}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FA08C8B2-2F71-496B-A16E-031A822574C9}" = rport=10243 | protocol=6 | dir=out | app=system |
"{FA88477F-1E70-45B9-B752-6C81CC9099D1}" = lport=2869 | protocol=6 | dir=in | app=system |
"{FB518D29-4C4C-4116-B8B9-BAE89A51186E}" = rport=139 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{10FAA65F-9164-422C-BD29-F026CE7E20EE}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{12857999-D1DA-424C-8CB9-492A89D088D4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1B890422-0EAD-44FE-BF69-31A75838B6D4}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1EE77529-3958-4AE4-ACBF-58FC1B83331A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2BFF0410-4346-4FEA-B8A1-B11568A13A47}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3B8D1D1B-626E-47E7-B85A-1FB80117BD80}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{3C3D14EC-EB38-4EF4-8199-8078D945CDB1}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{41B88B24-930A-45EF-8751-C38A67CF05B0}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{42441714-0060-43D0-BE67-206A0560CA21}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{49E6FCF3-7E19-412A-B0C2-B4B96554AA23}" = protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\nvidia updatus\daemonu.exe |
"{4B0D8300-1197-432E-B0E2-F1316003AA3E}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{561FD592-3794-4977-84D6-BFC85A6D3B9E}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd9\powerdvd9.exe |
"{56474FB5-64A9-418A-8112-1EC1A54E0EBF}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{5BCF28DF-1448-446B-8A3B-06BA6C4190BF}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{5C1E3594-1791-471D-8F59-EB226E5FBC2B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{5ECD14C3-EBE7-4690-8B8B-83C4952A6FC0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7BA9ACD8-A970-4BCA-8717-595119EADD1E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{83AB6719-2598-4E1D-AA91-062FA14EC5B6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{895AFA0A-B1A5-4B05-972E-414C5859505D}" = protocol=17 | dir=in | app=c:\program files (x86)\nvidia corporation\nvidia updatus\daemonu.exe |
"{903BC000-1C72-4951-A041-B3D5A0E86956}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{9B43D5DD-56C0-4EFC-A97B-688314D77CC7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A489F90E-AFE5-461D-8FAE-45FFF98B6301}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{AC763FCE-12D7-42A7-9921-EA1C6B02005D}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{B8C8E0A9-DB09-4D4B-BCDD-D0EF4DEDC730}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DA7AD3A5-11A0-4C71-8F7D-7460EAB8C9BE}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{DF136502-B19F-426C-9C63-848534023645}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{EA9C83F8-57D7-4EEB-A45B-6CDF8D9022DF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F1EE3705-8452-4003-908D-AED6F903876B}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{F32E8894-81B9-4B2E-9CE0-5FB2DFFD3B61}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FAEC324C-FEA5-402D-80E3-3AECC796E18C}" = protocol=6 | dir=out | app=system |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder
"{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}" = Überwachungstool für die Intel® Turbo-Boost-Technik
"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A84DB02B-9C2B-4272-9D2D-A80E00A56513}" = Broadcom Gigabit NetLink Controller
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"SynTPDeinstKey" = Synaptics Pointing Device Driver
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker
"{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = BrowserProtect
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{177586E7-E42E-4F38-83D1-D15B4AF5B714}" = Delta Chrome Toolbar
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1" = lightshot-3.4.0.0
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{51F026FA-5146-4232-A8BA-1364740BD053}" = Acer Crystal Eye webcam
"{58F4D244-314F-4D26-B5EF-C28AB32E22CB}_is1" = Acer GameZone Console
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9E48FF52-082C-4CC2-BB67-6E10D09C0431}" = Windows Live UX Platform Language Pack
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = Join Air
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.1 MUI
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D6C3C9E7-D334-4918-BD57-5B1EF14C207D}" = Bing Bar
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}" = eBay Worldwide
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"0fd0f6b44956cb2766bbd2c1777f3eb8" = Virtual Villagers 5 - New Believers
"356bd27eb836c04ac1d762597e538797" = Wandering Willows(TM)
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Avira AntiVir Desktop" = Avira Free Antivirus
"delta" = Delta toolbar
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"Free YouTube Download_is1" = Free YouTube Download version 3.0.19.1206
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.14.1206
"Google Chrome" = Google Chrome
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HOTEL - RESTAURANT - KÜCHE" = Pfanneberg HOTEL - RESTAURANT - KÜCHE
"Identity Card" = Identity Card
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9
"LManager" = Launch Manager
"NVIDIA.Updatus" = NVIDIA Updatus
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"PC Performer_is1" = PC Performer
"SecondLifeViewer2" = SecondLifeViewer2 (remove only)
"VideoPerformer" = VideoPerformer
"WinLiveSuite" = Windows Live Essentials
"Zoo Tycoon 1.0" = Microsoft Zoo Tycoon
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 14.01.2013 16:19:32 | Computer Name = nicole-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16457,
Zeitstempel: 0x50a2f9e3 Name des fehlerhaften Moduls: MSHTML.dll, Version: 9.0.8112.16457,
Zeitstempel: 0x50a30507 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0037541b ID des fehlerhaften
Prozesses: 0x488 Startzeit der fehlerhaften Anwendung: 0x01cdf291190f713b Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\MSHTML.dll Berichtskennung: b4b03127-5e87-11e2-b1c9-1c7508dc8a46
Error - 14.01.2013 16:47:24 | Computer Name = nicole-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16457,
Zeitstempel: 0x50a2f9e3 Name des fehlerhaften Moduls: MSHTML.dll, Version: 9.0.8112.16457,
Zeitstempel: 0x50a30507 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00375405 ID des fehlerhaften
Prozesses: 0x1b6c Startzeit der fehlerhaften Anwendung: 0x01cdf296565cc174 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\MSHTML.dll Berichtskennung: 9922afc9-5e8b-11e2-b1c9-1c7508dc8a46
Error - 14.01.2013 16:47:30 | Computer Name = nicole-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16457,
Zeitstempel: 0x50a2f9e3 Name des fehlerhaften Moduls: MSHTML.dll, Version: 9.0.8112.16457,
Zeitstempel: 0x50a30507 Ausnahmecode: 0xc000041d Fehleroffset: 0x00375405 ID des fehlerhaften
Prozesses: 0x1b6c Startzeit der fehlerhaften Anwendung: 0x01cdf296565cc174 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\MSHTML.dll Berichtskennung: 9c624ab5-5e8b-11e2-b1c9-1c7508dc8a46
Error - 29.01.2013 15:06:46 | Computer Name = nicole-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16457,
Zeitstempel: 0x50a2f9e3 Name des fehlerhaften Moduls: MSHTML.dll, Version: 9.0.8112.16457,
Zeitstempel: 0x50a30507 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00375405 ID des fehlerhaften
Prozesses: 0x1428 Startzeit der fehlerhaften Anwendung: 0x01cdfe4ecd5dde79 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\MSHTML.dll Berichtskennung: 061a6e34-6a47-11e2-a8aa-1c7508dc8a46
Error - 19.02.2013 13:57:53 | Computer Name = nicole-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16464,
Zeitstempel: 0x50ec971b Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x29732066 ID des fehlerhaften
Prozesses: 0x1584 Startzeit der fehlerhaften Anwendung: 0x01ce0ec8a6161336 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: unknown Berichtskennung: e159bd7f-7abd-11e2-be52-1c7508dc8a46
Error - 20.02.2013 10:25:47 | Computer Name = nicole-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16464,
Zeitstempel: 0x50ec971b Name des fehlerhaften Moduls: MSHTML.dll, Version: 9.0.8112.16464,
Zeitstempel: 0x50ec9c0f Ausnahmecode: 0xc0000005 Fehleroffset: 0x003753a7 ID des fehlerhaften
Prozesses: 0x1acc Startzeit der fehlerhaften Anwendung: 0x01ce0f7568fe8b38 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\MSHTML.dll Berichtskennung: 6a7f3ffc-7b69-11e2-b7b2-1c7508dc8a46
Error - 20.02.2013 10:25:58 | Computer Name = nicole-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16464,
Zeitstempel: 0x50ec971b Name des fehlerhaften Moduls: MSHTML.dll, Version: 9.0.8112.16464,
Zeitstempel: 0x50ec9c0f Ausnahmecode: 0xc000041d Fehleroffset: 0x003753a7 ID des fehlerhaften
Prozesses: 0x1acc Startzeit der fehlerhaften Anwendung: 0x01ce0f7568fe8b38 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\MSHTML.dll Berichtskennung: 71366748-7b69-11e2-b7b2-1c7508dc8a46
Error - 20.02.2013 10:33:26 | Computer Name = nicole-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16464,
Zeitstempel: 0x50ec971b Name des fehlerhaften Moduls: MSHTML.dll, Version: 9.0.8112.16464,
Zeitstempel: 0x50ec9c0f Ausnahmecode: 0xc0000005 Fehleroffset: 0x00375391 ID des fehlerhaften
Prozesses: 0xfb0 Startzeit der fehlerhaften Anwendung: 0x01ce0f76352c112f Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\MSHTML.dll Berichtskennung: 7bede239-7b6a-11e2-b7b2-1c7508dc8a46
Error - 20.02.2013 10:33:28 | Computer Name = nicole-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16464,
Zeitstempel: 0x50ec971b Name des fehlerhaften Moduls: MSHTML.dll, Version: 9.0.8112.16464,
Zeitstempel: 0x50ec9c0f Ausnahmecode: 0xc000041d Fehleroffset: 0x00375391 ID des fehlerhaften
Prozesses: 0xfb0 Startzeit der fehlerhaften Anwendung: 0x01ce0f76352c112f Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\MSHTML.dll Berichtskennung: 7d79163d-7b6a-11e2-b7b2-1c7508dc8a46
Error - 20.02.2013 18:05:49 | Computer Name = nicole-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16464,
Zeitstempel: 0x50ec971b Name des fehlerhaften Moduls: MSHTML.dll, Version: 9.0.8112.16464,
Zeitstempel: 0x50ec9c0f Ausnahmecode: 0xc0000005 Fehleroffset: 0x00375391 ID des fehlerhaften
Prozesses: 0x1bc4 Startzeit der fehlerhaften Anwendung: 0x01ce0f74e40b8498 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\MSHTML.dll Berichtskennung: aec7eda7-7ba9-11e2-b7b2-1c7508dc8a46
[ System Events ]
Error - 27.03.2013 05:01:48 | Computer Name = nicole-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows-Verwaltungsinstrumentation" wurde unerwartet beendet.
Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000
Millisekunden durchgeführt: Neustart des Diensts.
Error - 27.03.2013 05:02:48 | Computer Name = nicole-PC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
des Dienstes "Server" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen,
ist fehlgeschlagen. Fehler: %%1056
Error - 27.03.2013 05:02:48 | Computer Name = nicole-PC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
des Dienstes "Shellhardwareerkennung" Korrekturmaßnahmen (Neustart des Diensts)
durchzuführen, ist fehlgeschlagen. Fehler: %%1056
Error - 27.03.2013 05:03:48 | Computer Name = nicole-PC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Neustart
des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: %%1056
Error - 08.04.2013 12:54:38 | Computer Name = nicole-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern
Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
Management Console (MMC).
Error - 08.04.2013 12:54:38 | Computer Name = nicole-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1069
Error - 11.04.2013 10:14:14 | Computer Name = nicole-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern
Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
Management Console (MMC).
Error - 11.04.2013 10:14:14 | Computer Name = nicole-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1069
Error - 12.04.2013 08:40:29 | Computer Name = nicole-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern
Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
Management Console (MMC).
Error - 12.04.2013 08:40:29 | Computer Name = nicole-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1069
< End of report >
Kannst du mir vielleicht ein sehr gutes Antivir Programm empfehlen, welches im privaten und geschäftlichem Segment sehr gut schützt? LG Nicco Geändert von Nicco (12.04.2013 um 15:22 Uhr) |
|
| Themen zu Bitte dringende Hilfe! GVU-Trojaner: Ihr Computer wurde von der GVU gesperrt |
| anmeldung, computer, deutsche, entfernen, geschlossen, gesperrt, hallo zusammen, homepage, internet, meldung, nichts, passwort, problem, seite, sekunden, shell, start, trojan.lameshield, web, win32/kryptik.ayht, zahlen, zugang, zusammen |
Gruß Aneri 
Beim ersten Anzeichen illegal genutzter Software (Cracks, Patches und Co) wird der Support ohne Diskussion beendet.
Linear-Darstellung
