| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner nach MahnungsmailWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.06.2013, 16:52
| #1 |
| |  Trojaner nach Mahnungsmail Hallo! Nach einer Mahnungsmail mit Anhang habe ich mir (wie viele) einen Trojaner eingefangen. Gestern ist es mir dann auch noch passiert, dass auf einmal ein Bildschirm mit Bild von mir, Polizeiunterschrift und einer Forderung von 100€ aufploppte! Ein USB-Stick könnte ebenfalls befallen sein, da er zu dem Zeitpunkt am PC angeschlossen war. Hier das Logfile von Avira: Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Samstag, 1. Juni 2013 14:41
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows Vista (TM) Home Premium
Windowsversion : (Service Pack 2) [6.0.6002]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : AARON-PC
Versionsinformationen:
BUILD.DAT : 13.0.0.3640 54852 Bytes 18.04.2013 13:29:00
AVSCAN.EXE : 13.6.0.1262 636984 Bytes 06.05.2013 10:21:37
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 20.03.2013 06:20:09
LUKE.DLL : 13.6.0.1262 65080 Bytes 06.05.2013 10:21:44
AVSCPLR.DLL : 13.6.0.1262 92216 Bytes 06.05.2013 10:21:37
AVREG.DLL : 13.6.0.1262 247864 Bytes 06.05.2013 10:21:37
avlode.dll : 13.6.2.1262 432184 Bytes 06.05.2013 10:21:37
avlode.rdf : 13.0.1.12 25921 Bytes 16.05.2013 17:13:40
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 10:51:14
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 10:55:08
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 10:43:36
VBASE003.VDF : 7.11.80.61 2048 Bytes 28.05.2013 10:43:36
VBASE004.VDF : 7.11.80.62 2048 Bytes 28.05.2013 10:43:36
VBASE005.VDF : 7.11.80.63 2048 Bytes 28.05.2013 10:43:36
VBASE006.VDF : 7.11.80.64 2048 Bytes 28.05.2013 10:43:36
VBASE007.VDF : 7.11.80.65 2048 Bytes 28.05.2013 10:43:36
VBASE008.VDF : 7.11.80.66 2048 Bytes 28.05.2013 10:43:36
VBASE009.VDF : 7.11.80.67 2048 Bytes 28.05.2013 10:43:36
VBASE010.VDF : 7.11.80.68 2048 Bytes 28.05.2013 10:43:36
VBASE011.VDF : 7.11.80.69 2048 Bytes 28.05.2013 10:43:36
VBASE012.VDF : 7.11.80.70 2048 Bytes 28.05.2013 10:43:36
VBASE013.VDF : 7.11.80.71 2048 Bytes 28.05.2013 10:43:37
VBASE014.VDF : 7.11.81.57 145408 Bytes 29.05.2013 16:43:51
VBASE015.VDF : 7.11.81.137 130048 Bytes 30.05.2013 18:02:48
VBASE016.VDF : 7.11.81.255 207360 Bytes 31.05.2013 12:33:25
VBASE017.VDF : 7.11.82.0 2048 Bytes 31.05.2013 12:33:25
VBASE018.VDF : 7.11.82.1 2048 Bytes 31.05.2013 12:33:25
VBASE019.VDF : 7.11.82.2 2048 Bytes 31.05.2013 12:33:25
VBASE020.VDF : 7.11.82.3 2048 Bytes 31.05.2013 12:33:25
VBASE021.VDF : 7.11.82.4 2048 Bytes 31.05.2013 12:33:25
VBASE022.VDF : 7.11.82.5 2048 Bytes 31.05.2013 12:33:25
VBASE023.VDF : 7.11.82.6 2048 Bytes 31.05.2013 12:33:25
VBASE024.VDF : 7.11.82.7 2048 Bytes 31.05.2013 12:33:25
VBASE025.VDF : 7.11.82.8 2048 Bytes 31.05.2013 12:33:25
VBASE026.VDF : 7.11.82.9 2048 Bytes 31.05.2013 12:33:26
VBASE027.VDF : 7.11.82.10 2048 Bytes 31.05.2013 12:33:26
VBASE028.VDF : 7.11.82.11 2048 Bytes 31.05.2013 12:33:26
VBASE029.VDF : 7.11.82.12 2048 Bytes 31.05.2013 12:33:26
VBASE030.VDF : 7.11.82.13 2048 Bytes 31.05.2013 12:33:26
VBASE031.VDF : 7.11.82.70 40960 Bytes 01.06.2013 12:33:26
Engineversion : 8.2.12.50
AEVDF.DLL : 8.1.2.10 102772 Bytes 15.07.2012 19:55:07
AESCRIPT.DLL : 8.1.4.118 487805 Bytes 23.05.2013 14:42:16
AESCN.DLL : 8.1.10.4 131446 Bytes 26.03.2013 20:40:09
AESBX.DLL : 8.2.5.12 606578 Bytes 15.06.2012 12:17:10
AERDL.DLL : 8.2.0.88 643444 Bytes 10.01.2013 22:32:20
AEPACK.DLL : 8.3.2.12 754040 Bytes 08.05.2013 22:59:52
AEOFFICE.DLL : 8.1.2.56 205180 Bytes 08.03.2013 23:15:36
AEHEUR.DLL : 8.1.4.386 5947769 Bytes 27.05.2013 16:43:27
AEHELP.DLL : 8.1.25.10 258425 Bytes 08.05.2013 22:59:42
AEGEN.DLL : 8.1.7.4 442741 Bytes 08.05.2013 22:59:42
AEEXP.DLL : 8.4.0.32 201078 Bytes 23.05.2013 14:42:16
AEEMU.DLL : 8.1.3.2 393587 Bytes 15.07.2012 19:55:04
AECORE.DLL : 8.1.31.2 201080 Bytes 19.02.2013 23:14:33
AEBB.DLL : 8.1.1.4 53619 Bytes 05.11.2012 22:31:04
AVWINLL.DLL : 13.6.0.480 26480 Bytes 20.03.2013 06:18:58
AVPREF.DLL : 13.6.0.480 51056 Bytes 20.03.2013 06:20:07
AVREP.DLL : 13.6.0.480 178544 Bytes 20.03.2013 06:22:02
AVARKT.DLL : 13.6.0.1262 258104 Bytes 06.05.2013 10:21:35
AVEVTLOG.DLL : 13.6.0.1262 164920 Bytes 06.05.2013 10:21:36
SQLITE3.DLL : 3.7.0.1 397704 Bytes 20.03.2013 06:21:24
AVSMTP.DLL : 13.6.0.480 62832 Bytes 20.03.2013 06:20:11
NETNT.DLL : 13.6.0.480 16240 Bytes 20.03.2013 06:21:06
RCIMAGE.DLL : 13.4.0.360 4780832 Bytes 20.03.2013 06:19:02
RCTEXT.DLL : 13.6.0.976 69344 Bytes 29.03.2013 12:49:48
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Samstag, 1. Juni 2013 14:41
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '107' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '101' Modul(e) wurden durchsucht
Durchsuche Prozess 'conime.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'jucheck.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'VUAgent.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'VAIOUpdt.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'FNPLicensingService.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'TosBtHsp.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'TosBtHid.exe' - '13' Modul(e) wurden durchsucht
Durchsuche Prozess 'TosA2dp.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dropbox.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'TosBtMng.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmplayer.exe' - '94' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnscfg.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '93' Modul(e) wurden durchsucht
Durchsuche Prozess 'THGuard.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'Apntex.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'mobsync.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'acrotray.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'ISBMgr.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'ApMsgFwd.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'VCUServe.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'Apoint.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'Switcher.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '133' Modul(e) wurden durchsucht
Durchsuche Prozess 'SPMgr.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'VzFw.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'VzCdbSvc.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'VESMgrSub.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'xaudio.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'VCSW.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'VESMgr.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'TosBtSrv.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlwriter.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlbrowser.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlservr.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'cvpnd.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'PhotoshopElementsFileAgent.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '152' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '4926' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\'
[0] Archivtyp: RSRC
--> C:\Users\Aaron\AppData\Roaming\Dropbox\bin\Dropbox.exe
[1] Archivtyp: RSRC
--> C:\Program Files\Dropbox\DropboxProxy.exe
[2] Archivtyp: RSRC
--> C:\Users\Aaron\AppData\Local\Temp\firefoxjre_exe-1.exe
[3] Archivtyp: Runtime Packed
--> C:\Users\Aaron\AppData\Local\Temp\firefoxjre_exe.exe
[4] Archivtyp: Runtime Packed
--> C:\Users\Aaron\AppData\Local\Temp\pkzeb5n+.zip.part
[5] Archivtyp: ZIP
--> fixer_forging_investigation.exe
[FUND] Ist das Trojanische Pferd TR/Dropper.Gen
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Aaron\AppData\Local\Temp\pkzeb5n+.zip.part
[FUND] Ist das Trojanische Pferd TR/Dropper.Gen
--> C:\Users\Aaron\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3315e035-1f2260fb
[5] Archivtyp: ZIP
--> Ran.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-2423
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Aaron\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3315e035-1f2260fb
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-2423
Beginne mit der Suche in 'D:\' <Volume>
Beginne mit der Desinfektion:
C:\Users\Aaron\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3315e035-1f2260fb
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-2423
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5645b8aa.qua' verschoben!
C:\Users\Aaron\AppData\Local\Temp\pkzeb5n+.zip.part
[FUND] Ist das Trojanische Pferd TR/Dropper.Gen
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4d2d9755.qua' verschoben!
Ende des Suchlaufs: Samstag, 1. Juni 2013 17:49
Benötigte Zeit: 3:05:40 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
37691 Verzeichnisse wurden überprüft
1071381 Dateien wurden geprüft
4 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
2 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1071377 Dateien ohne Befall
14044 Archive wurden durchsucht
2 Warnungen
2 Hinweise
897388 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden
|
|
01.06.2013, 16:53
| #2 |
| /// TB-Ausbilder   | Trojaner nach Mahnungsmail Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Ich habe dein Thema in Arbeit und melde mich so schnell wie möglich mit weiteren Anweisungen. |
|
01.06.2013, 16:54
| #3 |
| /// TB-Ausbilder | Trojaner nach Mahnungsmail Servus,
__________________zunächst benötige ich ein paar Informationen: Schritt 1 Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop (falls noch nicht vorhanden).
Code:
ATTFilter activex
msconfig
CREATERESTOREPOINT
Schritt 2 Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
Schritt 3 Bitte lade dir  GMER herunter: (Dateiname zufällig)
 Tauchen Probleme auf?
Bitte poste mit deiner nächsten Antwort
|
|
01.06.2013, 17:58
| #4 |
| | Trojaner nach Mahnungsmail otl.txt: Code:
ATTFilter OTL logfile created on: 01.06.2013 18:01:48 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Aaron\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,13 Gb Available Physical Memory | 56,57% Memory free 4,23 Gb Paging File | 3,04 Gb Available in Paging File | 71,92% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 145,27 Gb Total Space | 37,74 Gb Free Space | 25,98% Space Free | Partition Type: NTFS Drive D: | 31,72 Gb Total Space | 31,63 Gb Free Space | 99,72% Space Free | Partition Type: NTFS Computer Name: AARON-PC | User Name: Aaron | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.01 18:00:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Aaron\Desktop\OTL.exe PRC - [2013.05.17 16:55:38 | 028,711,576 | ---- | M] (Dropbox, Inc.) -- C:\Users\Aaron\AppData\Roaming\Dropbox\bin\Dropbox.exe PRC - [2013.05.06 12:21:36 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.03.29 14:51:59 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2013.03.29 14:51:26 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2013.03.29 14:51:20 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2012.10.26 11:33:12 | 001,038,496 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe PRC - [2012.10.26 10:44:42 | 000,957,056 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Update\VUAgent.exe PRC - [2012.07.03 10:04:58 | 000,507,312 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe PRC - [2012.05.08 21:50:35 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe PRC - [2011.10.04 19:28:28 | 001,088,280 | ---- | M] (Mischel Internet Security) -- C:\Program Files\TrojanHunter 5.5\THGuard.exe PRC - [2010.03.23 14:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.04.10 23:27:30 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2007.06.15 12:45:20 | 000,469,112 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe PRC - [2006.11.25 08:29:44 | 002,134,016 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe PRC - [2006.11.24 18:58:38 | 000,919,672 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Power Management\SPMgr.exe PRC - [2006.11.24 11:36:54 | 000,182,392 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe PRC - [2006.11.24 11:36:54 | 000,100,472 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe PRC - [2006.11.14 11:46:24 | 000,411,768 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe PRC - [2006.11.11 16:35:36 | 000,043,128 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\ISB Utility\ISBMgr.exe PRC - [2006.10.31 22:40:16 | 000,077,824 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe PRC - [2006.10.31 14:52:08 | 000,108,136 | ---- | M] () -- C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe PRC - [2006.10.27 20:13:48 | 000,270,336 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe PRC - [2006.10.22 23:24:02 | 000,620,152 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe PRC - [2006.09.26 15:48:36 | 000,172,032 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe PRC - [2006.09.26 15:46:58 | 000,135,168 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe PRC - [2006.09.13 15:29:46 | 000,274,432 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe PRC - [2006.09.11 09:23:22 | 000,118,784 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apoint.exe PRC - [2006.09.08 08:06:08 | 000,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apntex.exe PRC - [2006.09.08 07:54:30 | 000,042,544 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\ApMsgFwd.exe PRC - [2006.08.23 13:43:08 | 000,274,432 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe PRC - [2006.01.23 23:14:10 | 000,069,632 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe ========== Modules (No Company Name) ========== MOD - [2013.03.13 22:48:52 | 024,978,944 | ---- | M] () -- C:\Users\Aaron\AppData\Roaming\Dropbox\bin\libcef.dll MOD - [2012.11.14 01:32:50 | 003,558,400 | ---- | M] () -- C:\Users\Aaron\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll MOD - [2012.10.11 22:56:46 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012.10.11 22:56:22 | 001,242,512 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2010.03.15 11:28:22 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll MOD - [2006.11.14 11:46:24 | 000,040,960 | ---- | M] () -- C:\Program Files\Sony\VAIO Camera Utility\VCULib.dll MOD - [2005.07.22 21:30:20 | 000,065,536 | ---- | M] () -- C:\Windows\System32\TosCommAPI.dll ========== Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService) SRV - [2013.06.01 14:38:14 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.15 06:54:27 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.03.29 14:51:59 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.03.29 14:51:20 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.10.26 10:44:42 | 000,957,056 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Program Files\Sony\VAIO Update\VUAgent.exe -- (VUAgent) SRV - [2012.05.08 21:50:35 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2010.03.23 14:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND) SRV - [2008.01.18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2007.01.16 14:05:00 | 002,523,136 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe -- (VAIOMediaPlatform-IntegratedServer-AppServer) SRV - [2007.01.16 14:05:00 | 001,089,536 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe -- (VAIOMediaPlatform-UCLS-UPnP) SRV - [2007.01.16 14:05:00 | 001,089,536 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe -- (VAIOMediaPlatform-IntegratedServer-UPnP) SRV - [2007.01.12 11:03:16 | 000,073,728 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe -- (VAIO Entertainment TV Device Arbitration Service) SRV - [2007.01.10 16:51:06 | 000,745,472 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe -- (VAIOMediaPlatform-UCLS-AppServer) SRV - [2007.01.08 17:06:40 | 000,397,312 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe -- (VAIOMediaPlatform-UCLS-HTTP) SRV - [2007.01.08 17:06:40 | 000,397,312 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe -- (VAIOMediaPlatform-IntegratedServer-HTTP) SRV - [2007.01.08 17:01:34 | 000,491,520 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe -- (VAIOMediaPlatform-Mobile-Gateway) SRV - [2006.11.24 11:36:54 | 000,182,392 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service) SRV - [2006.11.13 17:31:22 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe -- (SSScsiSV) SRV - [2006.10.31 22:40:16 | 000,077,824 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service) SRV - [2006.10.31 14:52:08 | 000,108,136 | ---- | M] () [Auto | Running] -- C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor5.0) SRV - [2006.10.04 18:25:00 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AvLib\MSCSPTISRV.exe -- (MSCSPTISRV) SRV - [2006.10.04 18:15:30 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AvLib\PACSPTISVR.exe -- (PACSPTISVR) SRV - [2006.10.04 18:06:58 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AvLib\SPTISRV.exe -- (SPTISRV) SRV - [2006.09.26 15:48:36 | 000,172,032 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe -- (VzCdbSvc) SRV - [2006.09.26 15:46:58 | 000,135,168 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe -- (VzFw) SRV - [2006.08.23 13:43:08 | 000,274,432 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe -- (Vcsw) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - [2013.03.29 14:52:54 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2013.03.29 14:52:54 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2013.03.29 14:52:54 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013.03.20 08:22:01 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2012.09.21 13:16:28 | 000,094,848 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\dnelwf.sys -- (DNE) DRV - [2010.12.30 15:19:40 | 000,016,640 | -H-- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys -- (Apowersoft_AudioDevice) DRV - [2010.03.23 14:15:36 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA) DRV - [2009.04.10 21:45:26 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST) DRV - [2007.01.18 20:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA) DRV - [2006.12.07 13:25:00 | 004,456,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2006.11.21 14:57:36 | 000,113,792 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd) DRV - [2006.11.20 17:55:16 | 000,036,480 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp) DRV - [2006.11.17 07:18:44 | 000,645,120 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA) DRV - [2006.11.06 15:56:03 | 000,227,328 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ti21sony.sys -- (ti21sony) DRV - [2006.11.02 09:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) DRV - [2006.11.01 06:31:46 | 000,017,328 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiWinAcc.sys -- (SiFilter) DRV - [2006.11.01 06:31:14 | 000,012,464 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiRemFil.sys -- (SiRemFil) DRV - [2006.11.01 06:30:34 | 000,074,672 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SI3132.sys -- (SI3132) DRV - [2006.10.30 02:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) DRV - [2006.10.28 00:29:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfusb.sys -- (tosrfusb) DRV - [2006.10.27 15:08:36 | 000,072,704 | ---- | M] (Ricoh) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\R5U870FLx86.sys -- (R5U870FLx86) DRV - [2006.10.27 15:08:32 | 000,043,904 | ---- | M] (Ricoh) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\R5U870FUx86.sys -- (R5U870FUx86) DRV - [2006.10.18 12:56:30 | 000,010,216 | ---- | M] (Sony Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\DMICall.sys -- (DMICall) DRV - [2006.10.13 13:34:22 | 000,027,520 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SonyNC.sys -- (SNC) DRV - [2006.10.10 19:33:22 | 000,041,600 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte) DRV - [2006.10.05 16:07:46 | 000,073,600 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TosRfhid.sys -- (Tosrfhid) DRV - [2006.09.06 11:44:52 | 000,030,976 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SonyImgF.sys -- (SonyImgF) DRV - [2006.08.30 02:35:58 | 000,140,800 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService) DRV - [2006.08.04 10:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio) DRV - [2005.08.01 16:45:08 | 000,064,896 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom) DRV - [2005.01.06 13:42:42 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.club-vaio.com IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {950892BA-F179-46C2-AEFE-D5283BB31E2E} IE - HKLM\..\SearchScopes\{950892BA-F179-46C2-AEFE-D5283BB31E2E}: "URL" = hxxp://partnerpage.google.com/eu.sony.com/de/search?hl=de&q={searchTerms}&btnG=Google-Suche&meta= IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050&SSPV=IEOB04 IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\..\SearchScopes,DefaultScope = {950892BA-F179-46C2-AEFE-D5283BB31E2E} IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\..\SearchScopes\{78FFB659-BD16-413C-86BC-DAF94C89DB85}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IEOB04 IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\..\SearchScopes\{950892BA-F179-46C2-AEFE-D5283BB31E2E}: "URL" = hxxp://partnerpage.google.com/eu.sony.com/de/search?hl=de&q={searchTerms}&btnG=Google-Suche&meta= IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012.05.07 22:26:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.06.01 14:38:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.07 22:15:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aaron\AppData\Roaming\mozilla\Extensions [2013.05.09 01:05:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aaron\AppData\Roaming\mozilla\Firefox\Profiles\ur3o4end.default\extensions [2013.05.09 01:05:14 | 000,209,665 | ---- | M] () (No name found) -- C:\Users\Aaron\AppData\Roaming\mozilla\firefox\profiles\ur3o4end.default\extensions\jid0-bbA9VAawX3LMWDu668aUDrpQVXU@jetpack.xpi [2013.06.01 14:38:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\browser\extensions [2013.06.01 14:38:15 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll (Your Company Name) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Softonic Helper Object) - {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:\Program Files\Softonic\Softonic\1.6.7.4\bh\Softonic.dll (Softonic.com) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files\Softonic\Softonic\1.6.7.4\SoftonicTlbr.dll (Softonic.com) O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [THGuard] C:\Program Files\TrojanHunter 5.5\THGuard.exe (Mischel Internet Security) O4 - HKLM..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe (Simply Super Software) O4 - HKLM..\Run: [VAIOCameraUtility] C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe (Sony Corporation) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - Startup: C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Aaron\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html () O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: RSS-Support-Site zu VAIO Information FLOW hinzufügen - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html () O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\jp2iexp.dll () O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 10.17.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{06B176C6-2B29-4202-92E4-F0328FA04F7E}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{379166A5-AC13-4662-9A43-FE2D102A87D4}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation) O24 - Desktop WallPaper: C:\Users\Aaron\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Aaron\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {DB4A8A40-353D-EA61-DA8E-49C3AF82DBA6} - Themes Setup ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2013.06.01 18:00:32 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Aaron\Desktop\OTL.exe [2013.06.01 14:38:00 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013.05.31 11:03:01 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Neuer Ordner (2) [2013.05.31 10:06:11 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Julian [2013.05.31 08:27:25 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Stribeck Kurve [2013.05.31 08:27:25 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Stick-Slip [2013.05.31 08:27:25 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Bilder Präsentation [2013.05.31 08:27:25 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\2013_02_03 [2013.05.31 08:27:25 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\2012_07_15 [2013.05.31 03:33:17 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Bericht Fertig [2013.05.27 12:47:04 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Bewerbung VOLKE Studienarbeit [2013.05.24 16:41:06 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Neuer Ordner [2013.05.18 17:51:20 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2013.05.18 17:50:00 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Documents\Simply Super Software [2013.05.18 17:50:00 | 000,000,000 | ---D | C] -- C:\Users\Aaron\AppData\Roaming\Simply Super Software [2013.05.18 17:49:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover [2013.05.18 17:49:49 | 000,605,968 | ---- | C] (Igor Pavlov) -- C:\Windows\System32\ztv7z.dll [2013.05.18 17:49:48 | 000,077,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ztvcabinet.dll [2013.05.18 17:49:46 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover [2013.05.18 17:49:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software [2013.05.18 17:47:44 | 000,000,000 | ---D | C] -- C:\Users\Aaron\AppData\Roaming\TrojanHunter [2013.05.18 12:59:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter [2013.05.18 12:59:13 | 000,000,000 | ---D | C] -- C:\ProgramData\TrojanHunter [2013.05.18 12:59:02 | 000,000,000 | ---D | C] -- C:\Program Files\TrojanHunter 5.5 [2013.05.18 10:24:45 | 000,000,000 | R--D | C] -- C:\Users\Aaron\Dropbox [2013.05.18 10:21:04 | 000,000,000 | ---D | C] -- C:\Program Files\Dropbox [2013.05.18 10:20:49 | 000,000,000 | ---D | C] -- C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox [2013.05.18 10:18:54 | 000,000,000 | ---D | C] -- C:\Users\Aaron\AppData\Roaming\Dropbox [2013.05.16 03:14:17 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2013.05.16 03:02:18 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2013.05.16 03:02:18 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2013.05.16 03:02:18 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2013.05.16 03:02:18 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2013.05.16 03:02:17 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2013.05.16 03:02:17 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2013.05.16 03:02:16 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2013.05.15 21:29:49 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll [2013.05.15 21:29:47 | 002,049,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2013.05.13 21:47:23 | 000,000,000 | -H-D | C] -- C:\Windows\PIF [2013.05.09 13:43:08 | 000,000,000 | ---D | C] -- C:\Users\Aaron\AppData\Roaming\MathWorks [2013.05.09 13:42:57 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Documents\MATLAB [2013.05.09 13:41:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MATLAB [2013.05.09 13:19:30 | 000,000,000 | ---D | C] -- C:\Program Files\MATLAB ========== Files - Modified Within 30 Days ========== [2013.06.01 18:00:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Aaron\Desktop\OTL.exe [2013.06.01 17:59:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.06.01 17:54:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.06.01 16:27:18 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.01 16:27:18 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.01 14:28:24 | 000,002,565 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk [2013.06.01 14:28:17 | 000,002,473 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat - Schnellstart.lnk [2013.06.01 14:27:49 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.06.01 14:27:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.06.01 14:27:00 | 2145,574,912 | -HS- | M] () -- C:\hiberfil.sys [2013.05.31 13:02:39 | 000,000,004 | ---- | M] () -- C:\Users\Aaron\AppData\Roaming\skype.ini [2013.05.31 07:50:23 | 000,728,432 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.05.31 07:50:23 | 000,678,860 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.05.31 07:50:23 | 000,167,990 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.05.31 07:50:23 | 000,136,360 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.05.29 19:39:12 | 002,210,116 | ---- | M] () -- C:\Users\Aaron\Desktop\DIN+50125-2009++%E9%87%91%E5%B1%9E%E6%9D%90%E6%96%99%E8%AF%95%E9%AA%8C.%E6%8A%97%E6%8B%89%E5%BC%BA%E5%BA%A6%E8%AF%95%E6%A0%B7.pdf [2013.05.29 15:56:25 | 000,081,818 | ---- | M] () -- C:\Users\Aaron\Desktop\Präsentation1.gif [2013.05.25 08:50:01 | 000,001,356 | ---- | M] () -- C:\Users\Aaron\AppData\Local\d3d9caps.dat [2013.05.18 12:59:16 | 000,059,392 | R--- | M] () -- C:\Windows\System32\streamhlp.dll [2013.05.18 10:24:45 | 000,000,941 | ---- | M] () -- C:\Users\Aaron\Desktop\Dropbox.lnk [2013.05.18 10:21:41 | 000,000,951 | ---- | M] () -- C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2013.05.16 22:36:46 | 000,364,576 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013.05.15 06:54:27 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013.05.15 06:54:27 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2013.05.12 13:48:46 | 000,001,964 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk [2013.05.12 13:48:46 | 000,001,912 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Acrobat 8 Standard.lnk [2013.05.09 13:41:29 | 000,001,005 | ---- | M] () -- C:\Users\Public\Desktop\MATLAB R2008b.lnk [2013.05.05 21:12:55 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb ========== Files Created - No Company Name ========== [2013.05.31 13:01:47 | 000,000,004 | ---- | C] () -- C:\Users\Aaron\AppData\Roaming\skype.ini [2013.05.29 19:39:12 | 002,210,116 | ---- | C] () -- C:\Users\Aaron\Desktop\DIN+50125-2009++%E9%87%91%E5%B1%9E%E6%9D%90%E6%96%99%E8%AF%95%E9%AA%8C.%E6%8A%97%E6%8B%89%E5%BC%BA%E5%BA%A6%E8%AF%95%E6%A0%B7.pdf [2013.05.29 15:56:23 | 000,081,818 | ---- | C] () -- C:\Users\Aaron\Desktop\Präsentation1.gif [2013.05.18 17:49:49 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll [2013.05.18 17:49:48 | 000,185,616 | ---- | C] () -- C:\Windows\System32\ztvunrar39.dll [2013.05.18 17:49:48 | 000,169,744 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll [2013.05.18 17:49:48 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll [2013.05.18 17:49:48 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll [2013.05.18 12:59:03 | 000,059,392 | R--- | C] () -- C:\Windows\System32\streamhlp.dll [2013.05.18 10:24:45 | 000,000,941 | ---- | C] () -- C:\Users\Aaron\Desktop\Dropbox.lnk [2013.05.18 10:21:41 | 000,000,951 | ---- | C] () -- C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2013.05.09 13:41:29 | 000,001,005 | ---- | C] () -- C:\Users\Public\Desktop\MATLAB R2008b.lnk [2012.10.22 21:50:02 | 000,013,811 | ---- | C] () -- C:\Users\Aaron\abaqus_v6.10.gpr [2012.10.19 08:26:55 | 000,569,161 | ---- | C] () -- C:\Users\Aaron\modified_brake_pull.res [2012.10.19 08:26:55 | 000,003,380 | ---- | C] () -- C:\Users\Aaron\modified_brake_pull.wev [2012.10.19 08:26:51 | 000,019,218 | ---- | C] () -- C:\Users\Aaron\modified_suspnsn.msg [2012.10.19 08:26:46 | 000,256,624 | ---- | C] () -- C:\Users\Aaron\modified_suspnsn.adm [2012.10.19 08:26:45 | 000,000,844 | ---- | C] () -- C:\Users\Aaron\modified_suspnsn.acf [2012.10.18 19:28:40 | 000,569,883 | ---- | C] () -- C:\Users\Aaron\baseline_brake_pull.res [2012.10.18 19:28:40 | 000,003,380 | ---- | C] () -- C:\Users\Aaron\baseline_brake_pull.wev [2012.10.18 19:28:36 | 000,019,221 | ---- | C] () -- C:\Users\Aaron\baseline_suspnsn.msg [2012.10.18 19:28:33 | 000,256,536 | ---- | C] () -- C:\Users\Aaron\baseline_suspnsn.adm [2012.10.18 19:28:32 | 000,000,846 | ---- | C] () -- C:\Users\Aaron\baseline_suspnsn.acf [2012.10.18 18:32:28 | 000,554,311 | ---- | C] () -- C:\Users\Aaron\baseline_parallel_travel.res [2012.10.18 18:32:28 | 000,003,380 | ---- | C] () -- C:\Users\Aaron\baseline_parallel_travel.wev [2012.10.18 18:32:25 | 000,018,044 | ---- | C] () -- C:\Users\Aaron\baseline_parallel_travel.msg [2012.10.18 18:32:21 | 000,255,470 | ---- | C] () -- C:\Users\Aaron\baseline_parallel_travel.adm [2012.10.18 18:32:20 | 000,000,310 | ---- | C] () -- C:\Users\Aaron\baseline_parallel_travel.acf [2012.10.18 17:57:01 | 000,002,395 | ---- | C] () -- C:\Users\Aaron\.acar.cfq [2012.10.14 19:06:17 | 001,888,701 | ---- | C] () -- C:\Users\Aaron\_parallel_travel.res [2012.10.14 19:06:17 | 000,020,635 | ---- | C] () -- C:\Users\Aaron\_parallel_travel.wev [2012.10.14 19:06:15 | 000,015,734 | ---- | C] () -- C:\Users\Aaron\_parallel_travel.msg [2012.10.14 19:06:09 | 000,205,199 | ---- | C] () -- C:\Users\Aaron\_parallel_travel.adm [2012.10.14 19:06:09 | 000,000,229 | ---- | C] () -- C:\Users\Aaron\_parallel_travel.acf [2012.10.14 17:35:47 | 001,888,711 | ---- | C] () -- C:\Users\Aaron\workshop1b_parallel_travel.res [2012.10.14 17:35:47 | 000,020,635 | ---- | C] () -- C:\Users\Aaron\workshop1b_parallel_travel.wev [2012.10.14 17:35:45 | 000,015,754 | ---- | C] () -- C:\Users\Aaron\workshop1b_parallel_travel.msg [2012.10.14 17:35:42 | 000,205,199 | ---- | C] () -- C:\Users\Aaron\workshop1b_parallel_travel.adm [2012.10.14 17:35:41 | 000,000,239 | ---- | C] () -- C:\Users\Aaron\workshop1b_parallel_travel.acf [2012.10.14 17:13:20 | 008,992,762 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.res [2012.10.14 17:13:18 | 000,003,827 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.sdl [2012.10.14 17:13:14 | 000,023,261 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.msg [2012.10.14 17:13:09 | 000,514,940 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.adm [2012.10.14 17:13:07 | 000,000,261 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.acf [2012.10.14 17:13:06 | 000,016,529 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.xml [2012.10.14 16:56:18 | 000,002,260 | ---- | C] () -- C:\Users\Aaron\.acar.cfg.cfq [2012.10.13 12:29:16 | 000,107,166 | ---- | C] () -- C:\Users\Aaron\aview.loq [2012.10.12 15:16:43 | 000,002,398 | ---- | C] () -- C:\Users\Aaron\.acar.cfg [2012.10.12 15:16:43 | 000,002,260 | ---- | C] () -- C:\Users\Aaron\.acar.cfg.cfg [2012.10.12 15:16:32 | 000,003,740 | ---- | C] () -- C:\Users\Aaron\acar.loq [2012.10.07 14:51:16 | 000,511,488 | ---- | C] () -- C:\Windows\System32\lame_enc.dll [2012.10.07 14:51:16 | 000,110,080 | ---- | C] () -- C:\Windows\System32\advd.dll [2012.10.07 14:51:16 | 000,023,040 | ---- | C] () -- C:\Windows\System32\auth.dll [2012.09.10 11:22:02 | 000,014,336 | ---- | C] () -- C:\Users\Aaron\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.08.22 21:54:12 | 000,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI [2012.05.08 21:11:35 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI [2012.05.08 07:52:43 | 000,066,560 | ---- | C] () -- C:\Users\Aaron\AppData\Roaming\skype.dat [2012.05.07 20:34:41 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2012.05.07 20:33:36 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2012.05.07 20:33:36 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2012.05.07 18:33:56 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2012.05.07 18:29:23 | 000,019,968 | ---- | C] () -- C:\Windows\System32\Cpuinf32.dll [2012.05.07 18:22:57 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Sony.dll [2012.05.07 18:11:45 | 000,001,356 | ---- | C] () -- C:\Users\Aaron\AppData\Local\d3d9caps.dat ========== ZeroAccess Check ========== [2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.10 23:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.10 23:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== Custom Scans ========== < > < End of report > Code:
ATTFilter OTL Extras logfile created on: 01.06.2013 18:01:48 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Aaron\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,13 Gb Available Physical Memory | 56,57% Memory free
4,23 Gb Paging File | 3,04 Gb Available in Paging File | 71,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 145,27 Gb Total Space | 37,74 Gb Free Space | 25,98% Space Free | Partition Type: NTFS
Drive D: | 31,72 Gb Total Space | 31,63 Gb Free Space | 99,72% Space Free | Partition Type: NTFS
Computer Name: AARON-PC | User Name: Aaron | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpid.exe" = C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpid.exe:LocalSubNet:Enabled:mpid.exe -- ()
"C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpirun.exe" = C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpirun.exe:LocalSubNet:Enabled:mpirun.exe -- ()
"C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpidiag.exe" = C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpidiag.exe:LocalSubNet:Enabled:mpidiag.exe
"C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpisrvutil.exe" = C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpisrvutil.exe:LocalSubNet:Enabled:mpisrvutil.exe
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04D53771-1403-4B72-83AD-869F46C253A7}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{4C53E09B-AA52-4544-AD10-5498AFF0818D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{659FD8A2-13AC-44C4-BD7D-122C059CCDA1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9DD2CA5D-7D8C-46F8-AC5C-CD4EB34D0700}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B5C6B61D-D777-40EE-B7B7-33928A908684}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CCED4731-2D01-4FAE-BDFE-4368AFF84D43}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{DFEDC5B9-7C43-484C-A2D7-C39FE24CC9C3}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{FF815BFF-3962-4ED1-A5AC-2EAD30ED8F56}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{117AC7D1-658B-4C2B-B7BA-F29B5D694D24}" = dir=in | app=c:\program files\apowersoft\streaming video recorder\streamingvideorecorder.exe |
"{12A061F1-7EDE-462E-81DA-0A552DDA1E83}" = dir=in | app=c:\program files\apowersoft\streaming video recorder\apowersoftdump.dll |
"{22195B0C-1A1B-425A-B2B8-E6DB35D2A840}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2C80E03D-4D2E-4A7A-89B4-0319A0F2A6D9}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{36D72B59-6F9F-48FB-A418-4F50A7003652}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{3D490AD4-B419-4B09-8618-8A14B0F9C4F1}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{7150E2A2-89B0-478D-85BC-D3A564380099}" = protocol=17 | dir=in | app=c:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe |
"{7BAFBB74-206E-49DC-A168-E40DF863F9E5}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{8A05D0FC-72A1-4ADF-AD40-506BB82B1F59}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{A54B8705-50FB-44BE-821A-84E25A241718}" = dir=in | app=c:\program files\apowersoft\streaming video recorder\streaming-video-recorder.exe |
"{A7BA7649-053E-406A-8A77-E352D002F4C0}" = protocol=6 | dir=in | app=c:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe |
"{B49AE202-5C18-46E8-84F1-E3834C396E0B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C5B3DE8B-60B6-4A96-90C3-61589E512943}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C8531022-732D-40B2-8779-054BB3BC63F7}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{FD1212EE-DAAE-4234-8BE4-2E3FF6C5FF5C}" = dir=in | app=c:\program files\apowersoft\streaming video recorder\apowersoftsrv.dll |
"TCP Query User{3217B0B2-67E0-4D50-9305-5D1C968B749B}C:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{49A886A5-706E-4C5F-B9C3-89D06AA8E978}C:\simulia\abaqus\6.10-3\exec\abqvwrk.exe" = protocol=6 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqvwrk.exe |
"TCP Query User{59A7D4EC-522D-4B78-AB8D-B5787706633F}C:\simulia\abaqus\6.10-3\exec\abqvwrk.exe" = protocol=6 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqvwrk.exe |
"TCP Query User{89A36D24-9A53-497F-8DC7-692AC5C0901B}C:\simulia\abaqus\6.10-3\exec\abqcaek.exe" = protocol=6 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqcaek.exe |
"TCP Query User{DA49968A-D1BE-42C6-97AD-AB00A2266885}C:\simulia\abaqus\6.10-3\exec\abqcaek.exe" = protocol=6 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqcaek.exe |
"UDP Query User{0A32162C-4D58-473F-A433-C3B3AC52956F}C:\simulia\abaqus\6.10-3\exec\abqvwrk.exe" = protocol=17 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqvwrk.exe |
"UDP Query User{811F74C5-6CA4-4344-9873-7AAE9ADD0388}C:\simulia\abaqus\6.10-3\exec\abqvwrk.exe" = protocol=17 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqvwrk.exe |
"UDP Query User{884768CE-C413-4DC2-834D-7D731DCD3BBA}C:\simulia\abaqus\6.10-3\exec\abqcaek.exe" = protocol=17 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqcaek.exe |
"UDP Query User{B619DAF9-0C32-4CA3-98C4-8F0997E2CFE1}C:\simulia\abaqus\6.10-3\exec\abqcaek.exe" = protocol=17 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqcaek.exe |
"UDP Query User{FB023436-E953-4817-B7B4-8B1E4E805957}C:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}" = Sony Video Shared Library
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (VAIO_VEDB)
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{09206F12-0EE5-46A7-80B7-725E214E87FF}" = Adams 2012
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX860_series" = Canon MX860 series MP Drivers
"{1417F599-1DBD-4499-9375-B2813E9F890C}" = VAIO Camera Utility
"{17C7703E-0B2A-4593-9CB7-E2FE14B6F8EA}" = Sony Snymsico for Vista
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"{2063C2E8-3812-4BBD-9998-6610F80C1DD4}" = VAIO Media AC3 Decoder 1.0
"{24960AC2-C413-4A86-B1C1-E4CCADCA44D3}" = VAIO Information FLOW
"{25569723-DC5A-4467-A639-79535BF01B71}" = Adobe Help Center 2.1
"{268278CF-FB69-4D98-B70E-BFEC1CDCA225}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{2864C41B-EF2D-4640-95A2-526276524519}" = Borland C++Builder 6
"{2A0F3EF9-68EE-49E9-A05B-ED5B82DF63E5}" = Wireless Switch Setting Utility
"{2A2FF7F5-6F0E-4A5D-A881-39365E718BD6}" = VAIO Cozy Orange Wallpaper
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{34B32B70-8081-11E2-89AF-B8AC6F98CCE3}" = Google Earth Plug-in
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D79DB6E-73DA-46C9-B8FA-DAE52108246F}" = OpenMG Secure Module 4.6.01
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{500162A0-4DD5-460A-BAFD-895AAE48C532}" = VAIO Media Content Collection 6.0
"{500C3FDC-5E5F-485F-BDF5-2C445839CBE0}" =
"{50BFDB3B-9CA8-477E-82FE-D3CD5F58F8C4}" = Dassault Systemes Software VC9 Prerequisites x86
"{55B781F0-060E-11D4-99D7-00C04FCCB775}" =
"{560F6B2E-F0DF-44E5-8190-A4A161F0E205}" = VAIO Media 6.0
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{5855C127-1F20-404D-B7FB-1FD84D7EAB5E}" = VAIO Media Redistribution 6.0
"{59452470-A902-477F-9338-9B88101681BD}" = Setting Utility Series
"{5958CAC6-373E-402F-84FE-0A699AA920B9}" = LAN Setting Utility
"{5E343EF6-D27C-4CFC-9FAE-9AAFB541BCEE}" = VAIO Photo 2007
"{6332AFF1-9D9A-429C-AA03-F82749FA4F49}" = SonicStage Mastering Studio
"{63415CB1-3C97-4D9C-980D-336710EB0526}" = Age of Empires III - The Asian Dynasties Trial
"{685BCC47-B8EC-45EC-BBCE-77DF2451502C}" = DVgate Plus
"{6B1F20F2-6321-4669-A58C-33DF8E7517FF}" = VAIO Entertainment Platform
"{6BADDD61-4B40-4FD1-BAE8-0E8C1E85F806}" = Solid Edge ST4
"{6D2576EC-A0E9-418A-A09A-409933A3B6F4}" = VAIO Camera Capture Utility
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{785EB1D4-ECEC-4195-99B4-73C47E187721}" = VAIO Media Integrated Server 6.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{934A3213-1CB6-4264-84A2-EE080C017BCA}" = VAIO Tender Green Wallpaper
"{97260AE9-A1EE-492E-8DCC-FD0AFF785720}" =
"{97BCD719-6ECB-458F-97D6-F38D2E07375E}" = VAIO Aqua Breeze Wallpaper
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C1C8A04-F8CA-4472-A92D-4288CE32DE86}" = SonicStage Mastering Studio Plug-Ins
"{9D12A8B5-9D41-4465-BF11-70719EB0CD02}" = VU5x86
"{9E319E96-ED8E-4B01-9775-C521A1869A25}" = VAIO Power Management
"{9E407618-D9CD-4F39-9490-9ED45294073D}" = Click to DVD 2.0.05 Menu Data
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO
"{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}" = VAIO Update
"{A0EB195B-5876-48E6-879D-33D4B2102610}" = SonicStage 4.2
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A7B609FB-83D8-4FC3-8477-1BC65ECFE85B}" = Adobe Photoshop Elements 5.0
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A947C2B3-7445-42C4-9063-EE704CACCB22}" = VAIO Hardware Diagnostics
"{AC76BA86-1033-F400-BA7E-000000000003}" = Adobe Acrobat 8 Standard - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-A80000000002}" = Adobe Reader 8 - Deutsch
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF9A04EB-7D8E-41DE-9EDE-4AB9BB2B71B6}" = VAIO Media Registration Tool 6.0
"{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}" = Cisco Systems VPN Client 5.0.07.0290
"{C183A21C-395A-490F-99D4-CCAB35E32859}" =
"{CC2FBD86-F382-4F9D-93D0-9CA71318DEAF}" = DNE Update
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D2AC7034-15AC-4F62-85BD-1E48021E45D6}_is1" = concept/design onlineTV 8
"{DF7DB916-90E5-40F2-9010-B8125EB5FD6F}" = SonicStage Mastering Studio Audio Filter
"{E12C6653-1FF0-4686-ADB8-589C13AE761F}" = Citavi
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E2B38044-AEF2-40AF-BDD8-FEDE799A8633}" =
"{E809063C-51A3-4269-8984-D1EB742F2151}" = Click to DVD 2.6.00
"{EC37A846-53AC-4DA7-98FA-76A4E74AA900}" = Benutzerdefinierte Voreinstellungen für SonicStage Mastering Studio Audio Filter
"{EF3D45BB-2260-4008-88EA-492E7744A9DF}" = Sony Utilities DLL
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0D85ADD-DD61-4B43-87A0-6DA52A211A8B}" = VAIO Event Service
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F570A6CC-53ED-4AA9-8B08-551CD3E38D8B}" =
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FC37C108-821D-4EDE-8F40-D5B497586805}" = VAIO Control Center
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"Abaqus 6.10 PDF Documentation" = Abaqus 6.10 PDF Documentation
"Abaqus 6.10-3" = Abaqus 6.10-3
"Abaqus FLEXnet License Server" = Abaqus FLEXnet License Server
"Adobe Acrobat 8 Standard - English, Français, Deutsch" = Adobe Acrobat 8 Standard - English, Français, Deutsch
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 5" = Adobe Photoshop Elements 5.0
"Amazon Kindle" = Amazon Kindle
"Avira AntiVir Desktop" = Avira Free Antivirus
"CamStudio" = CamStudio
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_104D0200" = HDAUDIO SoftV92 Data Fax Modem with SmartCP
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"HP-MPI_is1" = HP-MPI 1.1
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"InstallShield_{3D79DB6E-73DA-46C9-B8FA-DAE52108246F}" = OpenMG Secure Module 4.6.01
"InstallShield_{63415CB1-3C97-4D9C-980D-336710EB0526}" = Age of Empires III - The Asian Dynasties Trial
"MatlabR2008b" = MATLAB R2008b
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 2.1" = Canon MP Navigator EX 2.1
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"PROSet" = Intel(R) PRO Network Connections Drivers
"Softonic" = Softonic toolbar on IE
"Trojan Remover_is1" = Trojan Remover 6.8.6
"TrojanHunter_is1" = TrojanHunter 5.5
"WinRAR archiver" = WinRAR
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 31.05.2013 02:46:20 | Computer Name = Aaron-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 12277
Error - 31.05.2013 02:46:21 | Computer Name = Aaron-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 31.05.2013 02:46:21 | Computer Name = Aaron-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 13275
Error - 31.05.2013 02:46:21 | Computer Name = Aaron-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 13275
Error - 31.05.2013 02:46:27 | Computer Name = Aaron-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 31.05.2013 02:46:27 | Computer Name = Aaron-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 19609
Error - 31.05.2013 02:46:27 | Computer Name = Aaron-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 19609
Error - 31.05.2013 05:08:17 | Computer Name = Aaron-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 31.05.2013 05:08:17 | Computer Name = Aaron-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 10998
Error - 31.05.2013 05:08:17 | Computer Name = Aaron-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10998
[ System Events ]
Error - 30.05.2013 02:00:05 | Computer Name = Aaron-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 30.05.2013 12:37:46 | Computer Name = Aaron-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 30.05.2013 16:29:30 | Computer Name = Aaron-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 31.05.2013 01:41:03 | Computer Name = Aaron-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 31.05.2013 05:00:23 | Computer Name = Aaron-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 31.05.2013 06:50:46 | Computer Name = Aaron-PC | Source = Service Control Manager | ID = 7011
Description =
Error - 31.05.2013 06:51:39 | Computer Name = Aaron-PC | Source = DCOM | ID = 10010
Description =
Error - 31.05.2013 07:04:03 | Computer Name = Aaron-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 31.05.2013 um 13:02:16 unerwartet heruntergefahren.
Error - 31.05.2013 07:05:39 | Computer Name = Aaron-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 01.06.2013 08:28:51 | Computer Name = Aaron-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:16 on 01/06/2013 (Aaron)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-01 18:54:19
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3 FUJITSU_MHV2200BT rev.0000004F 186,31GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Aaron\AppData\Local\Temp\aglorpog.sys
---- System - GMER 2.1 ----
SSDT 8A0D6E6E ZwCreateSection
SSDT 8A0D6E78 ZwRequestWaitReplyPort
SSDT 8A0D6E73 ZwSetContextThread
SSDT 8A0D6E7D ZwSetSecurityObject
SSDT 8A0D6E82 ZwSystemDebugControl
SSDT 8A0D6E0F ZwTerminateProcess
---- EOF - GMER 2.1 ----
|
|
01.06.2013, 18:08
| #5 |
| /// TB-Ausbilder | Trojaner nach Mahnungsmail Servus, ja, das passt so. So geht es los: Schritt 1 Scan mit Combofix
Schritt 2 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 3 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte poste mit deiner nächsten Antwort
|
|
01.06.2013, 19:10
| #6 |
| | Trojaner nach Mahnungsmail combofix: Code:
ATTFilter ComboFix 13-06-01.01 - Aaron 01.06.2013 19:21:46.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.2045.1066 [GMT 2:00]
ausgeführt von:: c:\users\Aaron\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documentation\_desktop.ini
c:\documentation\Documentation\_desktop.ini
c:\documentation\Documentation\CS\_desktop.ini
c:\documentation\Documentation\DE\_desktop.ini
c:\documentation\Documentation\EN\_desktop.ini
c:\documentation\Documentation\ES\_desktop.ini
c:\documentation\Documentation\FI\_desktop.ini
c:\documentation\Documentation\FR\_desktop.ini
c:\documentation\Documentation\GR\_desktop.ini
c:\documentation\Documentation\IT\_desktop.ini
c:\documentation\Documentation\NL\_desktop.ini
c:\documentation\Documentation\PO\_desktop.ini
c:\documentation\Documentation\RU\_desktop.ini
c:\documentation\Documentation\SV\_desktop.ini
c:\documentation\Leaflets\_desktop.ini
c:\documentation\Leaflets\CS\_desktop.ini
c:\documentation\Leaflets\DE\_desktop.ini
c:\documentation\Leaflets\EN\_desktop.ini
c:\documentation\Leaflets\ES\_desktop.ini
c:\documentation\Leaflets\FI\_desktop.ini
c:\documentation\Leaflets\FR\_desktop.ini
c:\documentation\Leaflets\GR\_desktop.ini
c:\documentation\Leaflets\IT\_desktop.ini
c:\documentation\Leaflets\NL\_desktop.ini
c:\documentation\Leaflets\PO\_desktop.ini
c:\documentation\Leaflets\RU\_desktop.ini
c:\documentation\Leaflets\SV\_desktop.ini
c:\users\Aaron\AppData\Roaming\Microsoft\~DFKe509e3.tmp
c:\users\Aaron\AppData\Roaming\Microsoft\1eaadjc.dll
c:\users\Aaron\AppData\Roaming\Microsoft\bass.dll
c:\users\Aaron\AppData\Roaming\Microsoft\engine_vx.dll
c:\users\Aaron\AppData\Roaming\Microsoft\kfgresk.dll
c:\users\Aaron\AppData\Roaming\Microsoft\mjcriu.dll
c:\users\Aaron\AppData\Roaming\Microsoft\peaadje.dll
c:\users\Aaron\AppData\Roaming\Microsoft\qwadjb.dll
c:\users\Aaron\AppData\Roaming\Microsoft\rsaadjd.dll
c:\users\Aaron\AppData\Roaming\skype.dat
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-05-01 bis 2013-06-01 ))))))))))))))))))))))))))))))
.
.
2013-06-01 17:35 . 2013-06-01 17:36 -------- d-----w- c:\users\Aaron\AppData\Local\temp
2013-05-18 15:50 . 2013-05-18 15:50 -------- d-----w- c:\users\Aaron\AppData\Roaming\Simply Super Software
2013-05-18 15:49 . 2012-06-15 14:33 605968 ----a-w- c:\windows\system32\ztv7z.dll
2013-05-18 15:49 . 2005-08-25 23:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2013-05-18 15:49 . 2012-06-15 14:39 169744 ----a-w- c:\windows\system32\ztvunrar36.dll
2013-05-18 15:49 . 2012-06-15 14:35 185616 ----a-w- c:\windows\system32\ztvunrar39.dll
2013-05-18 15:49 . 2012-06-15 14:33 77072 ----a-w- c:\windows\system32\ztvcabinet.dll
2013-05-18 15:49 . 2003-02-02 18:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2013-05-18 15:49 . 2002-03-05 23:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2013-05-18 15:49 . 2013-05-29 16:42 -------- d-----w- c:\program files\Trojan Remover
2013-05-18 15:49 . 2013-05-18 15:49 -------- d-----w- c:\programdata\Simply Super Software
2013-05-18 15:47 . 2013-05-18 15:47 -------- d-----w- c:\users\Aaron\AppData\Roaming\TrojanHunter
2013-05-18 10:59 . 2013-05-18 11:00 -------- d-----w- c:\programdata\TrojanHunter
2013-05-18 10:59 . 2013-05-29 13:14 -------- d-----w- c:\program files\TrojanHunter 5.5
2013-05-18 08:24 . 2013-06-01 12:30 -------- d-----r- c:\users\Aaron\Dropbox
2013-05-18 08:21 . 2013-05-18 08:21 -------- d-----w- c:\program files\Dropbox
2013-05-18 08:18 . 2013-06-01 12:30 -------- d-----w- c:\users\Aaron\AppData\Roaming\Dropbox
2013-05-16 01:14 . 2013-05-05 19:12 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2013-05-15 19:29 . 2013-04-15 14:20 638328 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 19:29 . 2013-04-13 10:56 37376 ----a-w- c:\windows\system32\cdd.dll
2013-05-15 19:29 . 2013-04-09 01:36 2049024 ----a-w- c:\windows\system32\win32k.sys
2013-05-13 19:47 . 2013-05-13 19:47 -------- d--h--w- c:\windows\PIF
2013-05-09 11:43 . 2013-05-09 11:43 -------- d-----w- c:\users\Aaron\AppData\Roaming\MathWorks
2013-05-09 11:19 . 2013-05-09 11:19 -------- d-----w- c:\program files\MATLAB
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-15 04:54 . 2012-05-07 21:29 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-15 04:54 . 2012-05-07 21:29 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-04-01 10:40 . 2013-04-01 10:40 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-04-01 10:40 . 2013-01-20 17:34 861088 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-04-01 10:40 . 2013-01-20 17:34 782240 ----a-w- c:\windows\system32\deployJava1.dll
2013-03-29 12:52 . 2013-03-20 06:34 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-03-29 12:52 . 2013-03-20 06:34 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-03-29 12:52 . 2013-03-20 06:34 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-03-11 13:25 . 2013-04-09 21:27 3603816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-11 13:25 . 2013-04-09 21:27 3551080 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-09 03:45 . 2013-04-09 21:27 49152 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-09 01:28 . 2013-04-09 21:27 64000 ----a-w- c:\windows\system32\smss.exe
2013-03-08 03:53 . 2013-04-09 21:27 376320 ----a-w- c:\windows\system32\winsrv.dll
2013-03-08 03:52 . 2013-04-09 21:27 2067968 ----a-w- c:\windows\system32\mstscax.dll
2013-03-03 19:07 . 2013-04-09 21:27 1082232 ----a-w- c:\windows\system32\drivers\ntfs.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVDV.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-05-09 09:49 176936 ----a-w- c:\program files\DVDVideoSoftTB\prxtbDVDV.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVDV.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\prxtbDVDV.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-17 14:45 130736 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-17 14:45 130736 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-17 14:45 130736 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-17 14:45 130736 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2006-09-11 118784]
"VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2006-11-14 411768]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2006-11-11 43128]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-07 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-07 81920]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-05-06 345312]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"THGuard"="c:\program files\TrojanHunter 5.5\THGuard.exe" [2011-10-04 1088280]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2013-05-18 1648400]
.
c:\users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Aaron\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-5-17 28711576]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-BA7E-000000000003}\_SC_Acrobat.exe [2012-5-8 295606]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-11-25 2134016]
VPN Client.lnk - c:\windows\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico [2013-1-14 6144]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2006-11-24 09:36 73728 ----a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - AGLORPOG
*Deregistered* - aglorpog
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-07 04:54]
.
2013-06-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-07-14 08:12]
.
2013-06-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-07-14 08:12]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050&SSPV=IEOB04
uInternet Settings,ProxyOverride = *.local
IE: &Citavi Picker... - file://c:\programdata\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html
IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
IE: An vorhandenes PDF anfügen - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: RSS-Support-Site zu VAIO Information FLOW hinzufügen - c:\program files\Sony\VAIO Information FLOW\aiesc.html
IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\ur3o4end.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - user.js: extensions.Softonic.rvrtMsg - Click Yes to keep current home page and default search settings, Click No to restore original settings
FF - user.js: extensions.Softonic.autoRvrt - false
FF - user.js: extensions.Softonic_i.newTab - false
FF - user.js: extensions.Softonic.tlbrSrchUrl - hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=
FF - user.js: extensions.Softonic.id - d6ddf6420000000000000019d219945f
FF - user.js: extensions.Softonic.instlDay - 15593
FF - user.js: extensions.Softonic.vrsn - 1.6.7.4
FF - user.js: extensions.Softonic.vrsni - 1.6.7.4
FF - user.js: extensions.Softonic_i.vrsnTs - 1.6.7.411:14
FF - user.js: extensions.Softonic.prtnrId - softonic
FF - user.js: extensions.Softonic.prdct - Softonic
FF - user.js: extensions.Softonic.aflt - SD
FF - user.js: extensions.Softonic_i.smplGrp - none
FF - user.js: extensions.Softonic.tlbrId - base
FF - user.js: extensions.Softonic.instlRef - MON00015
FF - user.js: extensions.Softonic.dfltLng - de
FF - user.js: extensions.Softonic.excTlbr - false
FF - user.js: extensions.Softonic.admin - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-06-01 19:36
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-06-01 19:38:53
ComboFix-quarantined-files.txt 2013-06-01 17:38
.
Vor Suchlauf: 13 Verzeichnis(se), 39.583.531.008 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 42.232.635.392 Bytes frei
.
- - End Of File - - 8A800E33E65DED4A25F24CE49FAB16DE
Code:
ATTFilter # AdwCleaner v2.301 - Datei am 01/06/2013 um 19:47:18 erstellt
# Aktualisiert am 16/05/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Aaron - AARON-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Aaron\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\user.js
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\DVDVideoSoftTB
Ordner Gelöscht : C:\Program Files\Softonic
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Users\Aaron\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Aaron\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Aaron\AppData\LocalLow\DVDVideoSoftTB
Ordner Gelöscht : C:\Users\Aaron\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Aaron\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\Aaron\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Aaron\AppData\Roaming\pdfforge
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DVDVideoSoftTB Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Softonic
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\AVG Secure Search
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{44B50C01-4993-48E2-ADEE-D812BAE2E9A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A3E2F089-DDBB-4CBF-B06C-5D44DA316ED3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A5679AB0-C59E-49E7-83C4-5289F844A6E0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA0167C2-6295-41B8-9BDA-704B2F5E4CD9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D3F69D07-0AEE-47AF-87D0-1A67D4F70C68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SoftonicApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SoftonicApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Description
Schlüssel Gelöscht : HKLM\Software\DVDVideoSoftTB
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0835DF4C-06B6-49A9-B904-4A469227FB46}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{90A24964-FD7A-4B33-8EA3-79970D129E3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3F69D07-0AEE-47AF-87D0-1A67D4F70C68}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Softonic
Schlüssel Gelöscht : HKLM\Software\Softonic
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16483
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050&SSPV=IEOB04 --> hxxp://www.google.com
-\\ Mozilla Firefox v21.0 (de)
Datei : C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\ur3o4end.default\prefs.js
C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\ur3o4end.default\user.js ... Gelöscht !
Gelöscht : user_pref("extensions.Softonic.admin", false);
Gelöscht : user_pref("extensions.Softonic.aflt", "SD");
Gelöscht : user_pref("extensions.Softonic.autoRvrt", "false");
Gelöscht : user_pref("extensions.Softonic.cntry", "DE");
Gelöscht : user_pref("extensions.Softonic.cv", "cv5");
Gelöscht : user_pref("extensions.Softonic.dfltLng", "de");
Gelöscht : user_pref("extensions.Softonic.envrmnt", "production");
Gelöscht : user_pref("extensions.Softonic.excTlbr", false);
Gelöscht : user_pref("extensions.Softonic.hdrMd5", "3163BABE3369FEE22E11DE7D50591E59");
Gelöscht : user_pref("extensions.Softonic.hmpg", false);
Gelöscht : user_pref("extensions.Softonic.id", "d6ddf6420000000000000019d219945f");
Gelöscht : user_pref("extensions.Softonic.instlDay", "15593");
Gelöscht : user_pref("extensions.Softonic.instlRef", "MON00015");
Gelöscht : user_pref("extensions.Softonic.isdcmntcmplt", true);
Gelöscht : user_pref("extensions.Softonic.lastVrsnTs", "1.6.7.411:14:45");
Gelöscht : user_pref("extensions.Softonic.mntrvrsn", "1.3.0");
Gelöscht : user_pref("extensions.Softonic.newTab", false);
Gelöscht : user_pref("extensions.Softonic.prdct", "Softonic");
Gelöscht : user_pref("extensions.Softonic.prtnrId", "softonic");
Gelöscht : user_pref("extensions.Softonic.rvrtMsg", "Click Yes to keep current home page and default search set[...]
Gelöscht : user_pref("extensions.Softonic.sg", "az");
Gelöscht : user_pref("extensions.Softonic.smplGrp", "none");
Gelöscht : user_pref("extensions.Softonic.tlbrId", "base");
Gelöscht : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MON00015/tb_v1?SearchSource[...]
Gelöscht : user_pref("extensions.Softonic.vrsn", "1.6.7.4");
Gelöscht : user_pref("extensions.Softonic.vrsnTs", "1.6.7.411:14:45");
Gelöscht : user_pref("extensions.Softonic.vrsni", "1.6.7.4");
Gelöscht : user_pref("extensions.Softonic_i.newTab", false);
Gelöscht : user_pref("extensions.Softonic_i.smplGrp", "none");
Gelöscht : user_pref("extensions.Softonic_i.vrsnTs", "1.6.7.411:14:45");
*************************
AdwCleaner[S1].txt - [10058 octets] - [01/06/2013 19:47:18]
########## EOF - C:\AdwCleaner[S1].txt - [10119 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Aaron on 01.06.2013 at 20:04:17,80
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{78FFB659-BD16-413C-86BC-DAF94C89DB85}
~~~ Files
~~~ Folders
~~~ FireFox
Successfully deleted: [File] "C:\Users\Aaron\AppData\Roaming\mozilla\firefox\profiles\ur3o4end.default\extensions\jid0-bbA9VAawX3LMWDu668aUDrpQVXU@jetpack.xpi"
Emptied folder: C:\Users\Aaron\AppData\Roaming\mozilla\firefox\profiles\ur3o4end.default\minidumps [309 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.06.2013 at 20:05:59,45
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
02.06.2013, 10:50
| #7 |
| /// TB-Ausbilder | Trojaner nach Mahnungsmail Servus, sieht schon viel besser aus. Das Meiste wurde bereits entfernt.  Wir spüren noch die letzten Reste auf, damit wir sie im Anschluss entfernen können: Schritt 1
Schritt 2 Lade SystemLook von jpshortstuff vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop: SystemLook (32 bit)
Bitte poste mit deiner nächsten Antwort
|
|
02.06.2013, 13:06
| #8 |
| | Trojaner nach Mahnungsmail extras.txt: Code:
ATTFilter OTL Extras logfile created on: 02.06.2013 13:22:41 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Aaron\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,26 Gb Available Physical Memory | 63,06% Memory free
4,23 Gb Paging File | 3,17 Gb Available in Paging File | 74,97% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 145,27 Gb Total Space | 39,93 Gb Free Space | 27,49% Space Free | Partition Type: NTFS
Drive D: | 31,72 Gb Total Space | 31,63 Gb Free Space | 99,72% Space Free | Partition Type: NTFS
Computer Name: AARON-PC | User Name: Aaron | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpid.exe" = C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpid.exe:LocalSubNet:Enabled:mpid.exe -- ()
"C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpirun.exe" = C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpirun.exe:LocalSubNet:Enabled:mpirun.exe -- ()
"C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpidiag.exe" = C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpidiag.exe:LocalSubNet:Enabled:mpidiag.exe
"C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpisrvutil.exe" = C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpisrvutil.exe:LocalSubNet:Enabled:mpisrvutil.exe
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04D53771-1403-4B72-83AD-869F46C253A7}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{4C53E09B-AA52-4544-AD10-5498AFF0818D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{659FD8A2-13AC-44C4-BD7D-122C059CCDA1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9DD2CA5D-7D8C-46F8-AC5C-CD4EB34D0700}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B5C6B61D-D777-40EE-B7B7-33928A908684}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CCED4731-2D01-4FAE-BDFE-4368AFF84D43}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{DFEDC5B9-7C43-484C-A2D7-C39FE24CC9C3}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{FF815BFF-3962-4ED1-A5AC-2EAD30ED8F56}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{117AC7D1-658B-4C2B-B7BA-F29B5D694D24}" = dir=in | app=c:\program files\apowersoft\streaming video recorder\streamingvideorecorder.exe |
"{12A061F1-7EDE-462E-81DA-0A552DDA1E83}" = dir=in | app=c:\program files\apowersoft\streaming video recorder\apowersoftdump.dll |
"{22195B0C-1A1B-425A-B2B8-E6DB35D2A840}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2C80E03D-4D2E-4A7A-89B4-0319A0F2A6D9}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{36D72B59-6F9F-48FB-A418-4F50A7003652}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{3D490AD4-B419-4B09-8618-8A14B0F9C4F1}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{7150E2A2-89B0-478D-85BC-D3A564380099}" = protocol=17 | dir=in | app=c:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe |
"{7BAFBB74-206E-49DC-A168-E40DF863F9E5}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{8A05D0FC-72A1-4ADF-AD40-506BB82B1F59}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{A54B8705-50FB-44BE-821A-84E25A241718}" = dir=in | app=c:\program files\apowersoft\streaming video recorder\streaming-video-recorder.exe |
"{A7BA7649-053E-406A-8A77-E352D002F4C0}" = protocol=6 | dir=in | app=c:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe |
"{B49AE202-5C18-46E8-84F1-E3834C396E0B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C5B3DE8B-60B6-4A96-90C3-61589E512943}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C8531022-732D-40B2-8779-054BB3BC63F7}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{FD1212EE-DAAE-4234-8BE4-2E3FF6C5FF5C}" = dir=in | app=c:\program files\apowersoft\streaming video recorder\apowersoftsrv.dll |
"TCP Query User{3217B0B2-67E0-4D50-9305-5D1C968B749B}C:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{49A886A5-706E-4C5F-B9C3-89D06AA8E978}C:\simulia\abaqus\6.10-3\exec\abqvwrk.exe" = protocol=6 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqvwrk.exe |
"TCP Query User{59A7D4EC-522D-4B78-AB8D-B5787706633F}C:\simulia\abaqus\6.10-3\exec\abqvwrk.exe" = protocol=6 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqvwrk.exe |
"TCP Query User{89A36D24-9A53-497F-8DC7-692AC5C0901B}C:\simulia\abaqus\6.10-3\exec\abqcaek.exe" = protocol=6 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqcaek.exe |
"TCP Query User{DA49968A-D1BE-42C6-97AD-AB00A2266885}C:\simulia\abaqus\6.10-3\exec\abqcaek.exe" = protocol=6 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqcaek.exe |
"UDP Query User{0A32162C-4D58-473F-A433-C3B3AC52956F}C:\simulia\abaqus\6.10-3\exec\abqvwrk.exe" = protocol=17 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqvwrk.exe |
"UDP Query User{811F74C5-6CA4-4344-9873-7AAE9ADD0388}C:\simulia\abaqus\6.10-3\exec\abqvwrk.exe" = protocol=17 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqvwrk.exe |
"UDP Query User{884768CE-C413-4DC2-834D-7D731DCD3BBA}C:\simulia\abaqus\6.10-3\exec\abqcaek.exe" = protocol=17 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqcaek.exe |
"UDP Query User{B619DAF9-0C32-4CA3-98C4-8F0997E2CFE1}C:\simulia\abaqus\6.10-3\exec\abqcaek.exe" = protocol=17 | dir=in | app=c:\simulia\abaqus\6.10-3\exec\abqcaek.exe |
"UDP Query User{FB023436-E953-4817-B7B4-8B1E4E805957}C:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\aaron\appdata\roaming\dropbox\bin\dropbox.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}" = Sony Video Shared Library
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (VAIO_VEDB)
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{09206F12-0EE5-46A7-80B7-725E214E87FF}" = Adams 2012
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX860_series" = Canon MX860 series MP Drivers
"{1417F599-1DBD-4499-9375-B2813E9F890C}" = VAIO Camera Utility
"{17C7703E-0B2A-4593-9CB7-E2FE14B6F8EA}" = Sony Snymsico for Vista
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"{2063C2E8-3812-4BBD-9998-6610F80C1DD4}" = VAIO Media AC3 Decoder 1.0
"{24960AC2-C413-4A86-B1C1-E4CCADCA44D3}" = VAIO Information FLOW
"{25569723-DC5A-4467-A639-79535BF01B71}" = Adobe Help Center 2.1
"{268278CF-FB69-4D98-B70E-BFEC1CDCA225}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{2864C41B-EF2D-4640-95A2-526276524519}" = Borland C++Builder 6
"{2A0F3EF9-68EE-49E9-A05B-ED5B82DF63E5}" = Wireless Switch Setting Utility
"{2A2FF7F5-6F0E-4A5D-A881-39365E718BD6}" = VAIO Cozy Orange Wallpaper
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{34B32B70-8081-11E2-89AF-B8AC6F98CCE3}" = Google Earth Plug-in
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D79DB6E-73DA-46C9-B8FA-DAE52108246F}" = OpenMG Secure Module 4.6.01
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{500162A0-4DD5-460A-BAFD-895AAE48C532}" = VAIO Media Content Collection 6.0
"{500C3FDC-5E5F-485F-BDF5-2C445839CBE0}" =
"{50BFDB3B-9CA8-477E-82FE-D3CD5F58F8C4}" = Dassault Systemes Software VC9 Prerequisites x86
"{55B781F0-060E-11D4-99D7-00C04FCCB775}" =
"{560F6B2E-F0DF-44E5-8190-A4A161F0E205}" = VAIO Media 6.0
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{5855C127-1F20-404D-B7FB-1FD84D7EAB5E}" = VAIO Media Redistribution 6.0
"{59452470-A902-477F-9338-9B88101681BD}" = Setting Utility Series
"{5958CAC6-373E-402F-84FE-0A699AA920B9}" = LAN Setting Utility
"{5E343EF6-D27C-4CFC-9FAE-9AAFB541BCEE}" = VAIO Photo 2007
"{6332AFF1-9D9A-429C-AA03-F82749FA4F49}" = SonicStage Mastering Studio
"{63415CB1-3C97-4D9C-980D-336710EB0526}" = Age of Empires III - The Asian Dynasties Trial
"{685BCC47-B8EC-45EC-BBCE-77DF2451502C}" = DVgate Plus
"{6B1F20F2-6321-4669-A58C-33DF8E7517FF}" = VAIO Entertainment Platform
"{6BADDD61-4B40-4FD1-BAE8-0E8C1E85F806}" = Solid Edge ST4
"{6D2576EC-A0E9-418A-A09A-409933A3B6F4}" = VAIO Camera Capture Utility
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{785EB1D4-ECEC-4195-99B4-73C47E187721}" = VAIO Media Integrated Server 6.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{934A3213-1CB6-4264-84A2-EE080C017BCA}" = VAIO Tender Green Wallpaper
"{97260AE9-A1EE-492E-8DCC-FD0AFF785720}" =
"{97BCD719-6ECB-458F-97D6-F38D2E07375E}" = VAIO Aqua Breeze Wallpaper
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C1C8A04-F8CA-4472-A92D-4288CE32DE86}" = SonicStage Mastering Studio Plug-Ins
"{9D12A8B5-9D41-4465-BF11-70719EB0CD02}" = VU5x86
"{9E319E96-ED8E-4B01-9775-C521A1869A25}" = VAIO Power Management
"{9E407618-D9CD-4F39-9490-9ED45294073D}" = Click to DVD 2.0.05 Menu Data
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO
"{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}" = VAIO Update
"{A0EB195B-5876-48E6-879D-33D4B2102610}" = SonicStage 4.2
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A7B609FB-83D8-4FC3-8477-1BC65ECFE85B}" = Adobe Photoshop Elements 5.0
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A947C2B3-7445-42C4-9063-EE704CACCB22}" = VAIO Hardware Diagnostics
"{AC76BA86-1033-F400-BA7E-000000000003}" = Adobe Acrobat 8 Standard - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-A80000000002}" = Adobe Reader 8 - Deutsch
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF9A04EB-7D8E-41DE-9EDE-4AB9BB2B71B6}" = VAIO Media Registration Tool 6.0
"{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}" = Cisco Systems VPN Client 5.0.07.0290
"{C183A21C-395A-490F-99D4-CCAB35E32859}" =
"{CC2FBD86-F382-4F9D-93D0-9CA71318DEAF}" = DNE Update
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D2AC7034-15AC-4F62-85BD-1E48021E45D6}_is1" = concept/design onlineTV 8
"{DF7DB916-90E5-40F2-9010-B8125EB5FD6F}" = SonicStage Mastering Studio Audio Filter
"{E12C6653-1FF0-4686-ADB8-589C13AE761F}" = Citavi
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E2B38044-AEF2-40AF-BDD8-FEDE799A8633}" =
"{E809063C-51A3-4269-8984-D1EB742F2151}" = Click to DVD 2.6.00
"{EC37A846-53AC-4DA7-98FA-76A4E74AA900}" = Benutzerdefinierte Voreinstellungen für SonicStage Mastering Studio Audio Filter
"{EF3D45BB-2260-4008-88EA-492E7744A9DF}" = Sony Utilities DLL
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0D85ADD-DD61-4B43-87A0-6DA52A211A8B}" = VAIO Event Service
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F570A6CC-53ED-4AA9-8B08-551CD3E38D8B}" =
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FC37C108-821D-4EDE-8F40-D5B497586805}" = VAIO Control Center
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"Abaqus 6.10 PDF Documentation" = Abaqus 6.10 PDF Documentation
"Abaqus 6.10-3" = Abaqus 6.10-3
"Abaqus FLEXnet License Server" = Abaqus FLEXnet License Server
"Adobe Acrobat 8 Standard - English, Français, Deutsch" = Adobe Acrobat 8 Standard - English, Français, Deutsch
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 5" = Adobe Photoshop Elements 5.0
"Amazon Kindle" = Amazon Kindle
"Avira AntiVir Desktop" = Avira Free Antivirus
"CamStudio" = CamStudio
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_104D0200" = HDAUDIO SoftV92 Data Fax Modem with SmartCP
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"HP-MPI_is1" = HP-MPI 1.1
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"InstallShield_{3D79DB6E-73DA-46C9-B8FA-DAE52108246F}" = OpenMG Secure Module 4.6.01
"InstallShield_{63415CB1-3C97-4D9C-980D-336710EB0526}" = Age of Empires III - The Asian Dynasties Trial
"MatlabR2008b" = MATLAB R2008b
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 2.1" = Canon MP Navigator EX 2.1
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"PROSet" = Intel(R) PRO Network Connections Drivers
"Trojan Remover_is1" = Trojan Remover 6.8.6
"TrojanHunter_is1" = TrojanHunter 5.5
"WinRAR archiver" = WinRAR
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
========== Last 20 Event Log Errors ==========
[ System Events ]
Error - 01.06.2013 18:30:09 | Computer Name = Aaron-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >
Code:
ATTFilter OTL logfile created on: 02.06.2013 13:22:41 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Aaron\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,26 Gb Available Physical Memory | 63,06% Memory free 4,23 Gb Paging File | 3,17 Gb Available in Paging File | 74,97% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 145,27 Gb Total Space | 39,93 Gb Free Space | 27,49% Space Free | Partition Type: NTFS Drive D: | 31,72 Gb Total Space | 31,63 Gb Free Space | 99,72% Space Free | Partition Type: NTFS Computer Name: AARON-PC | User Name: Aaron | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.01 18:00:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Aaron\Desktop\OTL.exe PRC - [2013.05.06 12:21:36 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.03.29 14:51:59 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2013.03.29 14:51:26 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2013.03.29 14:51:20 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2012.10.26 11:33:12 | 001,038,496 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe PRC - [2012.10.26 10:44:42 | 000,957,056 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Update\VUAgent.exe PRC - [2012.07.03 10:04:58 | 000,507,312 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe PRC - [2012.05.08 21:50:35 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe PRC - [2011.10.04 19:28:28 | 001,088,280 | ---- | M] (Mischel Internet Security) -- C:\Program Files\TrojanHunter 5.5\THGuard.exe PRC - [2010.03.23 14:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.04.10 23:27:30 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2007.06.15 12:45:20 | 000,469,112 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe PRC - [2006.11.25 08:29:44 | 002,134,016 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe PRC - [2006.11.24 18:58:38 | 000,919,672 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Power Management\SPMgr.exe PRC - [2006.11.24 11:36:54 | 000,182,392 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe PRC - [2006.11.24 11:36:54 | 000,100,472 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe PRC - [2006.11.14 11:46:24 | 000,411,768 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe PRC - [2006.11.11 16:35:36 | 000,043,128 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\ISB Utility\ISBMgr.exe PRC - [2006.10.31 22:40:16 | 000,077,824 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe PRC - [2006.10.31 14:52:08 | 000,108,136 | ---- | M] () -- C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe PRC - [2006.10.27 20:13:48 | 000,270,336 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe PRC - [2006.10.22 23:24:02 | 000,620,152 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe PRC - [2006.09.26 15:48:36 | 000,172,032 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe PRC - [2006.09.26 15:46:58 | 000,135,168 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe PRC - [2006.09.13 15:29:46 | 000,274,432 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe PRC - [2006.09.11 09:23:22 | 000,118,784 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apoint.exe PRC - [2006.09.08 08:06:08 | 000,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apntex.exe PRC - [2006.09.08 07:54:30 | 000,042,544 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\ApMsgFwd.exe PRC - [2006.08.23 13:43:08 | 000,274,432 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe PRC - [2006.01.23 23:14:10 | 000,069,632 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe ========== Modules (No Company Name) ========== MOD - [2012.10.11 22:56:46 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012.10.11 22:56:22 | 001,242,512 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2006.11.14 11:46:24 | 000,040,960 | ---- | M] () -- C:\Program Files\Sony\VAIO Camera Utility\VCULib.dll MOD - [2005.07.22 21:30:20 | 000,065,536 | ---- | M] () -- C:\Windows\System32\TosCommAPI.dll ========== Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService) SRV - [2013.06.01 14:38:14 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.15 06:54:27 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.03.29 14:51:59 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.03.29 14:51:20 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.10.26 10:44:42 | 000,957,056 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Program Files\Sony\VAIO Update\VUAgent.exe -- (VUAgent) SRV - [2012.05.08 21:50:35 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2010.03.23 14:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND) SRV - [2008.01.18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2007.01.16 14:05:00 | 002,523,136 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe -- (VAIOMediaPlatform-IntegratedServer-AppServer) SRV - [2007.01.16 14:05:00 | 001,089,536 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe -- (VAIOMediaPlatform-UCLS-UPnP) SRV - [2007.01.16 14:05:00 | 001,089,536 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe -- (VAIOMediaPlatform-IntegratedServer-UPnP) SRV - [2007.01.12 11:03:16 | 000,073,728 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe -- (VAIO Entertainment TV Device Arbitration Service) SRV - [2007.01.10 16:51:06 | 000,745,472 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe -- (VAIOMediaPlatform-UCLS-AppServer) SRV - [2007.01.08 17:06:40 | 000,397,312 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe -- (VAIOMediaPlatform-UCLS-HTTP) SRV - [2007.01.08 17:06:40 | 000,397,312 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe -- (VAIOMediaPlatform-IntegratedServer-HTTP) SRV - [2007.01.08 17:01:34 | 000,491,520 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe -- (VAIOMediaPlatform-Mobile-Gateway) SRV - [2006.11.24 11:36:54 | 000,182,392 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service) SRV - [2006.11.13 17:31:22 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe -- (SSScsiSV) SRV - [2006.10.31 22:40:16 | 000,077,824 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service) SRV - [2006.10.31 14:52:08 | 000,108,136 | ---- | M] () [Auto | Running] -- C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor5.0) SRV - [2006.10.04 18:25:00 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AvLib\MSCSPTISRV.exe -- (MSCSPTISRV) SRV - [2006.10.04 18:15:30 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AvLib\PACSPTISVR.exe -- (PACSPTISVR) SRV - [2006.10.04 18:06:58 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AvLib\SPTISRV.exe -- (SPTISRV) SRV - [2006.09.26 15:48:36 | 000,172,032 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe -- (VzCdbSvc) SRV - [2006.09.26 15:46:58 | 000,135,168 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe -- (VzFw) SRV - [2006.08.23 13:43:08 | 000,274,432 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe -- (Vcsw) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Aaron\AppData\Local\Temp\catchme.sys -- (catchme) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - [2013.03.29 14:52:54 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2013.03.29 14:52:54 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2013.03.29 14:52:54 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013.03.20 08:22:01 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2012.09.21 13:16:28 | 000,094,848 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\dnelwf.sys -- (DNE) DRV - [2010.12.30 15:19:40 | 000,016,640 | -H-- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys -- (Apowersoft_AudioDevice) DRV - [2010.03.23 14:15:36 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA) DRV - [2009.04.10 21:45:26 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST) DRV - [2007.01.18 20:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA) DRV - [2006.12.07 13:25:00 | 004,456,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2006.11.21 14:57:36 | 000,113,792 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd) DRV - [2006.11.20 17:55:16 | 000,036,480 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp) DRV - [2006.11.17 07:18:44 | 000,645,120 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA) DRV - [2006.11.06 15:56:03 | 000,227,328 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ti21sony.sys -- (ti21sony) DRV - [2006.11.02 09:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) DRV - [2006.11.01 06:31:46 | 000,017,328 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiWinAcc.sys -- (SiFilter) DRV - [2006.11.01 06:31:14 | 000,012,464 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiRemFil.sys -- (SiRemFil) DRV - [2006.11.01 06:30:34 | 000,074,672 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SI3132.sys -- (SI3132) DRV - [2006.10.30 02:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) DRV - [2006.10.28 00:29:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfusb.sys -- (tosrfusb) DRV - [2006.10.27 15:08:36 | 000,072,704 | ---- | M] (Ricoh) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\R5U870FLx86.sys -- (R5U870FLx86) DRV - [2006.10.27 15:08:32 | 000,043,904 | ---- | M] (Ricoh) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\R5U870FUx86.sys -- (R5U870FUx86) DRV - [2006.10.18 12:56:30 | 000,010,216 | ---- | M] (Sony Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\DMICall.sys -- (DMICall) DRV - [2006.10.13 13:34:22 | 000,027,520 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SonyNC.sys -- (SNC) DRV - [2006.10.10 19:33:22 | 000,041,600 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte) DRV - [2006.10.05 16:07:46 | 000,073,600 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TosRfhid.sys -- (Tosrfhid) DRV - [2006.09.06 11:44:52 | 000,030,976 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SonyImgF.sys -- (SonyImgF) DRV - [2006.08.30 02:35:58 | 000,140,800 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService) DRV - [2006.08.04 10:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio) DRV - [2005.08.01 16:45:08 | 000,064,896 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom) DRV - [2005.01.06 13:42:42 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{950892BA-F179-46C2-AEFE-D5283BB31E2E}: "URL" = hxxp://partnerpage.google.com/eu.sony.com/de/search?hl=de&q={searchTerms}&btnG=Google-Suche&meta= IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\..\SearchScopes\{950892BA-F179-46C2-AEFE-D5283BB31E2E}: "URL" = hxxp://partnerpage.google.com/eu.sony.com/de/search?hl=de&q={searchTerms}&btnG=Google-Suche&meta= IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012.05.07 22:26:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.06.01 14:38:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.07 22:15:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aaron\AppData\Roaming\mozilla\Extensions [2013.06.01 20:05:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aaron\AppData\Roaming\mozilla\Firefox\Profiles\ur3o4end.default\extensions [2013.06.01 14:38:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\browser\extensions [2013.06.01 14:38:15 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2013.06.01 19:36:01 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll (Your Company Name) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [THGuard] C:\Program Files\TrojanHunter 5.5\THGuard.exe (Mischel Internet Security) O4 - HKLM..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe (Simply Super Software) O4 - HKLM..\Run: [VAIOCameraUtility] C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe (Sony Corporation) O4 - Startup: C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Aaron\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1804135862-959246047-3320822541-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html () O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: RSS-Support-Site zu VAIO Information FLOW hinzufügen - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html () O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\jp2iexp.dll () O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 10.17.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{06B176C6-2B29-4202-92E4-F0328FA04F7E}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{379166A5-AC13-4662-9A43-FE2D102A87D4}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation) O24 - Desktop WallPaper: C:\Users\Aaron\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Aaron\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.06.01 20:04:10 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT [2013.06.01 20:04:05 | 000,000,000 | ---D | C] -- C:\JRT [2013.06.01 20:03:29 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Aaron\Desktop\JRT.exe [2013.06.01 19:39:02 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013.06.01 19:38:55 | 000,000,000 | ---D | C] -- C:\Users\Aaron\AppData\Local\temp [2013.06.01 19:18:36 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2013.06.01 19:18:36 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2013.06.01 19:18:36 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2013.06.01 19:18:30 | 000,000,000 | ---D | C] -- C:\ComboFix [2013.06.01 19:18:21 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.06.01 19:17:45 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2013.06.01 19:16:56 | 005,076,199 | R--- | C] (Swearware) -- C:\Users\Aaron\Desktop\ComboFix.exe [2013.06.01 18:00:32 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Aaron\Desktop\OTL.exe [2013.06.01 14:38:00 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013.05.31 11:03:01 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Neuer Ordner (2) [2013.05.31 10:06:11 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Julian [2013.05.31 08:27:25 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Stribeck Kurve [2013.05.31 08:27:25 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Stick-Slip [2013.05.31 08:27:25 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Bilder Präsentation [2013.05.31 08:27:25 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\2013_02_03 [2013.05.31 08:27:25 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\2012_07_15 [2013.05.31 03:33:17 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Bericht Fertig [2013.05.27 12:47:04 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Bewerbung VOLKE Studienarbeit [2013.05.24 16:41:06 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Desktop\Neuer Ordner [2013.05.18 17:51:20 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2013.05.18 17:50:00 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Documents\Simply Super Software [2013.05.18 17:50:00 | 000,000,000 | ---D | C] -- C:\Users\Aaron\AppData\Roaming\Simply Super Software [2013.05.18 17:49:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover [2013.05.18 17:49:49 | 000,605,968 | ---- | C] (Igor Pavlov) -- C:\Windows\System32\ztv7z.dll [2013.05.18 17:49:48 | 000,077,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ztvcabinet.dll [2013.05.18 17:49:46 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover [2013.05.18 17:49:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software [2013.05.18 17:47:44 | 000,000,000 | ---D | C] -- C:\Users\Aaron\AppData\Roaming\TrojanHunter [2013.05.18 12:59:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter [2013.05.18 12:59:13 | 000,000,000 | ---D | C] -- C:\ProgramData\TrojanHunter [2013.05.18 12:59:02 | 000,000,000 | ---D | C] -- C:\Program Files\TrojanHunter 5.5 [2013.05.18 10:24:45 | 000,000,000 | R--D | C] -- C:\Users\Aaron\Dropbox [2013.05.18 10:21:04 | 000,000,000 | ---D | C] -- C:\Program Files\Dropbox [2013.05.18 10:20:49 | 000,000,000 | ---D | C] -- C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox [2013.05.18 10:18:54 | 000,000,000 | ---D | C] -- C:\Users\Aaron\AppData\Roaming\Dropbox [2013.05.16 03:14:17 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2013.05.16 03:02:18 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2013.05.16 03:02:18 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2013.05.16 03:02:18 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2013.05.16 03:02:18 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2013.05.16 03:02:17 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2013.05.16 03:02:17 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2013.05.16 03:02:16 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2013.05.15 21:29:49 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll [2013.05.15 21:29:47 | 002,049,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2013.05.13 21:47:23 | 000,000,000 | -H-D | C] -- C:\Windows\PIF [2013.05.09 13:43:08 | 000,000,000 | ---D | C] -- C:\Users\Aaron\AppData\Roaming\MathWorks [2013.05.09 13:42:57 | 000,000,000 | ---D | C] -- C:\Users\Aaron\Documents\MATLAB [2013.05.09 13:41:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MATLAB [2013.05.09 13:19:30 | 000,000,000 | ---D | C] -- C:\Program Files\MATLAB ========== Files - Modified Within 30 Days ========== [2013.06.02 12:59:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.06.02 12:54:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.06.02 12:28:36 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.02 12:28:36 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.02 11:07:46 | 000,728,432 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.06.02 11:07:46 | 000,678,860 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.06.02 11:07:46 | 000,167,990 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.06.02 11:07:46 | 000,136,360 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.06.02 02:59:00 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.06.02 00:29:31 | 000,002,565 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk [2013.06.02 00:29:20 | 000,002,473 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat - Schnellstart.lnk [2013.06.02 00:28:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.06.02 00:28:27 | 2145,574,912 | -HS- | M] () -- C:\hiberfil.sys [2013.06.01 20:03:31 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Aaron\Desktop\JRT.exe [2013.06.01 19:46:45 | 000,632,031 | ---- | M] () -- C:\Users\Aaron\Desktop\adwcleaner.exe [2013.06.01 19:36:01 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts [2013.06.01 19:17:02 | 005,076,199 | R--- | M] (Swearware) -- C:\Users\Aaron\Desktop\ComboFix.exe [2013.06.01 18:18:12 | 000,377,856 | ---- | M] () -- C:\Users\Aaron\Desktop\gmer_2.1.19163.exe [2013.06.01 18:16:43 | 000,000,000 | ---- | M] () -- C:\Users\Aaron\defogger_reenable [2013.06.01 18:15:33 | 000,050,477 | ---- | M] () -- C:\Users\Aaron\Desktop\Defogger.exe [2013.06.01 18:00:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Aaron\Desktop\OTL.exe [2013.05.31 13:02:39 | 000,000,004 | ---- | M] () -- C:\Users\Aaron\AppData\Roaming\skype.ini [2013.05.29 19:39:12 | 002,210,116 | ---- | M] () -- C:\Users\Aaron\Desktop\DIN+50125-2009++%E9%87%91%E5%B1%9E%E6%9D%90%E6%96%99%E8%AF%95%E9%AA%8C.%E6%8A%97%E6%8B%89%E5%BC%BA%E5%BA%A6%E8%AF%95%E6%A0%B7.pdf [2013.05.29 15:56:25 | 000,081,818 | ---- | M] () -- C:\Users\Aaron\Desktop\Präsentation1.gif [2013.05.25 08:50:01 | 000,001,356 | ---- | M] () -- C:\Users\Aaron\AppData\Local\d3d9caps.dat [2013.05.18 12:59:16 | 000,059,392 | R--- | M] () -- C:\Windows\System32\streamhlp.dll [2013.05.18 10:24:45 | 000,000,941 | ---- | M] () -- C:\Users\Aaron\Desktop\Dropbox.lnk [2013.05.18 10:21:41 | 000,000,951 | ---- | M] () -- C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2013.05.16 22:36:46 | 000,364,576 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013.05.15 06:54:27 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013.05.15 06:54:27 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2013.05.12 13:48:46 | 000,001,964 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk [2013.05.12 13:48:46 | 000,001,912 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Acrobat 8 Standard.lnk [2013.05.09 13:41:29 | 000,001,005 | ---- | M] () -- C:\Users\Public\Desktop\MATLAB R2008b.lnk [2013.05.05 21:12:55 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb ========== Files Created - No Company Name ========== [2013.06.01 19:46:42 | 000,632,031 | ---- | C] () -- C:\Users\Aaron\Desktop\adwcleaner.exe [2013.06.01 19:18:36 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013.06.01 19:18:36 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013.06.01 19:18:36 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013.06.01 19:18:36 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013.06.01 19:18:36 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2013.06.01 18:18:11 | 000,377,856 | ---- | C] () -- C:\Users\Aaron\Desktop\gmer_2.1.19163.exe [2013.06.01 18:16:43 | 000,000,000 | ---- | C] () -- C:\Users\Aaron\defogger_reenable [2013.06.01 18:15:31 | 000,050,477 | ---- | C] () -- C:\Users\Aaron\Desktop\Defogger.exe [2013.05.31 13:01:47 | 000,000,004 | ---- | C] () -- C:\Users\Aaron\AppData\Roaming\skype.ini [2013.05.29 19:39:12 | 002,210,116 | ---- | C] () -- C:\Users\Aaron\Desktop\DIN+50125-2009++%E9%87%91%E5%B1%9E%E6%9D%90%E6%96%99%E8%AF%95%E9%AA%8C.%E6%8A%97%E6%8B%89%E5%BC%BA%E5%BA%A6%E8%AF%95%E6%A0%B7.pdf [2013.05.29 15:56:23 | 000,081,818 | ---- | C] () -- C:\Users\Aaron\Desktop\Präsentation1.gif [2013.05.18 17:49:49 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll [2013.05.18 17:49:48 | 000,185,616 | ---- | C] () -- C:\Windows\System32\ztvunrar39.dll [2013.05.18 17:49:48 | 000,169,744 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll [2013.05.18 17:49:48 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll [2013.05.18 17:49:48 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll [2013.05.18 12:59:03 | 000,059,392 | R--- | C] () -- C:\Windows\System32\streamhlp.dll [2013.05.18 10:24:45 | 000,000,941 | ---- | C] () -- C:\Users\Aaron\Desktop\Dropbox.lnk [2013.05.18 10:21:41 | 000,000,951 | ---- | C] () -- C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2013.05.09 13:41:29 | 000,001,005 | ---- | C] () -- C:\Users\Public\Desktop\MATLAB R2008b.lnk [2012.10.22 21:50:02 | 000,013,811 | ---- | C] () -- C:\Users\Aaron\abaqus_v6.10.gpr [2012.10.19 08:26:55 | 000,569,161 | ---- | C] () -- C:\Users\Aaron\modified_brake_pull.res [2012.10.19 08:26:55 | 000,003,380 | ---- | C] () -- C:\Users\Aaron\modified_brake_pull.wev [2012.10.19 08:26:51 | 000,019,218 | ---- | C] () -- C:\Users\Aaron\modified_suspnsn.msg [2012.10.19 08:26:46 | 000,256,624 | ---- | C] () -- C:\Users\Aaron\modified_suspnsn.adm [2012.10.19 08:26:45 | 000,000,844 | ---- | C] () -- C:\Users\Aaron\modified_suspnsn.acf [2012.10.18 19:28:40 | 000,569,883 | ---- | C] () -- C:\Users\Aaron\baseline_brake_pull.res [2012.10.18 19:28:40 | 000,003,380 | ---- | C] () -- C:\Users\Aaron\baseline_brake_pull.wev [2012.10.18 19:28:36 | 000,019,221 | ---- | C] () -- C:\Users\Aaron\baseline_suspnsn.msg [2012.10.18 19:28:33 | 000,256,536 | ---- | C] () -- C:\Users\Aaron\baseline_suspnsn.adm [2012.10.18 19:28:32 | 000,000,846 | ---- | C] () -- C:\Users\Aaron\baseline_suspnsn.acf [2012.10.18 18:32:28 | 000,554,311 | ---- | C] () -- C:\Users\Aaron\baseline_parallel_travel.res [2012.10.18 18:32:28 | 000,003,380 | ---- | C] () -- C:\Users\Aaron\baseline_parallel_travel.wev [2012.10.18 18:32:25 | 000,018,044 | ---- | C] () -- C:\Users\Aaron\baseline_parallel_travel.msg [2012.10.18 18:32:21 | 000,255,470 | ---- | C] () -- C:\Users\Aaron\baseline_parallel_travel.adm [2012.10.18 18:32:20 | 000,000,310 | ---- | C] () -- C:\Users\Aaron\baseline_parallel_travel.acf [2012.10.18 17:57:01 | 000,002,395 | ---- | C] () -- C:\Users\Aaron\.acar.cfq [2012.10.14 19:06:17 | 001,888,701 | ---- | C] () -- C:\Users\Aaron\_parallel_travel.res [2012.10.14 19:06:17 | 000,020,635 | ---- | C] () -- C:\Users\Aaron\_parallel_travel.wev [2012.10.14 19:06:15 | 000,015,734 | ---- | C] () -- C:\Users\Aaron\_parallel_travel.msg [2012.10.14 19:06:09 | 000,205,199 | ---- | C] () -- C:\Users\Aaron\_parallel_travel.adm [2012.10.14 19:06:09 | 000,000,229 | ---- | C] () -- C:\Users\Aaron\_parallel_travel.acf [2012.10.14 17:35:47 | 001,888,711 | ---- | C] () -- C:\Users\Aaron\workshop1b_parallel_travel.res [2012.10.14 17:35:47 | 000,020,635 | ---- | C] () -- C:\Users\Aaron\workshop1b_parallel_travel.wev [2012.10.14 17:35:45 | 000,015,754 | ---- | C] () -- C:\Users\Aaron\workshop1b_parallel_travel.msg [2012.10.14 17:35:42 | 000,205,199 | ---- | C] () -- C:\Users\Aaron\workshop1b_parallel_travel.adm [2012.10.14 17:35:41 | 000,000,239 | ---- | C] () -- C:\Users\Aaron\workshop1b_parallel_travel.acf [2012.10.14 17:13:20 | 008,992,762 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.res [2012.10.14 17:13:18 | 000,003,827 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.sdl [2012.10.14 17:13:14 | 000,023,261 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.msg [2012.10.14 17:13:09 | 000,514,940 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.adm [2012.10.14 17:13:07 | 000,000,261 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.acf [2012.10.14 17:13:06 | 000,016,529 | ---- | C] () -- C:\Users\Aaron\workshop1a_ilc.xml [2012.10.14 16:56:18 | 000,002,260 | ---- | C] () -- C:\Users\Aaron\.acar.cfg.cfq [2012.10.13 12:29:16 | 000,107,166 | ---- | C] () -- C:\Users\Aaron\aview.loq [2012.10.12 15:16:43 | 000,002,398 | ---- | C] () -- C:\Users\Aaron\.acar.cfg [2012.10.12 15:16:43 | 000,002,260 | ---- | C] () -- C:\Users\Aaron\.acar.cfg.cfg [2012.10.12 15:16:32 | 000,003,740 | ---- | C] () -- C:\Users\Aaron\acar.loq [2012.10.07 14:51:16 | 000,511,488 | ---- | C] () -- C:\Windows\System32\lame_enc.dll [2012.10.07 14:51:16 | 000,110,080 | ---- | C] () -- C:\Windows\System32\advd.dll [2012.10.07 14:51:16 | 000,023,040 | ---- | C] () -- C:\Windows\System32\auth.dll [2012.09.10 11:22:02 | 000,014,336 | ---- | C] () -- C:\Users\Aaron\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.08.22 21:54:12 | 000,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI [2012.05.08 21:11:35 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI [2012.05.07 20:34:41 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2012.05.07 20:33:36 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2012.05.07 20:33:36 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2012.05.07 18:33:56 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2012.05.07 18:29:23 | 000,019,968 | ---- | C] () -- C:\Windows\System32\Cpuinf32.dll [2012.05.07 18:22:57 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Sony.dll [2012.05.07 18:11:45 | 000,001,356 | ---- | C] () -- C:\Users\Aaron\AppData\Local\d3d9caps.dat ========== ZeroAccess Check ========== [2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.10 23:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.10 23:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both < End of report > Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff
Log created at 13:44 on 02/06/2013 by Aaron
Administrator - Elevation successful
========== filefind ==========
Searching for "*Conduit*"
C:\MSC.Software\Adams\2012\ainsight\ain_conduit.py ------- 43104 bytes [12:46 12/10/2012] [20:03 20/12/2011] 5058F548CA5AE5A86F24A2606E7070A2
C:\MSC.Software\Adams\2012\interop\lib3dx\win32\resources\graphic\CATConduit.feat ------- 14339 bytes [12:57 12/10/2012] [19:41 20/12/2011] 8DACE35AEA2E37AC373E268069CB8E40
C:\MSC.Software\Adams\2012\interop\lib3dx\win32\resources\graphic\CATConduitSample.CATfct ------- 13072 bytes [12:57 12/10/2012] [19:40 20/12/2011] E31C68A4B350E3E3107AF7BCDFBFA7BB
C:\Program Files\Common Files\Apple\Mobile Device Support\iSyncConduit.dll --a---- 1207392 bytes [10:43 06/12/2012] [10:43 06/12/2012] C963B2DECF0872C4A79D4E5E97062E8C
C:\SIMULIA\Abaqus\6.10-3\External\Interop_32\intel_a\resources\graphic\CATConduit.feat --a---- 14339 bytes [18:47 22/10/2012] [13:32 29/10/2008] 8DACE35AEA2E37AC373E268069CB8E40
C:\SIMULIA\Abaqus\6.10-3\External\Interop_32\intel_a\resources\graphic\CATConduitSample.CATfct --a---- 13072 bytes [18:47 22/10/2012] [13:32 29/10/2008] E31C68A4B350E3E3107AF7BCDFBFA7BB
C:\Users\Aaron\AppData\Local\Microsoft\Internet Explorer\DOMStore\971FP5EQ\search.conduit[1].xml --a---- 206 bytes [16:30 07/10/2012] [16:30 07/10/2012] CF76EC5C6E77CA617B76D3AFF47C7635
C:\Users\Aaron\AppData\Local\Microsoft\Internet Explorer\DOMStore\ZOSVXWXK\storage.conduit[1].xml --a---- 13 bytes [15:12 20/11/2012] [15:12 20/11/2012] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
Searching for "*DVDVideoSoftTB*"
No files found.
Searching for "*Softonic*"
C:\Users\Aaron\AppData\Local\Microsoft\Internet Explorer\DOMStore\MVDAYHPB\search.softonic[1].xml --a---- 208 bytes [09:16 10/09/2012] [09:16 10/09/2012] D59E1BDA3A28F9F5166A86F319FD16FB
C:\Users\Aaron\Downloads\SoftonicDownloader_fuer_streaming-video-recorder.exe --a---- 353000 bytes [09:09 10/09/2012] [09:09 10/09/2012] D8085AD0A45809BEAC3E529FA57990ED
Searching for "*PriceGong*"
No files found.
Searching for "*OpenCandy*"
No files found.
Searching for "*pdfforge*"
C:\Program Files\PDFCreator\PlugIns\pdfforge\pdfforge.chm --a---- 423955 bytes [13:08 23/07/2012] [18:57 27/06/2012] 9F37752515DB8D2EBE60A3A8DBAB7546
C:\Program Files\PDFCreator\PlugIns\pdfforge\pdfforge.dll --a---- 64512 bytes [13:08 23/07/2012] [18:53 27/06/2012] 7AED26F99D1CA5F125AAE5747F5421DD
========== folderfind ==========
Searching for "*Conduit*"
No folders found.
Searching for "*DVDVideoSoftTB*"
No folders found.
Searching for "*Softonic*"
No folders found.
Searching for "*PriceGong*"
No folders found.
Searching for "*OpenCandy*"
No folders found.
Searching for "*pdfforge*"
C:\Program Files\PDFCreator\PlugIns\pdfforge d------ [13:08 23/07/2012]
========== regfind ==========
Searching for "Conduit"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com]
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com]
Searching for "DVDVideoSoftTB"
No data found.
Searching for "Softonic"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\softonic.com]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e386ff39_0]
@="{0.0.0.00000000}.{29634b91-ac25-44f9-88af-fcbc1fd5446f}|\Device\HarddiskVolume2\Users\Aaron\Downloads\SoftonicDownloader_fuer_streaming-video-recorder.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Microsoft\Internet Explorer\DOMStorage\softonic.com]
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e386ff39_0]
@="{0.0.0.00000000}.{29634b91-ac25-44f9-88af-fcbc1fd5446f}|\Device\HarddiskVolume2\Users\Aaron\Downloads\SoftonicDownloader_fuer_streaming-video-recorder.exe%b{00000000-0000-0000-0000-000000000000}"
Searching for "PriceGong"
No data found.
Searching for "OpenCandy"
No data found.
Searching for "pdfforge"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.Images2PDF]
@="pdfforge Images2PDF"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D512261-7F39-3DEA-B9E6-44F1B58C5783}]
@="pdfforge.PDF.PDFText"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D512261-7F39-3DEA-B9E6-44F1B58C5783}\InprocServer32]
"Class"="pdfforge.PDF.PDFText"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D512261-7F39-3DEA-B9E6-44F1B58C5783}\InprocServer32]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D512261-7F39-3DEA-B9E6-44F1B58C5783}\InprocServer32]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D512261-7F39-3DEA-B9E6-44F1B58C5783}\InprocServer32\2.4.0.0]
"Class"="pdfforge.PDF.PDFText"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D512261-7F39-3DEA-B9E6-44F1B58C5783}\InprocServer32\2.4.0.0]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D512261-7F39-3DEA-B9E6-44F1B58C5783}\InprocServer32\2.4.0.0]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D512261-7F39-3DEA-B9E6-44F1B58C5783}\ProgId]
@="pdfforge.PDF.PDFText"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2CE383B7-8DE1-3A87-A090-E01004C18D0D}]
@="pdfforge.X509.X509"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2CE383B7-8DE1-3A87-A090-E01004C18D0D}\InprocServer32]
"Class"="pdfforge.X509.X509"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2CE383B7-8DE1-3A87-A090-E01004C18D0D}\InprocServer32]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2CE383B7-8DE1-3A87-A090-E01004C18D0D}\InprocServer32]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2CE383B7-8DE1-3A87-A090-E01004C18D0D}\InprocServer32\2.4.0.0]
"Class"="pdfforge.X509.X509"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2CE383B7-8DE1-3A87-A090-E01004C18D0D}\InprocServer32\2.4.0.0]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2CE383B7-8DE1-3A87-A090-E01004C18D0D}\InprocServer32\2.4.0.0]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2CE383B7-8DE1-3A87-A090-E01004C18D0D}\ProgId]
@="pdfforge.X509.X509"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EDB5376-DAA6-3443-826C-3A7B64DBC9D1}]
@="pdfforge.PDF.PDFLine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EDB5376-DAA6-3443-826C-3A7B64DBC9D1}\InprocServer32]
"Class"="pdfforge.PDF.PDFLine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EDB5376-DAA6-3443-826C-3A7B64DBC9D1}\InprocServer32]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EDB5376-DAA6-3443-826C-3A7B64DBC9D1}\InprocServer32]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EDB5376-DAA6-3443-826C-3A7B64DBC9D1}\InprocServer32\2.4.0.0]
"Class"="pdfforge.PDF.PDFLine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EDB5376-DAA6-3443-826C-3A7B64DBC9D1}\InprocServer32\2.4.0.0]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EDB5376-DAA6-3443-826C-3A7B64DBC9D1}\InprocServer32\2.4.0.0]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EDB5376-DAA6-3443-826C-3A7B64DBC9D1}\ProgId]
@="pdfforge.PDF.PDFLine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{358C5262-FCCB-32F9-AE90-6A9276CD1A71}]
@="pdfforge.PDF.PDF"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{358C5262-FCCB-32F9-AE90-6A9276CD1A71}\InprocServer32]
"Class"="pdfforge.PDF.PDF"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{358C5262-FCCB-32F9-AE90-6A9276CD1A71}\InprocServer32]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{358C5262-FCCB-32F9-AE90-6A9276CD1A71}\InprocServer32]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{358C5262-FCCB-32F9-AE90-6A9276CD1A71}\InprocServer32\2.4.0.0]
"Class"="pdfforge.PDF.PDF"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{358C5262-FCCB-32F9-AE90-6A9276CD1A71}\InprocServer32\2.4.0.0]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{358C5262-FCCB-32F9-AE90-6A9276CD1A71}\InprocServer32\2.4.0.0]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{358C5262-FCCB-32F9-AE90-6A9276CD1A71}\ProgId]
@="pdfforge.PDF.PDF"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F5B8EE-AC0D-3B21-9C1A-E3EF0DD966FC}]
@="pdfforge.Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F5B8EE-AC0D-3B21-9C1A-E3EF0DD966FC}\InprocServer32]
"Class"="pdfforge.Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F5B8EE-AC0D-3B21-9C1A-E3EF0DD966FC}\InprocServer32]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F5B8EE-AC0D-3B21-9C1A-E3EF0DD966FC}\InprocServer32]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F5B8EE-AC0D-3B21-9C1A-E3EF0DD966FC}\InprocServer32\2.4.0.0]
"Class"="pdfforge.Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F5B8EE-AC0D-3B21-9C1A-E3EF0DD966FC}\InprocServer32\2.4.0.0]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F5B8EE-AC0D-3B21-9C1A-E3EF0DD966FC}\InprocServer32\2.4.0.0]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F5B8EE-AC0D-3B21-9C1A-E3EF0DD966FC}\ProgId]
@="pdfforge.Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65E0A140-B49D-332E-9678-A214CE10BBDF}]
@="pdfforge.PDF.PDFEncryptor"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65E0A140-B49D-332E-9678-A214CE10BBDF}\InprocServer32]
"Class"="pdfforge.PDF.PDFEncryptor"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65E0A140-B49D-332E-9678-A214CE10BBDF}\InprocServer32]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65E0A140-B49D-332E-9678-A214CE10BBDF}\InprocServer32]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65E0A140-B49D-332E-9678-A214CE10BBDF}\InprocServer32\2.4.0.0]
"Class"="pdfforge.PDF.PDFEncryptor"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65E0A140-B49D-332E-9678-A214CE10BBDF}\InprocServer32\2.4.0.0]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65E0A140-B49D-332E-9678-A214CE10BBDF}\InprocServer32\2.4.0.0]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65E0A140-B49D-332E-9678-A214CE10BBDF}\ProgId]
@="pdfforge.PDF.PDFEncryptor"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{916B50E2-28CA-3B5A-8503-D3B62193F207}]
@="pdfforge.PDF.PDF+X509+Signing"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{916B50E2-28CA-3B5A-8503-D3B62193F207}\InprocServer32]
"Class"="pdfforge.PDF.PDF+X509+Signing"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{916B50E2-28CA-3B5A-8503-D3B62193F207}\InprocServer32]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{916B50E2-28CA-3B5A-8503-D3B62193F207}\InprocServer32]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{916B50E2-28CA-3B5A-8503-D3B62193F207}\InprocServer32\2.4.0.0]
"Class"="pdfforge.PDF.PDF+X509+Signing"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{916B50E2-28CA-3B5A-8503-D3B62193F207}\InprocServer32\2.4.0.0]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{916B50E2-28CA-3B5A-8503-D3B62193F207}\InprocServer32\2.4.0.0]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{916B50E2-28CA-3B5A-8503-D3B62193F207}\ProgId]
@="pdfforge.PDF.PDF.X509.Signing"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E4E38F-7318-3FB0-8A79-D2F9595430BB}]
@="pdfforge.PDF.PDF+X509"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E4E38F-7318-3FB0-8A79-D2F9595430BB}\InprocServer32]
"Class"="pdfforge.PDF.PDF+X509"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E4E38F-7318-3FB0-8A79-D2F9595430BB}\InprocServer32]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E4E38F-7318-3FB0-8A79-D2F9595430BB}\InprocServer32]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E4E38F-7318-3FB0-8A79-D2F9595430BB}\InprocServer32\2.4.0.0]
"Class"="pdfforge.PDF.PDF+X509"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E4E38F-7318-3FB0-8A79-D2F9595430BB}\InprocServer32\2.4.0.0]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E4E38F-7318-3FB0-8A79-D2F9595430BB}\InprocServer32\2.4.0.0]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E4E38F-7318-3FB0-8A79-D2F9595430BB}\ProgId]
@="pdfforge.PDF.PDF.X509"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F749CA8E-15C7-3D60-B935-5500537B29A8}]
@="pdfforge.DllInfo"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F749CA8E-15C7-3D60-B935-5500537B29A8}\InprocServer32]
"Class"="pdfforge.DllInfo"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F749CA8E-15C7-3D60-B935-5500537B29A8}\InprocServer32]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F749CA8E-15C7-3D60-B935-5500537B29A8}\InprocServer32]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F749CA8E-15C7-3D60-B935-5500537B29A8}\InprocServer32\2.4.0.0]
"Class"="pdfforge.DllInfo"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F749CA8E-15C7-3D60-B935-5500537B29A8}\InprocServer32\2.4.0.0]
"Assembly"="pdfforge, Version=2.4.0.0, Culture=neutral, PublicKeyToken=null"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F749CA8E-15C7-3D60-B935-5500537B29A8}\InprocServer32\2.4.0.0]
"CodeBase"="file:///C:/Program Files/PDFCreator/PlugIns/pdfforge/pdfforge.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F749CA8E-15C7-3D60-B935-5500537B29A8}\ProgId]
@="pdfforge.DllInfo"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge Images2PDF]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.DllInfo]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.DllInfo]
@="pdfforge.DllInfo"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDF]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDF]
@="pdfforge.PDF.PDF"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDF.X509]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDF.X509]
@="pdfforge.PDF.PDF+X509"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDF.X509.Signing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDF.X509.Signing]
@="pdfforge.PDF.PDF+X509+Signing"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDFEncryptor]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDFEncryptor]
@="pdfforge.PDF.PDFEncryptor"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDFLine]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDFLine]
@="pdfforge.PDF.PDFLine"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDFText]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.PDF.PDFText]
@="pdfforge.PDF.PDFText"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.Tools]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.Tools]
@="pdfforge.Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.X509.X509]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pdfforge.X509.X509]
@="pdfforge.X509.X509"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}]
"Readme"="hxxp://www.pdfforge.org"
Searching for " "
[HKEY_CURRENT_USER\Software\Borland\C++Builder\6.0\Direct]
"Headlines"="
<!DOCTYPE html>
<!--[if lt IE 7 ]><html lang="en" class="no-js ie6 oldie"><![endif]-->
<!--[if IE 7 ]><html lang="en" class="no-js ie7 oldie"><![endif]-->
<!--[if IE 8 ]><html lang="en" class="no-js ie8 oldie"><![endif]-->
<!--[if gt IE 8]><!--><html class="no-js" lang="en"><!--<![endif]-->
<head>
<!-- Meta Information -->
<meta charset="utf-8" /><meta http-equiv="cleartype" content="on" /><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /><meta http-equiv="cache-control" content="no-cache" />
<meta name="description" content="Build better quality software, faster with market leading solutions for Requirements, Test & Change Management. Open. Agile. Enterprise." />
<meta name="keywords" content="Borland" />
<title>Open & Agile Requirement, Test & Change Management Solutions - Borland</title>
<meta name="ROBOTS" content="INDEX,FOLLOW" />
<!-- Icons -->
<
[HKEY_CURRENT_USER\Software\Borland\C++Builder\6.0\Direct]
"Previous Headlines"="
<!DOCTYPE html>
<!--[if lt IE 7 ]><html lang="en" class="no-js ie6 oldie"><![endif]-->
<!--[if IE 7 ]><html lang="en" class="no-js ie7 oldie"><![endif]-->
<!--[if IE 8 ]><html lang="en" class="no-js ie8 oldie"><![endif]-->
<!--[if gt IE 8]><!--><html class="no-js" lang="en"><!--<![endif]-->
<head>
<!-- Meta Information -->
<meta charset="utf-8" /><meta http-equiv="cleartype" content="on" /><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /><meta http-equiv="cache-control" content="no-cache" />
<meta name="description" content="Build better quality software, faster with market leading solutions for Requirements, Test & Change Management. Open. Agile. Enterprise." />
<meta name="keywords" content="Borland" />
<title>Open & Agile Requirement, Test & Change Management Solutions - Borland</title>
<meta name="ROBOTS" content="INDEX,FOLLOW" />
<!-- Icons -
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Aaron\Desktop\TrojanHunter55Setup.exe"="TrojanHunter Setup "
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Aaron\Desktop\trjsetup685.exe"="Trojan Remover Setup "
[HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0]
"ProcessorNameString"="Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1]
"ProcessorNameString"="Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SOFTWARE\Canon\WIA\Devices\MX860 series]
"ProductId"="MX860 "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"=" <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> <Capability Type="Shell"/> </Resource> </Res
[HKEY_LOCAL_MACHINE\SOFTWARE\Sony Corporation\SonicStage\GUI\InternalMS]
"Sony MSC-U01 "=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Sony Corporation\SonicStage\GUI\InternalMS]
"Sony MSC-U02 "=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Sony Corporation\SonicStage\GUI\InternalMS]
"Sony MSC-U03 "=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Sony Corporation\SonicStage\GUI\InternalMS]
"Sony MSC-U04 "=""
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15\_0]
"FriendlyName"="Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15\_1]
"FriendlyName"="Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_2.70#000A27001CAB6D7B&0#]
"DeviceDesc"="iPod "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#087820140BC0F756&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_STT&PROD_&REV_1.00#09021000000111090000000188&0#]
"DeviceDesc"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_USB&PROD_DISK&REV_0.11#BE8A44F14CDB977A&0#]
"DeviceDesc"="Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SI3132\ProblemDevices]
"Maxtor 4D060H3 DAK05GK0"="MaxMode = UDMA-5"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SI3132\ProblemDevices]
"HDS724040KLSA80 KFAOA32A"="DisableAtaQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SI3132\ProblemDevices]
"HDS722525VLSA80 V36OA6MA"="DisableAtaQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SI3132\ProblemDevices]
"HDS722516VLSA80 V34OA6MA"="DisableAtaQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SI3132\ProblemDevices]
"Maxtor 7B250S0 BANC1B70"="DisableSataQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SI3132\ProblemDevices]
"HTS541060G9SA00 MB3OC60D"="DisableSataQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SI3132\ProblemDevices]
"HTS541080G9SA00 MB4OC60D"="DisableSataQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SI3132\ProblemDevices]
"HTS541010G9SA00 MBZOC60D"="DisableSataQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15\_0]
"FriendlyName"="Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15\_1]
"FriendlyName"="Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_2.70#000A27001CAB6D7B&0#]
"DeviceDesc"="iPod "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#087820140BC0F756&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_STT&PROD_&REV_1.00#09021000000111090000000188&0#]
"DeviceDesc"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_USB&PROD_DISK&REV_0.11#BE8A44F14CDB977A&0#]
"DeviceDesc"="Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SI3132\ProblemDevices]
"Maxtor 4D060H3 DAK05GK0"="MaxMode = UDMA-5"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SI3132\ProblemDevices]
"HDS724040KLSA80 KFAOA32A"="DisableAtaQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SI3132\ProblemDevices]
"HDS722525VLSA80 V36OA6MA"="DisableAtaQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SI3132\ProblemDevices]
"HDS722516VLSA80 V34OA6MA"="DisableAtaQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SI3132\ProblemDevices]
"Maxtor 7B250S0 BANC1B70"="DisableSataQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SI3132\ProblemDevices]
"HTS541060G9SA00 MB3OC60D"="DisableSataQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SI3132\ProblemDevices]
"HTS541080G9SA00 MB4OC60D"="DisableSataQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SI3132\ProblemDevices]
"HTS541010G9SA00 MBZOC60D"="DisableSataQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15\_0]
"FriendlyName"="Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\GenuineIntel_-_x86_Family_6_Model_15\_1]
"FriendlyName"="Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_2.70#000A27001CAB6D7B&0#]
"DeviceDesc"="iPod "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#087820140BC0F756&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_STT&PROD_&REV_1.00#09021000000111090000000188&0#]
"DeviceDesc"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_USB&PROD_DISK&REV_0.11#BE8A44F14CDB977A&0#]
"DeviceDesc"="Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SI3132\ProblemDevices]
"Maxtor 4D060H3 DAK05GK0"="MaxMode = UDMA-5"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SI3132\ProblemDevices]
"HDS724040KLSA80 KFAOA32A"="DisableAtaQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SI3132\ProblemDevices]
"HDS722525VLSA80 V36OA6MA"="DisableAtaQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SI3132\ProblemDevices]
"HDS722516VLSA80 V34OA6MA"="DisableAtaQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SI3132\ProblemDevices]
"Maxtor 7B250S0 BANC1B70"="DisableSataQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SI3132\ProblemDevices]
"HTS541060G9SA00 MB3OC60D"="DisableSataQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SI3132\ProblemDevices]
"HTS541080G9SA00 MB4OC60D"="DisableSataQueueing"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SI3132\ProblemDevices]
"HTS541010G9SA00 MBZOC60D"="DisableSataQueueing"
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Borland\C++Builder\6.0\Direct]
"Headlines"="
<!DOCTYPE html>
<!--[if lt IE 7 ]><html lang="en" class="no-js ie6 oldie"><![endif]-->
<!--[if IE 7 ]><html lang="en" class="no-js ie7 oldie"><![endif]-->
<!--[if IE 8 ]><html lang="en" class="no-js ie8 oldie"><![endif]-->
<!--[if gt IE 8]><!--><html class="no-js" lang="en"><!--<![endif]-->
<head>
<!-- Meta Information -->
<meta charset="utf-8" /><meta http-equiv="cleartype" content="on" /><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /><meta http-equiv="cache-control" content="no-cache" />
<meta name="description" content="Build better quality software, faster with market leading solutions for Requirements, Test & Change Management. Open. Agile. Enterprise." />
<meta name="keywords" content="Borland" />
<title>Open & Agile Requirement, Test & Change Management Solutions - Borland</title>
<meta name="ROBOTS" content="INDEX,FOLLOW" />
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Borland\C++Builder\6.0\Direct]
"Previous Headlines"="
<!DOCTYPE html>
<!--[if lt IE 7 ]><html lang="en" class="no-js ie6 oldie"><![endif]-->
<!--[if IE 7 ]><html lang="en" class="no-js ie7 oldie"><![endif]-->
<!--[if IE 8 ]><html lang="en" class="no-js ie8 oldie"><![endif]-->
<!--[if gt IE 8]><!--><html class="no-js" lang="en"><!--<![endif]-->
<head>
<!-- Meta Information -->
<meta charset="utf-8" /><meta http-equiv="cleartype" content="on" /><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /><meta http-equiv="cache-control" content="no-cache" />
<meta name="description" content="Build better quality software, faster with market leading solutions for Requirements, Test & Change Management. Open. Agile. Enterprise." />
<meta name="keywords" content="Borland" />
<title>Open & Agile Requirement, Test & Change Management Solutions - Borland</title>
<meta name="ROBOTS" content="INDEX,FOL
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Aaron\Desktop\TrojanHunter55Setup.exe"="TrojanHunter Setup "
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Aaron\Desktop\trjsetup685.exe"="Trojan Remover Setup "
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Aaron\Desktop\TrojanHunter55Setup.exe"="TrojanHunter Setup "
[HKEY_USERS\S-1-5-21-1804135862-959246047-3320822541-1003_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Aaron\Desktop\trjsetup685.exe"="Trojan Remover Setup "
-= EOF =-
|
|
02.06.2013, 13:17
| #9 |
| /// TB-Ausbilder | Trojaner nach Mahnungsmail Servus, wir entfernen die letzten Reste und kontrollieren nochmal alles: Schritt 1 Fixen mit OTL
Code:
ATTFilter :OTL
[2013.05.31 13:02:39 | 000,000,004 | ---- | M] () -- C:\Users\Aaron\AppData\Roaming\skype.ini
[2013.05.29 19:39:12 | 002,210,116 | ---- | M] () -- C:\Users\Aaron\Desktop\DIN+50125-2009++%E9%87%91%E5%B1%9E%E6%9D%90%E6%96%99%E8%AF%95%E9%AA%8C.%E6%8A%97%E6%8B%89%E5%BC%BA%E5%BA%A6%E8%AF%95%E6%A0%B7.pdf
:files
C:\Users\Aaron\AppData\Local\Microsoft\Internet Explorer\DOMStore\MVDAYHPB\search.softonic[1].xml
C:\Users\Aaron\Downloads\SoftonicDownloader_fuer_streaming-video-recorder.exe
C:\Users\Aaron\AppData\Local\Microsoft\Internet Explorer\DOMStore\971FP5EQ\search.conduit[1].xml
C:\Users\Aaron\AppData\Local\Microsoft\Internet Explorer\DOMStore\ZOSVXWXK\storage.conduit[1].xml
:reg
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\softonic.com]
:Commands
[emptytemp]
Schritt 2 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 3 ESET Online Scanner
Schritt 4 Downloade Dir bitte  SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
|
|
02.06.2013, 17:57
| #10 |
| | Trojaner nach MahnungsmailCode:
ATTFilter All processes killed
========== OTL ==========
C:\Users\Aaron\AppData\Roaming\skype.ini moved successfully.
C:\Users\Aaron\Desktop\DIN+50125-2009++%E9%87%91%E5%B1%9E%E6%9D%90%E6%96%99%E8%AF%95%E9%AA%8C.%E6%8A%97%E6%8B%89%E5%BC%BA%E5%BA%A6%E8%AF%95%E6%A0%B7.pdf moved successfully.
========== FILES ==========
C:\Users\Aaron\AppData\Local\Microsoft\Internet Explorer\DOMStore\MVDAYHPB\search.softonic[1].xml moved successfully.
C:\Users\Aaron\Downloads\SoftonicDownloader_fuer_streaming-video-recorder.exe moved successfully.
C:\Users\Aaron\AppData\Local\Microsoft\Internet Explorer\DOMStore\971FP5EQ\search.conduit[1].xml moved successfully.
C:\Users\Aaron\AppData\Local\Microsoft\Internet Explorer\DOMStore\ZOSVXWXK\storage.conduit[1].xml moved successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\softonic.com\ deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Aaron
->Temp folder emptied: 456490 bytes
->Temporary Internet Files folder emptied: 55315117 bytes
->Java cache emptied: 927034 bytes
->FireFox cache emptied: 142597586 bytes
->Flash cache emptied: 55768 bytes
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Default User
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 373904 bytes
Total Files Cleaned = 190,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 06022013_145745
Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\JETD670.tmp not found!
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.06.02.02 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Aaron :: AARON-PC [Administrator] 02.06.2013 15:09:54 mbam-log-2013-06-02 (15-09-54).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 224946 Laufzeit: 10 Minute(n), 6 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b81cdb773960474f8835628641b35177
# engine=13975
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-02 04:07:53
# local_time=2013-06-02 06:07:53 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 97 12871 115959757 5630 0
# compatibility_mode=5892 16776574 100 100 5615085 207722001 0 0
# scanned=332708
# found=1
# cleaned=0
# scan_time=9106
sh=1D49560857393FC6472532049AAA92917278466C ft=1 fh=05bd3d1bd9f1e9f1 vn="a variant of Win32/Kryptik.BCKO trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Aaron\AppData\Roaming\skype.dat.vir"
Code:
ATTFilter Results of screen317's Security Check version 0.99.64 Windows Vista Service Pack 2 x86 (UAC is disabled!) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Trojan Remover 6.8.6 Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 17 Java(TM) SE Runtime Environment 6 Java version out of Date! Adobe Flash Player 11.7.700.202 Adobe Reader 8 Adobe Reader out of Date! Mozilla Firefox (21.0) ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` |
|
02.06.2013, 18:17
| #11 |
| /// TB-Ausbilder | Trojaner nach Mahnungsmail Servus, der Fund von ESET stellt keine Gefahr mehr dar, da er sich bereits in der Quarantäne von ComboFix befindet und mit DelFix (siehe weiter unten) automatisch entfernt wird.  Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.  Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Schritt 1 Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Schritt 2 Deinstalliere bitte deine aktuelle Version von Adobe Reader Start--> Systemsteuerung--> Software / Programme deinstallieren--> Adobe Reader und lade dir die neue Version von Hier herunter- Entferne den Hacken für den McAfee SecurityScan bzw. Google Chrome. Schritt 3
Prüfe bitte auch (regelmässig) ob folgende Links fehlende Updates bei deinen Plugins zeigen: Schritt 4 Die Reihenfolge ist hier entscheidend.
Schritt 5 Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von Registry Cleanern. Diese Schaden deinem System mehr als dass sie helfen. Hier ein englischer Link: Miekemoes Blogspot ( MVP ) Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. |
|
03.06.2013, 09:03
| #12 |
| | Trojaner nach Mahnungsmail Vielen Dank, alles soweit erledigt! Jedoch habe ich das Gefühl, mein Rechner spinnt noch etwas.... Im Internet zum Beispiel flackert auf einmal der Mauszeiger über den Bildschirm und es öffnet sich beispielsweise ohne jeglichen Grund die Bibliothek und im Anschluss schließt sich dann Firefox komplett ohne Absturzbericht... Was kann das sein  |
|
03.06.2013, 15:39
| #13 | |
| /// TB-Ausbilder | Trojaner nach MahnungsmailZitat:
Malware befindet sich laut den Logdateien keine mehr auf deinem Rechner. Daher vermute ich, dass es an Firefox oder einem anderen Programm liegt, das die Probleme verursacht. Hier könntest du dein Problem noch schildern: Alles rund um Windows Ich bin froh, dass wir helfen konnten  In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest: Lob, Kritik und Wünsche Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen. |
|
| Themen zu Trojaner nach Mahnungsmail |
| avg, avira, bildschirm, csrss.exe, desktop, explorer.exe, free, home, infizierte, logfile, lsass.exe, modul, namen, programm, prozesse, registry, services.exe, spoolsv.exe, svchost.exe, trojaner, vista, warnung, windows, winlogon.exe, wmp |
Textbox.
Linear-Darstellung
