|
funmoods & DR/FakePic.Gen tmp.edb Hallo, habe Avira, Bezahlversion. Vista 32 bit vorhin den OTL scan gemacht, poste im Anschluß. Defogger hat keine Meldung gebracht, habe ungeschickter Weise 2 x laufen lassen. Die Windows- Firewall ist nach jedem Hochfahren/ Bereitschaftsstart seit einiger Zeit ausgeschaltet. Der tmp.edb wurde schon 6 x in Quarantäne verschoben, wird jedesmal wieder gefunden. PS: Schönen Gruß an ARNE, der mir das letzte Mal sehr geholfen hat. Donation hatte ich nicht vergessen, auch diesmal gerne wieder. Ihr seid jeden Cent wert!! von Stefan OTL Extras logfile created on: 08.03.2012 07:56:21 - Run 4 OTL by OldTimer - Version 3.2.35.1 Folder = C:\Users\stefan\Desktop Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,87 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 42,22% Memory free 3,98 Gb Paging File | 2,57 Gb Available in Paging File | 64,57% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 116,21 Gb Total Space | 30,20 Gb Free Space | 25,98% Space Free | Partition Type: NTFS Drive E: | 115,21 Gb Total Space | 55,74 Gb Free Space | 48,39% Space Free | Partition Type: NTFS Computer Name: STEFANS-PC | User Name: stefan | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = ChromeHTML] -- Reg Error: Key error. File not found ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htafile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.) https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found "VistaSp2" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0C8D1522-7E32-4BC0-BE14-D90FB4825D3C}" = rport=139 | protocol=6 | dir=out | app=system | "{144A587B-9B81-410D-8273-00DBD342F077}" = lport=139 | protocol=6 | dir=in | app=system | "{15E8C7F0-1F48-4F97-94A4-5D1AFA70070A}" = rport=445 | protocol=6 | dir=out | app=system | "{1932CA5D-3CA1-4DB4-B302-A6EEF8554BEC}" = rport=137 | protocol=17 | dir=out | app=system | "{2C88C1E2-BC5D-47B2-9F47-1A946A8E38F5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{2F928AA8-8801-42A7-AA89-28B122243FFA}" = lport=138 | protocol=17 | dir=in | app=system | "{4001BB15-D4FD-4FD8-A357-0F3B7106D3E1}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{580834CE-2A4F-4316-A2CA-A3C095E416DF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{65D5C019-7B04-49AA-B130-EDCA2C0EEE5C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{6B6A5499-D5A3-48F4-9126-9715B34DD59C}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{8A90567F-4AE3-42FE-B5AE-89F912CCC731}" = lport=445 | protocol=6 | dir=in | app=system | "{8DD54E4E-767F-47B8-A79A-AA0C8EBD83C1}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{905A52E1-2634-4A7B-9A83-8119D3B2B28B}" = rport=138 | protocol=17 | dir=out | app=system | "{9975C84E-BCB3-4EC0-B2EF-AD4E3A6AE4AA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{9B867489-881B-433B-95DA-1B94D2E11C36}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{A10545C0-5E04-4098-84C2-3677BDD2D91B}" = lport=137 | protocol=17 | dir=in | app=system | "{D1C5570F-FFAD-41BB-918F-32153DCE5FDA}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{D3B68AC1-F456-46C6-91CA-328C53962859}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{01E5080F-98CB-430A-A700-4866A7116DB1}" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | "{13DD5DD0-242D-4BD0-AD59-EB167D755AB0}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1249422293\ee\aolsoftware.exe | "{3ABB71A2-B77E-4862-BD45-6CBDF152890E}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | "{3B4D169D-816A-4853-9AEA-E87082F3E7F6}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{3D253078-0B37-493F-B867-E84686DDB605}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{4FD33549-8904-4FEB-B1AC-0E898D60945D}" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | "{57CAB3DC-7D38-480F-8185-99F6D1BAC92B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{5E0AAAA4-47E7-4B69-97CE-ECEB650BB37E}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | "{614C1272-D968-4E00-9A09-1ADA4EDCD6E8}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{6577F43D-5FAF-498F-9B1B-6E103D88CBD4}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | "{6A5FF6A2-3CB1-4508-8407-1BD472886E93}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{6EE9B36D-A153-411F-A127-454CA12D5EB1}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | "{946B46CB-D380-4AD6-BA51-8AB8E5286164}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | "{95620E1D-8F8E-40B7-B156-0324ECBC5C16}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | "{97D38C72-E4C0-4CE3-A241-676749934343}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{AAC9DA1C-CDC9-4444-83A0-30A736C2A00D}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | "{B6368EF1-F57A-412F-B0CB-70951CBF0685}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | "{BFBA3987-05FD-4532-8978-5C2160C4F028}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | "{C58721FE-FB8D-486D-AB3A-C835BA267A93}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | "{C638E927-AD9D-4C8B-8407-DD3384F539F9}" = dir=in | app=c:\program files\itunes\itunes.exe | "{CDCCC0EA-DF3A-4935-8610-D870BE4F20F0}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | "{D243E28D-554C-41DF-8F51-950416EDBF04}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | "{DB2C8F83-719E-4246-B239-E199E638F5B6}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{DB88F476-CEC9-4DCC-9ADA-F721C0E8A02D}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | "{E50FBE1F-CEFA-4DF3-A152-63A4EA064B56}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1249422293\ee\aolsoftware.exe | "{ECC293F9-732B-4CBF-80E3-D6599AC591AE}" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | "{F42E7EF1-35A8-4EEE-9760-64EAC5232840}" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00010407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional "{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status "{02CA24DD-C8B0-4280-BE53-7862869C2EB1}" = Realtek WiFi Protected Setup Library "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu "{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan "{0D5D0BEE-FBA9-4928-A50D-6CDFAB827755}" = TOSHIBA ConfigFree "{0D8E81A5-B61C-4360-910C-A738FD1B220A}" = Toshiba TEMPRO "{0FB630AB-7BD8-40AE-B223-60397D57C3C9}" = Realtek WLAN Driver "{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist "{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}" = Primo "{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan "{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg "{1C971EE3-B4C4-4367-9676-57549919C6CE}" = TOSHIBA Benutzerhandbücher "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information "{22DD005D-0EF1-4E3E-92F8-49D89E31479A}" = 1400 "{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer "{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 29 "{2883F6F5-0509-43F3-868C-D50330DD9DD3}" = TOSHIBA Hardware Setup "{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support "{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor "{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant "{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba "{39CB30DB-27F8-4dd4-A294-CB4AE3B584FD}" = Copy "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2 "{46C4591A-C135-482B-B653-06D67A94DA8B}_is1" = Videograbber5.3 "{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4B1E87C3-00DE-4898-8E39-E390AAEF2391}" = TOSHIBA Supervisor Password "{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth "{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator "{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder "{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{6A3C2391-BCE2-4D28-A336-73B953B4502F}" = 1400Trb "{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER "{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder "{6FBE200D-1F00-40B7-BF48-FEB265AADE94}" = 1400_Help "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour "{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime "{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support "{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update "{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver "{895722FE-25FE-4854-95AC-B0C42F9DBEDA}" = REALTEK RTL8187B Wireless LAN Driver "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager "{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel "{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195 "{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer "{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp "{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer "{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder "{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch "{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator "{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm "{C656142F-EFE1-44CD-BFAD-6CBC6DCB9860}" = Vodafone Mobile Connect Lite "{C716522C-3731-4667-8579-40B098294500}" = Toolbox "{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition "{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B "{CE2121C6-C94D-4A73-8EA4-6943F33EE335}" = Music Transfer "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component "{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility "{DABF43D9-1104-4764-927B-5BED1274A3B0}" = Runtime "{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader "{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport "{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software "{E3723A04-A894-4036-A78E-282E18F43C0A}_is1" = Tinypic 3.14 "{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher "{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext "{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential "{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply "{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax "{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari "{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0 "{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes "{FDB5E0F3-86EA-4379-8A2F-1BC2436543E9}" = iCloud "{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "AOL Toolbar 4.0" = "Avira AntiVir Desktop" = Avira Internet Security 2012 "Browser Defender_is1" = Browser Defender 3.0 "DivX Setup.divx.com" = DivX-Setup "Freemake Video Converter_is1" = Freemake Video Converter Version 3.0.1 "GOM Player" = GOM Player "Google Chrome" = Google Chrome "Google Updater" = Google Updater "HDMI" = Intel(R) Graphics Media Accelerator Driver "HijackThis" = HijackThis 2.0.2 "HP Imaging Device Functions" = HP Imaging Device Functions 8.0 "HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0 "HPExtendedCapabilities" = HP Customer Participation Program 8.0 "HPOCR" = HP OCR Software 8.0 "InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center "InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder "InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition "InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher "InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de) "o2DE" = Mobile Connection Manager "Picasa 3" = Picasa 3 "RealPlayer 12.0" = RealPlayer "softonic-de3 Toolbar" = softonic-de3 Toolbar "SumatraPDF" = SumatraPDF "SynTPDeinstKey" = Synaptics Pointing Device Driver "TOSHIBA Software Modem" = TOSHIBA Software Modem "TUGZip_is1" = TUGZip 3.5 "ViewpointMediaPlayer" = Viewpoint Media Player "VLC media player" = VLC media player 1.1.10 "ZTE USB Driver" = ZTE USB Driver ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Facebook Plug-In" = Facebook Plug-In ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 23.02.2012 03:50:12 | Computer Name = stefans-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledEvent 4805 Error - 23.02.2012 03:50:12 | Computer Name = stefans-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledSPRetry 4805 Error - 24.02.2012 13:56:56 | Computer Name = stefans-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: Continuously busy for more than a second Error - 24.02.2012 13:56:57 | Computer Name = stefans-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledEvent 766121 Error - 24.02.2012 13:56:57 | Computer Name = stefans-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledSPRetry 766121 Error - 24.02.2012 22:23:49 | Computer Name = stefans-PC | Source = WinMgmt | ID = 10 Description = Error - 25.02.2012 06:12:17 | Computer Name = stefans-PC | Source = WinMgmt | ID = 10 Description = Error - 27.02.2012 09:18:22 | Computer Name = stefans-PC | Source = WinMgmt | ID = 10 Description = Error - 27.02.2012 13:03:50 | Computer Name = stefans-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung avcenter.exe, Version 12.1.0.18, Zeitstempel 0x4e7bab7a, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5, Ausnahmecode 0xc0150014, Fehleroffset 0x00075e2f, Prozess-ID 0xc6c, Anwendungsstartzeit 01ccf566b34bd18a. Error - 27.02.2012 14:03:31 | Computer Name = stefans-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung avcenter.exe, Version 12.1.0.18, Zeitstempel 0x4e7bab7a, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5, Ausnahmecode 0xc0150014, Fehleroffset 0x00075e2f, Prozess-ID 0x16fc, Anwendungsstartzeit 01ccf57500561b3a. [ System Events ] Error - 06.03.2012 07:16:44 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7022 Description = Error - 06.03.2012 07:18:00 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7034 Description = Error - 07.03.2012 07:10:24 | Computer Name = stefans-PC | Source = Dhcp | ID = 1002 Description = Die IP-Adresslease 192.168.1.31 für die Netzwerkkarte mit der Netzwerkadresse 001A7342FFF6 wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet). Error - 07.03.2012 08:44:31 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7022 Description = Error - 07.03.2012 08:46:01 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7034 Description = Error - 07.03.2012 08:50:15 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7022 Description = Error - 07.03.2012 08:51:25 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7034 Description = Error - 07.03.2012 23:51:59 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7011 Description = Error - 08.03.2012 02:37:31 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7022 Description = Error - 08.03.2012 02:38:55 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7034 Description = < End of report > OTL logfile created on: 08.03.2012 07:56:21 - Run 4 OTL by OldTimer - Version 3.2.35.1 Folder = C:\Users\stefan\Desktop Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,87 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 42,22% Memory free 3,98 Gb Paging File | 2,57 Gb Available in Paging File | 64,57% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 116,21 Gb Total Space | 30,20 Gb Free Space | 25,98% Space Free | Partition Type: NTFS Drive E: | 115,21 Gb Total Space | 55,74 Gb Free Space | 48,39% Space Free | Partition Type: NTFS Computer Name: STEFANS-PC | User Name: stefan | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days ========== Processes (SafeList) ========== PRC - File not found PRC - C:\Users\stefan\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (Freemake) PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.) PRC - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)A PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.) PRC - C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.) PRC - C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe (Telefónica I+D) PRC - C:\Program Files\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH) PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba) PRC - C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe () PRC - C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony) PRC - C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION) PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION) PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION) PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation) PRC - C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe (TOSHIBA) PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems) ========== Modules (No Company Name) ========== MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\6310a2050033b0b567428ca55bda4a1b\Microsoft.VisualBasic.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\d0cf808e33a5123b33010b933d3b1597\System.ServiceProcess.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\65450889f3742aada2a6c0cf8e6173e3\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\137696d0416b65dbc1561152971488b4\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\3951e0a359c004cd6ba268ff78ac62aa\PresentationCore.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1e258a951222c818540b33880ca45f2e\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll () MOD - C:\Program Files\Mozilla Firefox\mozjs.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll () MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll () MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe () MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe () MOD - C:\Program Files\TUGZip\Plugins\TzArchive10.tgp () MOD - C:\Windows\System32\ztvunrar36.dll () MOD - C:\Program Files\TUGZip\TzShell.dll () MOD - C:\Program Files\TUGZip\Plugins\TzImage10.tgp () ========== Win32 Services (SafeList) ========== SRV - (Freemake Improver) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (Freemake) SRV - (McAfee SiteAdvisor Service) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.) SRV - (AntiVirMailService) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) SRV - (AntiVirFirewallService) -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (Browser Defender Update Service) -- C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.) SRV - (TGCM_ImportWiFiSvc) -- C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe (Telefónica I+D) SRV - (TemproMonitoringService) Notebook Performance Tuning Service (TEMPRO) -- C:\Program Files\Toshiba TEMPRO\TemproSvc.exe (Toshiba Europe GmbH) SRV - (SmartFaceVWatchSrv) -- C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba) SRV - (TNaviSrv) -- C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation) SRV - (VMCService) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone) SRV - (ConfigFree Service) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION) SRV - (TOSHIBA SMART Log Service) -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation) SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation) SRV - (TosCoSrv) -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation) SRV - (TODDSrv) -- C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems) ========== Driver Services (SafeList) ========== DRV - (NwlnkFwd) -- File not found DRV - (NwlnkFlt) -- File not found DRV - (IpInIp) -- File not found DRV - (esgiguard) -- File not found DRV - (catchme) -- File not found DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH) DRV - (avfwot) -- C:\Windows\System32\drivers\avfwot.sys (Avira GmbH) DRV - (avfwim) -- C:\Windows\System32\drivers\avfwim.sys (Avira GmbH) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (ZTEusbser6k) -- C:\Windows\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated) DRV - (ZTEusbnmea) -- C:\Windows\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated) DRV - (ZTEusbmdm6k) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated) DRV - (massfilter) -- C:\Windows\System32\drivers\massfilter.sys (ZTE Incorporated) DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (massfilter_hs) -- C:\Windows\System32\drivers\massfilter_hs.sys (ZTE Incorporated) DRV - (RTL8187B) -- C:\Windows\System32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation ) DRV - (tos_sps32) -- C:\Windows\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation ) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (UVCFTR) -- C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.) DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation) DRV - (RtlProt) -- C:\Windows\System32\drivers\RtlProt.sys (Windows (R) Codename Longhorn DDK provider) DRV - (wanatw) WAN Miniport (ATW) -- C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.) DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems) DRV - (FwLnk) -- C:\Windows\System32\drivers\FwLnk.sys (TOSHIBA Corporation) DRV - (tdcmdpst) -- C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.) DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{9A284460-6B83-4FC5-9B1D-B3C625C48887}: "URL" = hxxp://www.google.com/search?source=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEA; IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA; IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) IE - HKCU\..\SearchScopes,DefaultScope = {BA778FA4-2DDB-4814-9662-D91BA0D516E1} IE - HKCU\..\SearchScopes\{9A284460-6B83-4FC5-9B1D-B3C625C48887}: "URL" = hxxp://www.google.com/search?source=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7GPEA_de IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\..\SearchScopes\{BA778FA4-2DDB-4814-9662-D91BA0D516E1}: "URL" = hxxp://start.funmoods.com/results.php?f=4&a=make&q={searchTerms} IE - HKCU\..\SearchScopes\{C64A81FB-0C89-4787-BA3B-CF8909B4FAF7}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?fr=mcafee&p={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://start.funmoods.com" FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.2 FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.11.2 FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4.2b FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.4 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.1.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.7.1.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.732: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.732: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.732: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll () FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\stefan\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( ) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.04.30 23:40:37 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools Security\BDT\Firefox\ [2011.07.08 23:14:28 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012.02.05 07:42:05 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.11.14 22:58:43 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Program Files\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2012.02.02 17:23:38 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.17 17:52:41 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.07 19:35:48 | 000,000,000 | ---D | M] [2009.08.04 20:29:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\stefan\AppData\Roaming\mozilla\Extensions [2012.03.06 15:50:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions [2012.02.11 19:04:02 | 000,000,000 | ---D | M] ("Winamp Toolbar") -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2012.02.14 11:59:13 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2011.04.30 23:40:44 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.06.08 10:29:10 | 000,000,927 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\conduit.xml [2012.02.02 17:24:05 | 000,001,798 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\funmoods.xml [2010.09.16 14:21:14 | 000,002,689 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\search-defender.xml [2009.12.14 05:19:41 | 000,001,246 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\winamp-search.xml [2012.01.25 18:17:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2012.02.02 17:23:38 | 000,000,000 | ---D | M] (Freemake Video Converter Plugin) -- C:\PROGRAM FILES\FREEMAKE\FREEMAKE VIDEO CONVERTER\BROWSERPLUGIN\FIREFOX () (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\{EF4E370E-D9F0-4E00-B93E-A4F274CFDD5A}.XPI () (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\CANITBECHEAPER@TRAFFICBROKER.CO.UK.XPI () (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\ISREADITLATER@IDEASHOWER.COM.XPI [2012.02.17 17:52:40 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011.10.19 19:03:23 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.19 19:03:23 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.10.19 19:03:23 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.10.19 19:03:23 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.09.27 19:40:39 | 000,002,027 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml [2011.10.19 19:03:23 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.19 19:03:23 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Search (Enabled) CHR - default_search_provider: search_url = hxxp://start.funmoods.com/results.php?f=4&a=make&q={searchTerms} CHR - default_search_provider: suggest_url = CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll CHR - plugin: Microsoft Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\pdf.dll CHR - plugin: Chrome NaCl (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\ppGoogleNaClPluginChrome.dll CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\gears.dll CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.53\npGoogleUpdate3.dll CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa2\npPicasa3.dll CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Facebook Plugin (Enabled) = C:\Users\stefan\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: YouTube = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\ CHR - Extension: YouTube = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\ CHR - Extension: Google-Suche = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\ CHR - Extension: SiteAdvisor = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.122.1_0\ CHR - Extension: Freemake Video Converter = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_0\ CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.1_0\ CHR - Extension: Mehr Leistung und Videoformate fr dein HTML5 video = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\ CHR - Extension: Google Mail = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\ CHR - Extension: Google Mail = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony) O4 - HKLM..\Run: [cfFncEnabler.exe] cfFncEnabler.exe File not found O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found O4 - HKLM..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA) O4 - HKLM..\Run: [Toshiba TEMPRO] C:\Program Files\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation) O4 - HKCU..\Run: [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.) O4 - HKCU..\Run: [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4 File not found O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 110.164.252.222 110.164.252.223 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{162DD6C4-76E2-4D27-BAE8-43FB03178D96}: DhcpNameServer = 110.164.252.222 110.164.252.223 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2D479C68-92B0-4157-B684-8C5176B9A625}: DhcpNameServer = 192.168.8.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2FC486A3-58D8-41E1-AD9B-EBBD52601BB9}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9432ACA8-31E7-41F3-A91F-B334FC66FF5C}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\msdaipp\oledb - No CLSID value found O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\stefan\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\stefan\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 60 Days ========== [2012.03.08 07:52:05 | 000,584,704 | ---- | C] (OldTimer Tools) -- C:\Users\stefan\Desktop\OTL.exe [2012.03.08 07:45:55 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012.03.07 17:48:28 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\VIDEO_TS [2012.03.07 15:24:10 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\iTunes Freemake redsn0w [2012.03.07 15:11:16 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\salt [2012.03.07 15:10:57 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\outländer [2012.03.07 15:10:31 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\knight and day [2012.03.07 12:31:39 | 000,000,000 | ---D | C] -- C:\sh4ldr [2012.03.07 12:31:39 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group [2012.02.18 15:26:57 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\spongebob [2012.02.18 03:06:55 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.02.18 03:06:52 | 001,798,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.02.18 03:06:51 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.02.18 03:06:51 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.02.18 03:06:51 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.02.18 03:06:46 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.02.16 07:32:53 | 002,044,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012.02.15 17:33:34 | 000,000,000 | ---D | C] -- C:\Users\stefan\AppData\Roaming\redsn0w [2012.02.06 15:38:56 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\Techno - House - Trance - Elektro mp4 & wma [2012.02.02 17:23:41 | 000,000,000 | ---D | C] -- C:\Users\stefan\Documents\Documents\Freemake [2012.02.02 17:23:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Freemake [2012.02.02 17:23:09 | 000,000,000 | ---D | C] -- C:\Users\stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake [2012.02.02 17:23:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake [2012.02.02 17:23:08 | 000,000,000 | ---D | C] -- C:\Program Files\Freemake [2012.02.02 16:26:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2012.02.02 16:25:18 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2012.02.02 16:25:14 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2012.01.26 11:18:56 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\i- cloud [2012.01.14 12:44:49 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciseq.dll [2012.01.14 12:44:36 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll [2012.01.14 12:44:32 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll [2012.01.14 12:44:18 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll [2012.01.14 12:44:18 | 000,497,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 60 Days ========== [2012.03.08 07:52:20 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\stefan\Desktop\OTL.exe [2012.03.08 07:52:09 | 000,073,728 | ---- | M] () -- C:\Users\stefan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.03.08 07:49:04 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.03.08 07:43:25 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.03.08 07:43:24 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.03.08 07:43:24 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.03.08 07:43:24 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.03.08 07:37:39 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.03.08 07:36:06 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.03.08 07:36:06 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.03.08 07:35:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.03.07 15:27:37 | 000,001,194 | ---- | M] () -- C:\Users\stefan\Desktop\stefan - Verknüpfung.lnk [2012.03.07 13:46:05 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2012.03.07 12:10:27 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2012.02.24 18:58:09 | 000,000,680 | ---- | M] () -- C:\Users\stefan\AppData\Local\d3d9caps.dat [2012.02.23 09:18:36 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2012.02.18 03:31:26 | 000,371,368 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.02.17 03:01:33 | 000,137,416 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2012.02.14 13:59:07 | 000,002,565 | ---- | M] () -- C:\Users\stefan\Desktop\Microsoft Word.lnk [2012.02.14 12:23:53 | 002,988,767 | ---- | M] () -- C:\Users\stefan\Muddy2.mp3 [2012.02.14 12:19:17 | 003,367,403 | ---- | M] () -- C:\Users\stefan\Muddy1.mp3 [2012.02.02 17:24:29 | 000,000,050 | ---- | M] () -- C:\user.js [2012.01.17 18:30:43 | 216,364,819 | ---- | M] () -- C:\Windows\MEMORY.DMP [2012.01.12 20:52:56 | 002,044,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012.01.08 21:03:37 | 000,000,379 | ---- | M] () -- C:\Users\stefan\Desktop\Fotoos.lnk [2012.01.08 08:20:04 | 000,000,406 | ---- | M] () -- C:\Users\stefan\Desktop\i 1raffetti - Verknüpfung.lnk [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.02.14 12:23:52 | 002,988,767 | ---- | C] () -- C:\Users\stefan\Muddy2.mp3 [2012.02.14 12:19:13 | 003,367,403 | ---- | C] () -- C:\Users\stefan\Muddy1.mp3 [2012.02.02 18:37:10 | 000,001,194 | ---- | C] () -- C:\Users\stefan\Desktop\stefan - Verknüpfung.lnk [2012.02.02 17:24:29 | 000,000,050 | ---- | C] () -- C:\user.js [2012.01.16 20:04:18 | 216,364,819 | ---- | C] () -- C:\Windows\MEMORY.DMP [2012.01.08 21:03:44 | 000,000,379 | ---- | C] () -- C:\Users\stefan\Desktop\Fotoos.lnk [2012.01.08 08:20:11 | 000,000,406 | ---- | C] () -- C:\Users\stefan\Desktop\i 1raffetti - Verknüpfung.lnk [2011.07.08 23:14:21 | 000,767,952 | ---- | C] () -- C:\Windows\BDTSupport.dll [2011.06.26 21:29:43 | 000,000,002 | ---- | C] () -- C:\Windows\msoffice.ini [2011.05.08 00:51:39 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe [2011.05.08 00:51:39 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2011.05.08 00:51:39 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe [2011.05.08 00:51:39 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2011.05.08 00:51:39 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2010.11.01 12:26:47 | 000,000,680 | ---- | C] () -- C:\Users\stefan\AppData\Local\d3d9caps.dat ========== Alternate Data Streams ========== @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84 @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:DFC5A2B2 < End of report > |
Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen! Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden. Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code: hier steht das Log |
Hallo Arne, schön von Dir zu hören. Leider kriege ich die Protokolle von Malwarebytes und ESET nicht kopiert und eingefügt. Und das mit CODE- Tags schnall´ ich nicht. Drag & drop geht auch nicht. Schönen Gruß vonStefan |
Zitat:
Zitat:
CODE-Tags wurde übrigens extra verlinkt |
Hallo Arne, das ging vorhin nicht! Erst nach Neustart. Der Text hatte sich nicht markieren lassen, mir drag/ drop ging es auch nicht. Ich dachte schon, der Virus ist so schlau, daß er das verhindert. Bei Malwarebytes sind 24 Logdateien aus 2011 und 1 aus 2012. Soll ich diese öffnen, kopieren und posten? Hier das ESET- Protokoll. Code: C:\Program Files\Videograbber\eBay_shortcuts_1024_Videograbber.exe Win32/Adware.ADON application |
Bitte in CODE-Tags! Das kann doch nicht so schwierig sein! CODE in eckigen Klammern posten, dann das Log und abgeschlossen wird es mit /CODE in eckigen Klammern!! Die 24-Log von MBAM alle zusammen in EINE ZIP packen und hier anhängen. Falls zu groß da abladen => File-Upload.net - Ihr kostenloser File Hoster! |
<CODE> ein kurzer hinweis: nachlesen bei wiki hätts auch getan. ich dachte, in tag posten heißt, auf die site "tag" posten. ich denke manchmal kompliziert. so soll das aussehen, oder? <CODE/> |
ECKIGE und keine SPITZEN Klammer! Das sind eckige Klammer => [ ] Das sind spotze Klammern => < > Zitat:
|
Hallo Arne, ich bekomme den Ordner nicht hochgeladen. Auch nicht mit dem upload- tool. Ich hoffe, ich darf das hier posten, soviel ist´s nicht. In der Quarantäne habe ich 6 Eintragungen. copy/ paste geht nicht. Dann schreibe ich sie am Besten ab? <CODE> Malwarebytes' Anti-Malware 1.50.1.1100 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 6502 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 04.05.2011 01:07:57 mbam-log-2011-05-04 (01-07-57).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 179130 Laufzeit: 4 Minute(n), 18 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 1 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: c:\program files\free registry cleaner for vista (Rogue.FreeRegistryCleanerForVista) -> Quarantined and deleted successfully. Infizierte Dateien: (Keine bösartigen Objekte gefunden) Malwarebytes' Anti-Malware 1.50.1.1100 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 6502 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 06.05.2011 08:31:11 mbam-log-2011-05-06 (08-31-11).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|) Durchsuchte Objekte: 341072 Laufzeit: 1 Stunde(n), 18 Minute(n), 21 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\stefan\AppData\Roaming\desktopicon\ebayshortcuts.exe (Adware.ADON) -> Quarantined and deleted successfully. Malwarebytes' Anti-Malware 1.50.1.1100 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 6502 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 08.05.2011 08:42:19 mbam-log-2011-05-08 (08-42-19).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 0 Laufzeit: 30 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Malwarebytes' Anti-Malware 1.50.1.1100 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 6502 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 10.05.2011 15:45:46 mbam-log-2011-05-10 (15-45-46).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 179697 Laufzeit: 4 Minute(n), 47 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Malwarebytes' Anti-Malware 1.50.1.1100 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 6548 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 11.05.2011 00:21:22 mbam-log-2011-05-11 (00-21-22).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|) Durchsuchte Objekte: 312882 Laufzeit: 1 Stunde(n), 0 Minute(n), 48 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 53955, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 53973, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 53997, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54003, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54009, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54011, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54014, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54015, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54018, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54021, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54029, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54036, Process: avwebgrd.exe) 01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54039, Process: avwebgrd.exe) 02:22:58 stefan MESSAGE Scheduled update executed successfully 02:23:00 stefan MESSAGE IP Protection stopped 02:23:09 stefan MESSAGE Database updated successfully 02:23:11 stefan MESSAGE IP Protection started successfully 21:36:05 stefan MESSAGE Protection started successfully 21:36:11 stefan MESSAGE IP Protection started successfully Malwarebytes' Anti-Malware 1.51.0.1200 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 6940 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 25.06.2011 01:04:48 mbam-log-2011-06-25 (01-04-48).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|) Durchsuchte Objekte: 333464 Laufzeit: 1 Stunde(n), 35 Minute(n), 47 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Toshiba\Webshops\addamazontoolbarbutton.exe (Rogue.SystemSmartSecurity) -> Quarantined and deleted successfully. Malwarebytes' Anti-Malware 1.51.0.1200 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 7006 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 04.07.2011 03:06:52 mbam-log-2011-07-04 (03-06-52).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|) Durchsuchte Objekte: 332761 Laufzeit: 1 Stunde(n), 34 Minute(n), 25 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Malwarebytes' Anti-Malware 1.51.0.1200 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 7014 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 06.07.2011 13:58:47 mbam-log-2011-07-06 (13-58-47).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|) Durchsuchte Objekte: 312010 Laufzeit: 1 Stunde(n), 12 Minute(n), 32 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Malwarebytes Anti-Malware 1.60.1.1000 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: v2012.03.08.05 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 stefan :: STEFANS-PC [Administrator] 08.03.2012 15:11:22 mbam-log-2012-03-08 (15-11-22).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 465051 Laufzeit: 3 Stunde(n), 51 Minute(n), 12 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 4 G:\Vista\Users\stefan\AppData\Roaming\Desktopicon\eBayShortcuts.exe (Adware.ADON) -> Erfolgreich gelöscht und in Quarantäne gestellt. G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Excel\Thinstall\Office 2003\10000001a00002i\OfficeLiveSignIn.exe (Trojan.IRCBot) -> Erfolgreich gelöscht und in Quarantäne gestellt. G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Excel\Thinstall\Office 2003\1000000b00002i\rundll32.exe (Trojan.IRCBot) -> Erfolgreich gelöscht und in Quarantäne gestellt. G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Excel\Thinstall\Office 2003\4000003900002i\MultiKill.exe (Trojan.IRCBot) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) 11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55110, Process: avwebgrd.exe) 11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55112, Process: avwebgrd.exe) 11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55114, Process: avwebgrd.exe) 11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55124, Process: avwebgrd.exe) 11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55133, Process: avwebgrd.exe) 11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55137, Process: avwebgrd.exe) 11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55140, Process: avwebgrd.exe) 11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55158, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55161, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55165, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55168, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55173, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55174, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55176, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55185, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55186, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55188, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55191, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55195, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55196, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55198, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55200, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55204, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55205, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55206, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55209, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55210, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55213, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55214, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55217, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55218, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55221, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55222, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55228, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55230, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55237, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55243, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55244, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55249, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55250, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55252, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55254, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55256, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55268, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55269, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55270, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55273, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55274, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55276, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55279, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55280, Process: avwebgrd.exe) 11:46:17 stefan IP-BLOCK 94.198.240.136 (Type: outgoing, Port: 55282, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55497, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55498, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55499, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55501, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55504, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55505, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55508, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55509, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55518, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55521, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.179.67 (Type: outgoing, Port: 55529, Process: avwebgrd.exe) 11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55533, Process: avwebgrd.exe) 11:50:41 stefan IP-BLOCK 94.198.240.235 (Type: outgoing, Port: 55541, Process: avwebgrd.exe) 11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55545, Process: avwebgrd.exe) 11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55549, Process: avwebgrd.exe) 11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55550, Process: avwebgrd.exe) 11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55551, Process: avwebgrd.exe) 11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55554, Process: avwebgrd.exe) 11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55555, Process: avwebgrd.exe) 11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55566, Process: avwebgrd.exe) 11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55568, Process: avwebgrd.exe) 11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55573, Process: avwebgrd.exe) 11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55578, Process: avwebgrd.exe) 11:50:58 stefan IP-BLOCK 78.108.179.67 (Type: outgoing, Port: 55583, Process: avwebgrd.exe) 20:10:58 stefan MESSAGE Protection started successfully 20:11:05 stefan MESSAGE IP Protection started successfully 10:06:09 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 50827, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51161, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51163, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51175, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51180, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51182, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51196, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51200, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51213, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51216, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51220, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51221, Process: avwebgrd.exe) 15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51235, Process: avwebgrd.exe) 23:32:44 stefan MESSAGE Protection started successfully 23:32:51 stefan MESSAGE IP Protection started successfully 23:29:17 stefan MESSAGE Protection started successfully 23:29:23 stefan MESSAGE IP Protection started successfully 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49698, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49700, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49714, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49720, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49721, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49724, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49739, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49740, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49745, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49748, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49750, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49758, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.179.67 (Type: outgoing, Port: 49765, Process: avwebgrd.exe) 01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49767, Process: avwebgrd.exe) 01:27:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49775, Process: avwebgrd.exe) 01:27:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49777, Process: avwebgrd.exe) 01:27:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49779, Process: avwebgrd.exe) 01:28:09 stefan IP-BLOCK 78.108.182.90 (Type: outgoing, Port: 49781, Process: avwebgrd.exe) 01:52:53 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 51767, Process: avwebgrd.exe) 02:22:57 stefan MESSAGE Scheduled update executed successfully 02:22:59 stefan MESSAGE IP Protection stopped 02:23:08 stefan MESSAGE Database updated successfully 02:23:11 stefan MESSAGE IP Protection started successfully 02:22:58 stefan MESSAGE Scheduled update executed successfully 02:23:01 stefan MESSAGE IP Protection stopped 02:23:12 stefan MESSAGE Database updated successfully 02:23:15 stefan MESSAGE IP Protection started successfully 00:55:50 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57083, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57084, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57086, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57091, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57094, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57096, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57100, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57101, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57104, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57112, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57113, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57114, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57116, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57117, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57118, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57119, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57124, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57125, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57128, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57130, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57136, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57148, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57149, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57154, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57159, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57161, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57163, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57167, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57170, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57172, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57190, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57192, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57193, Process: avwebgrd.exe) 00:55:51 stefan IP-BLOCK 78.108.179.67 (Type: outgoing, Port: 57197, Process: avwebgrd.exe) 00:55:59 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57229, Process: avwebgrd.exe) 00:55:59 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57240, Process: avwebgrd.exe) 00:55:59 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57244, Process: avwebgrd.exe) 00:55:59 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57246, Process: avwebgrd.exe) 00:55:59 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57251, Process: avwebgrd.exe) 00:55:59 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57253, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57329, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57330, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57337, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57338, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57340, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57341, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57343, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57344, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57347, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57349, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57350, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57354, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57355, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57356, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57357, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57359, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57367, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57369, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57375, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57376, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57380, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57382, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57383, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57389, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57390, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57391, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57392, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57396, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57398, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57399, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57400, Process: avwebgrd.exe) 00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57408, Process: avwebgrd.exe) 00:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57419, Process: avwebgrd.exe) 00:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57421, Process: avwebgrd.exe) 00:57:36 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57423, Process: avwebgrd.exe) 01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57896, Process: avwebgrd.exe) 01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57897, Process: avwebgrd.exe) 01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57899, Process: avwebgrd.exe) 01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57900, Process: avwebgrd.exe) 01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57902, Process: avwebgrd.exe) 01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57904, Process: avwebgrd.exe) 01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57906, Process: avwebgrd.exe) 01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57912, Process: avwebgrd.exe) 01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57914, Process: avwebgrd.exe) 01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57916, Process: avwebgrd.exe) 01:09:30 stefan IP-BLOCK 78.108.179.67 (Type: outgoing, Port: 57927, Process: avwebgrd.exe) 01:23:32 stefan IP-BLOCK 92.241.168.67 (Type: outgoing, Port: 58953, Process: avwebgrd.exe) 02:23:00 stefan MESSAGE Scheduled update executed successfully 02:23:01 stefan MESSAGE IP Protection stopped 02:23:19 stefan MESSAGE Database updated successfully 02:23:23 stefan MESSAGE IP Protection started successfully 22:23:55 stefan MESSAGE Protection started successfully 22:24:02 stefan MESSAGE IP Protection started successfully 22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49538, Process: avwebgrd.exe) 22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49550, Process: avwebgrd.exe) 22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49551, Process: avwebgrd.exe) 22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49558, Process: avwebgrd.exe) 22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49565, Process: avwebgrd.exe) 22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49566, Process: avwebgrd.exe) 22:37:55 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49583, Process: avwebgrd.exe) 22:38:04 stefan IP-BLOCK 94.198.240.62 (Type: outgoing, Port: 49585, Process: avwebgrd.exe) 02:22:58 stefan MESSAGE Scheduled update executed successfully 02:23:04 stefan MESSAGE IP Protection stopped 02:23:27 stefan MESSAGE Database updated successfully 02:23:31 stefan MESSAGE IP Protection started successfully 16:03:22 stefan IP-BLOCK 208.91.207.65 (Type: outgoing, Port: 51206, Process: avwebgrd.exe) 12:44:20 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 54591, Process: avwebgrd.exe) 13:12:48 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 56044, Process: avwebgrd.exe) 20:44:30 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 62636, Process: avwebgrd.exe) 20:51:51 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 63216, Process: avwebgrd.exe) 20:52:16 stefan IP-BLOCK 208.91.207.65 (Type: outgoing, Port: 63328, Process: avwebgrd.exe) 20:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63872, Process: avwebgrd.exe) 20:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63874, Process: avwebgrd.exe) 20:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63880, Process: avwebgrd.exe) 20:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63891, Process: avwebgrd.exe) 20:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63899, Process: avwebgrd.exe) 20:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63900, Process: avwebgrd.exe) 20:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63902, Process: avwebgrd.exe) 21:02:01 stefan IP-BLOCK 208.91.207.65 (Type: outgoing, Port: 64244, Process: avwebgrd.exe) 21:04:01 stefan IP-BLOCK 78.108.181.20 (Type: outgoing, Port: 64317, Process: avwebgrd.exe) 21:04:01 stefan IP-BLOCK 78.108.181.20 (Type: outgoing, Port: 64319, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52023, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52040, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52041, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52042, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52056, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52057, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52061, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52062, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52063, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52073, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52076, Process: avwebgrd.exe) 12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52092, Process: avwebgrd.exe) 12:58:11 stefan IP-BLOCK 94.198.240.202 (Type: outgoing, Port: 52097, Process: avwebgrd.exe) 12:58:19 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52099, Process: avwebgrd.exe) 13:19:20 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53023, Process: avwebgrd.exe) 13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53056, Process: avwebgrd.exe) 13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53062, Process: avwebgrd.exe) 13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53075, Process: avwebgrd.exe) 13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53077, Process: avwebgrd.exe) 13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53097, Process: avwebgrd.exe) 13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53098, Process: avwebgrd.exe) 13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53099, Process: avwebgrd.exe) 13:54:05 stefan IP-BLOCK 208.91.207.65 (Type: outgoing, Port: 55249, Process: avwebgrd.exe) 00:23:41 stefan MESSAGE IP Protection stopped 21:19:16 stefan MESSAGE Protection started successfully 21:19:30 stefan MESSAGE IP Protection started successfully 21:19:34 stefan MESSAGE IP Protection stopped 21:46:47 stefan MESSAGE Protection started successfully 21:46:54 stefan MESSAGE IP Protection started successfully 21:46:57 stefan MESSAGE IP Protection stopped <CODE/> Hoffentlich ist das ok so. Fürchte fast, daß nicht. Hätte nach jedem Absatz ein </> Endezeichen gehört? Grüße vonStefan |
Hi Arna (hatten wir vor 1 Jahr schonmal :) Hier die abgetippte Liste der Quarantäne vom Malwarebytes. G ist die externe Festplatte. Jetzt ist mir die CODE/ Tag Bedeutung auch klar geworden. Legt Anfang und Ende fest. Hätt´ ich auch selber.. bin ich aber nicht. Bin über 55, das merkt man bei sowas. Gruß vonStefan <CODE> Adware.ADON 08.03.2012, 14:14 File G:\Vista\User\stefan\AppData\Roaming\Desktopicon\eB... Trojan.IRCBot 08.03.2012, 14:11 File G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Exce... Trojan.IRCBot 08.03.2012, 14:11 File G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Exce... Trojan.IRCBot 08.03.2012, 14:11 File G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Exce... Rogue.SystemS... File c:\Toshiba\Webshops\addamazontoolbarbutton.exe Aadware.ADON File c:\User\stefan\AppData\Roaming\desktopicon\ebayshor... <CODE/> |
Habe das mit den eckigen Klammern zu spät gelesen. Tut mir echt leid. |
Zitat:
|
Urlaubsbekanntschaft. Dem hats ein Arbeitskollege auf die mobile Festplatte gespielt. Die habe ich auf G kopiert und immer wieder einen Film zum Anschauen auf meinen PC gezogen. Großartige Idee, wie mir scheint.. Gruß Stefan |
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code: hier steht das LogFalls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code: netsvcs
|
Hallo Arne, ich hatte den Firefox offen. Soll ich nochmal? OTL Logfile: Code: OTL logfile created on: 10.03.2012 17:11:38 - Run 5[CustomScan mit OTL] Gruß vonStefan |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 00:23 Uhr. |
Copyright ©2000-2025, Trojaner-Board
