Fehlermeldung"You have a secruity problem"

  • geschlossen

  • bomber09
  • 1679 Aufrufe 22 Antworten

Diese Seite verwendet Cookies. Durch die Nutzung unserer Seite erklären Sie sich damit einverstanden, dass wir Cookies setzen. Weitere Informationen

  • Fehlermeldung"You have a secruity problem"

    Icg habe seit gestern Abend dieses Problem !

    Unten rechts in der Leiste gibt es jetzt ein neues Symbol was fast so aussieht wie das von Windows!! und es kommen alls paar sec "You have a Secruity Problem"

    Bitte um Hilfe bomber09
    [COLOR="Blue"]Meine UP´s Kinder Hörspiele[/color]

    Dieser Beitrag wurde bereits 1 mal editiert, zuletzt von bomber09 ()

  • hihi,
    ...mehr infos wären nicht schlecht!!was für proggis. im spez. kommen bei dir zum einsatz ??

    es handelt sich um ne meldung vom sicherheitscenter,irgendwas stimmt nicht mit deinem virenscanner,nehme ich mal stark an.




    lizens abgelaufen,?
    key blacklisted,?
    firewall checken.?usw. alles eben was mit der sicherheit zu tun hat!!

    geh mal ins menue vom virenscanner und check deine einstellungen,meistens bekommst du hier auch schon die antwort durch ein pop fenster selbst.

    greets jo :D
    .... wenn du abends in den himmel schaust,dann denke an ihn....

    User helfen Usern: die FSB-Tutoren!(Zum Chat) mit den Tutoren
    Haltet euch an den Ehrencodex hier im Board

  • Problem - Fehlermeldung => "You have a secruity problem"

    Hört sich ganz nach Spyware an. Lass mal Spybot - Search and Destroy (ist kostenlos) drüberlaufen !


    Gruss

    Wolf_57 - ;)

  • Wolf_57 schrieb:

    Hört sich ganz nach Spyware an. Lass mal Spybot - Search and Destroy (ist kostenlos) drüberlaufen !




    ...und auch mit hyjackthis nen logfile erstellen und auf der webseite überprüfen lassen,junge hast dir irgendwas eingefangen.

    da handelt es sich um einen veränderten regestryeintrag der geändert werden muss!!

    zudem mal die autostarteintäge kontrollieren!!

    ....und dann würd ich mal deinen virenscanner schärfer einstellen ,oder nen anderen besorgen der was taugt ,-sonst wäre es ja nicht erst soweit gekommen.

    greets jo :D
    .... wenn du abends in den himmel schaust,dann denke an ihn....

    User helfen Usern: die FSB-Tutoren!(Zum Chat) mit den Tutoren
    Haltet euch an den Ehrencodex hier im Board

  • eindeutig was eingefangen.... ich hoffe, du bist schlau genug, die angebotene SW (sie müssen unbedingt dies & das installieren) abzulehnen :D

    ===> verschoben zu den Kollegen der Krankenabteilung, nach Viren, Würmer & Trojaner



    gute Besserung, NeHe
    • Da, wo die Neurosen blüh'n, da möcht' ich Landschaftsgärtner sein! •
    Rechteübersicht * Forenregeln * F.A.Q. * Lexikon
    Suchfunktion * Chat * User helfen User
    Der Minister nimmt flüsternd den Bischof beim Arm: »Halt' du sie dumm, ich halt' sie arm!« (R. Mey)

  • 1.) Poste ein (neues) Hijackthis Logfile
    HijackThis Logfileauswertung

    2.) Deaktiviere die Systemwiederherstellung, im Verlauf der Infektion wurden auch Malwaredateien in Wiederherstellungspunkten mitgesichert - die sind alle nun unbrauchbar, da ein Zurücksetzen des System durch einen Wiederherstellungspunkt das System wahrscheinlich wieder infizieren würde.

    3.) Führe dieses MBR-Tool aus und poste die Ausgabe.Hier ist es Downzuloaden.
    rootkit in master boot record

    4.) Blacklight und Malwarebytes Antimalware ausführen und Logfiles posten
    F-Secure Blacklight > Rootkit Elimination Technology
    Malwarebytes.org

    5.) Führe Silentrunners nach dieser Anleitung aus und poste das Logfile
    Silentrunner


    Oder mach einfach Format C : ;)


    Wer sich solche Sachen auf dem PC einfängt,sollte sich wirklich mal Gedanken über seine Sicherheitstools machen.
    Der PC ist irgendwo ungenügend geschützt.Sonst würden solche Malware Programme sich nicht auf dem PC einnisten können.
    Also nach einer Neuinstallation des Systems,dieses richtig absichern.

    Virenscanner,Firewall,Popup Blocker,Adware Scanner,sind Pflicht in der Heutigen Zeit.
    Wer ohne Schutz ins Internet geht,ist selber Schuld.

    Greetz
    [COLOR="Blue"][SIZE="3"]Das Problem ist nicht der Computer,das Problem sitzt davor.[/SIZE][/color]

    Dieser Beitrag wurde bereits 1 mal editiert, zuletzt von Firecat ()

  • Sorry forget it.
    Ein komprimittiertes System kriegst Du nicht mehr sauber.

    1) Avira Free ist mE Müll
    2) Sollten Deine Daten nicht gesichtert sein, kannst von einer RettungsCD booten und versuchen die Daten extern zu sichern
    3)Dann wird neu aufgesetzt (incl. Neupartitionierung zuvor), voll geupdatet und ein ordentlicher Virenscann installiert
    4)Dann werden die zuvor gesicherten Daten mit dem Virenscan vollständig geprüft und gereinigt
    5)Was bei 4 übrig bleibt kannst Du zurück auf Dein System kopieren

    mfg
    Miraculix

  • HijackThis

    PHP-Quellcode

    1. Logfile of Trend Micro HijackThis v2.0.2
    2. Scan saved at 20:34:41, on 13.12.2008
    3. Platform: Windows Vista (WinNT 6.00.1904)
    4. MSIE: Internet Explorer v7.00 (7.00.6000.16386)
    5. Boot mode: Normal
    7. Running processes:
    8. C:\Windows\system32\taskeng.exe
    9. C:\Windows\system32\Dwm.exe
    10. C:\Windows\Explorer.EXE
    11. C:\Program Files\Windows Defender\MSASCui.exe
    12. C:\hp\support\hpsysdrv.exe
    13. C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
    14. C:\WINDOWS\RtHDVCpl.exe
    15. C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    16. C:\Program Files\Java\jre6\bin\jusched.exe
    17. C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
    18. C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
    19. C:\Program Files\Winamp\winampa.exe
    20. C:\WINDOWS\System32\rundll32.exe
    21. C:\WINDOWS\PixArt\PAC207\Monitor.exe
    22. C:\WINDOWS\System32\svhost.exe
    23. C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    24. C:\Program Files\Windows Sidebar\sidebar.exe
    25. C:\Program Files\Valve\Steam\Steam.exe
    26. C:\Program Files\Skype\Phone\Skype.exe
    27. C:\Windows\System32\mobsync.exe
    28. C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
    29. C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe
    30. C:\Program Files\ICQ6.5\ICQ.exe
    31. C:\Users\marcel\AppData\Local\Temp\yyy1542.exe
    32. C:\Program Files\Windows Sidebar\sidebar.exe
    33. C:\Program Files\Mozilla Firefox\firefox.exe
    34. C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
    35. C:\Program Files\Skype\Plugin Manager\skypePM.exe
    36. C:\Windows\system32\wuauclt.exe
    37. C:\Windows\system32\SearchFilterHost.exe
    38. C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    40. R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    41. R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1700389
    42. R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=desktop
    43. R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    44. R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    45. R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=desktop
    46. R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    47. R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    48. R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    49. R3 - URLSearchHook: (no name) - - (no file)
    50. R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    51. R3 - URLSearchHook: IsoBuster Toolbar - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll
    52. O1 - Hosts: ::1 localhost
    53. O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    54. O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    55. O2 - BHO: IsoBuster Toolbar - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll
    56. O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
    57. O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    58. O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
    59. O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    60. O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
    61. O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    62. O3 - Toolbar: IsoBuster Toolbar - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll
    63. O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    64. O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
    65. O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
    66. O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    67. O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    68. O4 - HKLM\..\Run: [WinSys2] C:\Windows\system32\startup.exe
    69. O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    70. O4 - HKLM\..\Run: [ProfilerU] C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
    71. O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
    72. O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    73. O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
    74. O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    75. O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    76. O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    77. O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
    78. O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    79. O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    80. O4 - HKLM\..\Run: [svhost] C:\WINDOWS\system32\svhost.exe
    81. O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    82. O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
    83. O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    84. O4 - HKCU\..\Run: [{11BF71CA-F5C0-AE98-09CB-11AAFA56CE30}] C:\Users\marcel\AppData\Roaming:winupd.exe
    85. O4 - HKCU\..\Run: [winupd.exe] C:\Users\marcel\AppData\Roaming:winupd.exe
    86. O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
    87. O4 - HKCU\..\Run: [Tunebite] C:\Program Files\RapidSolution\Tunebite\Tunebite.exe -tray
    88. O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    89. O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\Windows\TEMP\E_SA19B.tmp" /EF "HKCU"
    90. O4 - HKCU\..\Run: [{B1F199CC-C2D4-6D78-F49D-69FD404D74E2}] C:\Users\marcel\AppData\Roaming\svchost.exe
    91. O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    92. O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
    93. O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
    94. O4 - HKCU\..\Run: [Cognac] C:\Users\marcel\AppData\Local\Temp\~tmpb.exe
    95. O4 - HKCU\..\Run: [MSFox] C:\Users\marcel\AppData\Local\Temp\yyy1542.exe
    96. O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
    97. O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
    98. O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
    99. O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    100. O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    101. O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    102. O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    103. O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
    104. O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
    105. O13 - Gopher Prefix:
    106. O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    107. O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
    108. O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    109. O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    110. O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    111. O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
    112. O23 - Service: CyberGhost VPN Client (CGVPNCliSrvc) - mobile concepts GmbH - C:\Program Files\S.A.D\CyberGhost VPN\CGVPNCliService.exe
    113. O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    114. O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    115. O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    116. O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
    117. O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    118. O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    119. O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
    120. O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    121. O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
    122. O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software GmbH - C:\Windows\System32\TUProgSt.exe
    124. --
    125. End of file - 10301 bytes
    Alles anzeigen

    Mbr

    PHP-Quellcode

    1. Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net
    3. device: opened successfully
    4. user: error reading MBR
    5. kernel: error reading MBR


    Blacklight

    PHP-Quellcode

    1. Keine Funde


    Malware

    PHP-Quellcode

    1. Bin dabei


    Silentrunner

    Quellcode

    1. "Silent Runners.vbs", revision 59, http://www.silentrunners.org/
    2. Operating System: Windows Vista
    3. Output limited to non-default values, except where indicated by "{++}"
    6. Startup items buried in registry:
    7. ---------------------------------
    9. HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
    10. "Sidebar" = "C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" [MS]
    11. "{11BF71CA-F5C0-AE98-09CB-11AAFA56CE30}" = "C:\Users\marcel\AppData\Roaming:winupd.exe" [** WMI GetObject error **]
    12. "winupd.exe" = "C:\Users\marcel\AppData\Roaming:winupd.exe" [** WMI GetObject error **]
    13. "Steam" = ""c:\program files\valve\steam\steam.exe" -silent" ['Valve Corporation']
    14. "Tunebite" = "C:\Program Files\RapidSolution\Tunebite\Tunebite.exe -tray" [file not found]
    15. "Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ['Skype Technologies S.A.']
    16. "EPSON Stylus DX4400 Series" = "C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\Windows\TEMP\E_SA19B.tmp" /EF "HKCU"" ['SEIKO EPSON CORPORATION']
    17. "{B1F199CC-C2D4-6D78-F49D-69FD404D74E2}" = "C:\Users\marcel\AppData\Roaming\svchost.exe" [file not found]
    18. "PC Suite Tray" = ""C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray" ['Nokia']
    19. "Nokia.PCSync" = ""C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog" ['Time Information Services Ltd.']
    20. "ICQ" = ""C:\Program Files\ICQ6.5\ICQ.exe" silent" ['ICQ, Inc.']
    21. "Cognac" = "C:\Users\marcel\AppData\Local\Temp\~tmpb.exe" [null data]
    22. "MSFox" = "C:\Users\marcel\AppData\Local\Temp\yyy1542.exe" [null data]
    24. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    25. "Windows Defender" = "C:\Program Files\Windows Defender\MSASCui.exe -hide"
    26. "hpsysdrv" = "c:\hp\support\hpsysdrv.exe" ['Hewlett-Packard Company']
    27. "OsdMaestro" = ""C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"" ['OsdMaestro']
    28. "RtHDVCpl" = "RtHDVCpl.exe" ['Realtek Semiconductor']
    29. "(Default)" = "(empty string)" [file not found]
    30. "avgnt" = ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min" ['Avira GmbH']
    31. "WinSys2" = "C:\Windows\system32\startup.exe" [null data]
    32. "SunJavaUpdateSched" = ""C:\Program Files\Java\jre6\bin\jusched.exe"" ['Sun Microsystems, Inc.']
    33. "ProfilerU" = "C:\Program Files\Saitek\SD6\Software\ProfilerU.exe" ['Saitek']
    34. "SaiMfd" = "C:\Program Files\Saitek\SD6\Software\SaiMfd.exe" ['Saitek']
    35. "WinampAgent" = ""C:\Program Files\Winamp\winampa.exe"" [null data]
    36. "NapsterShell" = "C:\Program Files\Napster\napster.exe /systray" [file not found]
    37. "NvSvc" = "RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart" [MS]
    38. "NvCplDaemon" = "RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup" [MS]
    39. "NvMediaCenter" = "RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit" [MS]
    40. "Monitor" = "C:\Windows\PixArt\PAC207\Monitor.exe" ['PixArt Imaging Incorporation']
    41. "QuickTime Task" = ""C:\Program Files\QuickTime\QTTask.exe" -atboottime" ['Apple Inc.']
    42. "Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ['Adobe Systems Incorporated']
    43. "svhost" = "C:\WINDOWS\system32\svhost.exe" [null data]
    44. "GrooveMonitor" = ""C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"" [MS]
    46. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
    47. "Launcher" = "C:\Windows\SMINST\launcher.exe"
    49. HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\
    50. >{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer"
    51. \StubPath = "C:\Windows\system32\ie4uinit.exe -UserIconConfig" [MS]
    52. {44BBA840-CC51-11CF-AAFA-00AA00B6015C}\(Default) = "Microsoft Windows Mail 7"
    53. \StubPath = ""C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE" [MS]
    55. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
    56. {02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided)
    57. -> {HKLM...CLSID} = "Yahoo! Toolbar Helper"
    58. \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ['Yahoo! Inc.']
    59. {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
    60. -> {HKLM...CLSID} = "Adobe PDF Reader"
    61. \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ['Adobe Systems Incorporated']
    62. {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\(Default) = (no title provided)
    63. -> {HKLM...CLSID} = "IsoBuster Toolbar"
    64. \InProcServer32\(Default) = "C:\Program Files\IsoBuster\tbIsoB.dll" ['Conduit Ltd.']
    65. {72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided)
    66. -> {HKLM...CLSID} = "Groove GFS Browser Helper"
    67. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    68. {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
    69. -> {HKLM...CLSID} = "Java(tm) Plug-In SSV Helper"
    70. \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\ssv.dll" ['Sun Microsystems, Inc.']
    71. {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\(Default) = (no title provided)
    72. -> {HKLM...CLSID} = "Google Toolbar Notifier BHO"
    73. \InProcServer32\(Default) = "C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll" ['Google Inc.']
    74. {DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided)
    75. -> {HKLM...CLSID} = "Java(tm) Plug-In 2 SSV Helper"
    76. \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" ['Sun Microsystems, Inc.']
    77. {E5A1691B-D188-4419-AD02-90002030B8EE}\(Default) = (no title provided)
    78. -> {HKLM...CLSID} = "FlashFXP Helper for Internet Explorer"
    79. \InProcServer32\(Default) = "C:\PROGRA~1\FlashFXP\IEFlash.dll" ['IniCom Networks, Inc.']
    81. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
    82. "{00020d75-0000-0000-c000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
    83. -> {HKLM...CLSID} = "Microsoft Office Outlook"
    84. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL" [MS]
    85. "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
    86. -> {HKLM...CLSID} = "DesktopContext Class"
    87. \InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ['NVIDIA Corporation']
    88. "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
    89. -> {HKLM...CLSID} = "RealOne Player Context Menu Class"
    90. \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ['RealNetworks, Inc.']
    91. "{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
    92. -> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
    93. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL" [MS]
    94. "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
    95. -> {HKLM...CLSID} = (no title provided)
    96. \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS]
    97. "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"
    98. -> {HKLM...CLSID} = "Microsoft Office Metadata Handler"
    99. \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
    100. "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"
    101. -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"
    102. \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
    103. "{7F67036B-66F1-411A-AD85-759FB9C5B0DB}" = "ShellViewRTF"
    104. -> {HKLM...CLSID} = "ShellViewRTF"
    105. \InProcServer32\(Default) = "C:\Windows\System32\ShellvRTF.dll" ['XSS']
    106. "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
    107. -> {HKLM...CLSID} = "Shell Extension for Malware scanning"
    108. \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ['Avira GmbH']
    109. "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
    110. -> {HKLM...CLSID} = "WinRAR"
    111. \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
    112. "{44440D00-FF19-4AFC-B765-9A0970567D97}" = "TuneUp Theme Extension"
    113. -> {HKLM...CLSID} = "TuneUp Theme Extension"
    114. \InProcServer32\(Default) = "C:\Windows\System32\uxtuneup.dll" ['TuneUp Software GmbH']
    115. "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" = "TuneUp Shredder Shell Extension"
    116. -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"
    117. \InProcServer32\(Default) = "C:\Program Files\TuneUp Utilities 2009\SDShelEx-win32.dll" ['TuneUp Software GmbH']
    118. "{4838CD50-7E5D-4811-9B17-C47A85539F28}" = "TuneUp Disk Space Explorer Shell Extension"
    119. -> {HKLM...CLSID} = "TuneUp Disk Space Explorer Shell Extension"
    120. \InProcServer32\(Default) = "C:\Program Files\TuneUp Utilities 2009\DseShExt-x86.dll" ['TuneUp Software GmbH']
    121. "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "Nokia Phone Browser"
    122. -> {HKLM...CLSID} = "Nokia Phone Browser"
    123. \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 7\phonebrowser.dll" ['Nokia']
    124. "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper"
    125. -> {HKLM...CLSID} = "Groove GFS Browser Helper"
    126. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    127. "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar"
    128. -> {HKLM...CLSID} = "Groove Folder Synchronization"
    129. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    130. "{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler"
    131. -> {HKLM...CLSID} = "Groove GFS Stub Icon Handler"
    132. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    133. "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
    134. -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
    135. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    136. "{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler"
    137. -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
    138. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    139. "{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler"
    140. -> {HKLM...CLSID} = "Groove XML Icon Handler"
    141. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    142. "{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)"
    143. -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)"
    144. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    145. "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)"
    146. -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)"
    147. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    148. "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
    149. -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"
    150. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    151. "{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
    152. -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"
    153. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    154. "{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
    155. -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"
    156. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    157. "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
    158. -> {HKLM...CLSID} = "Outlook File Icon Extension"
    159. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL" [MS]
    161. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
    162. <<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"
    163. -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"
    164. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    166. HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\
    167. <<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"
    168. -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"
    169. \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]
    171. HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
    172. {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
    173. -> {HKLM...CLSID} = "PDF Shell Extension"
    174. \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ['Adobe Systems, Inc.']
    176. HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
    177. EPPShellEx\(Default) = "{509FE1AF-ADD5-49EC-BC55-7CF81FD16E78}"
    178. -> {HKLM...CLSID} = (no title provided)
    179. \InProcServer32\(Default) = "C:\Program Files\EPSON\Creativity Suite\Easy Photo Print\EPPShell.dll" ['SEIKO EPSON CORPORATION']
    180. Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
    181. -> {HKLM...CLSID} = "Shell Extension for Malware scanning"
    182. \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ['Avira GmbH']
    183. TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}"
    184. -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"
    185. \InProcServer32\(Default) = "C:\Program Files\TuneUp Utilities 2009\SDShelEx-win32.dll" ['TuneUp Software GmbH']
    186. WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    187. -> {HKLM...CLSID} = "WinRAR"
    188. \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
    189. XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
    190. -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
    191. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    193. HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
    194. TuneUp Disk Space Explorer Shell Extension\(Default) = "{4838CD50-7E5D-4811-9B17-C47A85539F28}"
    195. -> {HKLM...CLSID} = "TuneUp Disk Space Explorer Shell Extension"
    196. \InProcServer32\(Default) = "C:\Program Files\TuneUp Utilities 2009\DseShExt-x86.dll" ['TuneUp Software GmbH']
    197. TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}"
    198. -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"
    199. \InProcServer32\(Default) = "C:\Program Files\TuneUp Utilities 2009\SDShelEx-win32.dll" ['TuneUp Software GmbH']
    200. WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    201. -> {HKLM...CLSID} = "WinRAR"
    202. \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
    203. XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
    204. -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
    205. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    207. HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
    208. Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
    209. -> {HKLM...CLSID} = "Shell Extension for Malware scanning"
    210. \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ['Avira GmbH']
    211. WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    212. -> {HKLM...CLSID} = "WinRAR"
    213. \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
    214. XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
    215. -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
    216. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    218. HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\
    219. XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"
    220. -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"
    221. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    224. Group Policies {GPedit.msc branch and setting}:
    225. -----------------------------------------------
    227. Note: detected settings may not have any effect.
    229. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
    231. "ConsentPromptBehaviorAdmin" = (REG_DWORD) dword:0x00000002
    232. {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    233. User Account Control: Behavior Of The Elevation Prompt For Administrators In Admin Approval Mode}
    235. "ConsentPromptBehaviorUser" = (REG_DWORD) dword:0x00000001
    236. {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    237. User Account Control: Behavior Of The Elevation Prompt For Standard Users}
    239. "EnableInstallerDetection" = (REG_DWORD) dword:0x00000001
    240. {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    241. User Account Control: Detect Application Installations And Prompt For Elevation}
    243. "EnableLUA" = (REG_DWORD) dword:0x00000001
    244. {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    245. User Account Control: Run All Administrators In Admin Approval Mode}
    247. "EnableSecureUIAPaths" = (REG_DWORD) dword:0x00000001
    248. {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    249. User Account Control: Only elevate UIAccess applications that are installed in secure locations}
    251. "EnableVirtualization" = (REG_DWORD) dword:0x00000001
    252. {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    253. User Account Control: Virtualize file and registry write failures to per-user locations}
    255. "PromptOnSecureDesktop" = (REG_DWORD) dword:0x00000001
    256. {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    257. User Account Control: Switch to the secure desktop when prompting for elevation}
    259. "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
    260. {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    261. Shutdown: Allow system to be shut down without having to log on}
    263. "undockwithoutlogon" = (REG_DWORD) dword:0x00000001
    264. {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    265. Devices: Allow undock without having to log on}
    267. "FilterAdministratorToken" = (REG_DWORD) dword:0x00000000
    268. {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
    269. User Account Control: Admin Approval Mode for the Built-in Administrator Account}
    272. Active Desktop and Wallpaper:
    273. -----------------------------
    275. Active Desktop may be disabled at this entry:
    276. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
    278. Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
    279. HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
    280. "Wallpaper" = "C:\Windows\web\wallpaper\img24.jpg"
    282. Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
    283. HKCU\Control Panel\Desktop\
    284. "Wallpaper" = "C:\Windows\web\wallpaper\img24.jpg"
    287. Enabled Screen Saver:
    288. ---------------------
    290. HKCU\Control Panel\Desktop\
    291. "SCRNSAVE.EXE" = "C:\Windows\Snow3.scr" [null data]
    294. Windows Portable Device AutoPlay Handlers
    295. -----------------------------------------
    297. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\
    299. EpsonCreativitySuite\
    300. "Provider" = "FileManager"
    301. "InvokeProgID" = "EpsonCreativitySuite"
    302. "InvokeVerb" = "Play"
    303. HKLM\SOFTWARE\Classes\EpsonCreativitySuite\shell\Play\DropTarget\CLSID = "{7720BCC1-4F11-4f17-A80F-0BB69EF9788F}"
    304. -> {HKLM...CLSID} = (no title provided)
    305. \LocalServer32\(Default) = "C:\Program Files\EPSON\Creativity Suite\File Manager\eppqcom.exe" [null data]
    307. HPAutoplayPSE\
    308. "Provider" = "HP Photosmart Essential 2.0"
    309. "InvokeProgID" = "HpqPSApl.Autoplay"
    310. "InvokeVerb" = "Play"
    311. HKLM\SOFTWARE\Classes\HpqPSApl.Autoplay\shell\Play\DropTarget\CLSID = "{A6873065-D632-4615-A3A9-C5F05EE109C1}"
    312. -> {HKLM...CLSID} = (no title provided)
    313. \LocalServer32\(Default) = "c:\Program Files\HP\Digital Imaging\bin\HpqPsApl.exe" ['Hewlett-Packard']
    315. LightScribeOnArrivalAP\
    316. "Provider" = "LightScribe Direct Disc Labeling"
    317. "InvokeProgID" = "LightScribe.AutoPlayHandler"
    318. "InvokeVerb" = "LabelLightScribeDisc"
    319. HKLM\SOFTWARE\Classes\LightScribe.AutoPlayHandler\shell\LabelLightScribeDisc\command\(Default) = "c:\Program Files\Common Files\LightScribe\LsLauncher.exe" ['Hewlett-Packard Company']
    321. MediaCapture9Music\
    322. "Provider" = "Media Import"
    323. "InvokeProgID" = "RoxioMediaCapture9"
    324. "InvokeVerb" = "Audio"
    325. HKLM\SOFTWARE\Classes\RoxioMediaCapture9\shell\Audio\command\(Default) = "c:\Program Files\Roxio\Media Import 9\MediaCapture9.exe -audio %L" ['Sonic Solutions']
    327. MediaCapture9Photos\
    328. "Provider" = "Media Import"
    329. "InvokeProgID" = "RoxioMediaCapture9"
    330. "InvokeVerb" = "Photo"
    331. HKLM\SOFTWARE\Classes\RoxioMediaCapture9\shell\Photo\command\(Default) = "c:\Program Files\Roxio\Media Import 9\MediaCapture9.exe -photo %L" ['Sonic Solutions']
    333. MediaCapture9VideoCamera\
    334. "Provider" = "Media Import"
    335. "ProgID" = "Shell.HWEventHandlerShellExecute"
    336. "InitCmdLine" = "c:\Program Files\Roxio\Media Import 9\MediaCapture9.exe"
    337. HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
    338. -> {HKLM...CLSID} = "Shell Execute Hardware Event Handler"
    339. \LocalServer32\(Default) = "C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]
    341. MediaCapture9Videos\
    342. "Provider" = "Media Import"
    343. "InvokeProgID" = "RoxioMediaCapture9"
    344. "InvokeVerb" = "Video"
    345. HKLM\SOFTWARE\Classes\RoxioMediaCapture9\shell\Video\command\(Default) = "c:\Program Files\Roxio\Media Import 9\MediaCapture9.exe -video %L" ['Sonic Solutions']
    347. NMMPlayCDAudioOnArrival\
    348. "Provider" = "Nokia Music Manager"
    349. "InvokeProgID" = "NokiaMusicManager"
    350. "InvokeVerb" = "NMMPlayCD"
    351. HKLM\SOFTWARE\Classes\NokiaMusicManager\shell\NMMPlayCD\command\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 7\MusicManager.exe /playCD "%L"" ['Nokia']
    353. NMMRipCDAudioOnArrival\
    354. "Provider" = "Nokia Music Manager"
    355. "InvokeProgID" = "NokiaMusicManager"
    356. "InvokeVerb" = "NMMRipCD"
    357. HKLM\SOFTWARE\Classes\NokiaMusicManager\shell\NMMRipCD\command\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 7\MusicManager.exe /ripCD "%L"" ['Nokia']
    359. RoxioSCAudioCDTask33\
    360. "Provider" = "Roxio Creator Audio"
    361. "InvokeProgID" = "Roxio.RoxioCentral33"
    362. "InvokeVerb" = "AudioCDTask"
    363. HKLM\SOFTWARE\Classes\Roxio.RoxioCentral33\shell\AudioCDTask\Command\(Default) = ""c:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Main\Roxio_Central33.exe" /Launch {8E376824-EA6C-4CB7-AA05-A30CB84D359B}" [null data]
    365. RoxioSCCopyCD33\
    366. "Provider" = "Roxio Creator Copy"
    367. "InvokeProgID" = "Roxio.RoxioCentral33"
    368. "InvokeVerb" = "ExactCopyJob"
    369. HKLM\SOFTWARE\Classes\Roxio.RoxioCentral33\shell\ExactCopyJob\Command\(Default) = ""c:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Main\Roxio_Central33.exe" /Launch {6123D5C0-0B6A-4B67-A692-C0863AB98CDA}" [null data]
    371. RoxioSCCopyDisc33\
    372. "Provider" = "Roxio Creator Copy"
    373. "InvokeProgID" = "Roxio.RoxioCentral33"
    374. "InvokeVerb" = "ExactCopyJob"
    375. HKLM\SOFTWARE\Classes\Roxio.RoxioCentral33\shell\ExactCopyJob\Command\(Default) = ""c:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Main\Roxio_Central33.exe" /Launch {6123D5C0-0B6A-4B67-A692-C0863AB98CDA}" [null data]
    377. RoxioSCDataProject33\
    378. "Provider" = "Roxio Creator Data"
    379. "InvokeProgID" = "Roxio.RoxioCentral33"
    380. "InvokeVerb" = "DataGuide"
    381. HKLM\SOFTWARE\Classes\Roxio.RoxioCentral33\shell\DataGuide\Command\(Default) = ""c:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Main\Roxio_Central33.exe" /Launch Data" [null data]
    383. RoxioSCDataTask33\
    384. "Provider" = "Roxio Creator Data"
    385. "InvokeProgID" = "Roxio.RoxioCentral33"
    386. "InvokeVerb" = "DataTask"
    387. HKLM\SOFTWARE\Classes\Roxio.RoxioCentral33\shell\DataTask\Command\(Default) = ""c:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Main\Roxio_Central33.exe" /Launch {D085B12D-4D9B-49C2-8323-5053831CBD54}" [null data]
    389. VLCPlayCDAudioOnArrival\
    390. "Provider" = "VideoLAN VLC media player"
    391. "InvokeProgID" = "VLC.CDAudio"
    392. "InvokeVerb" = "play"
    393. HKLM\SOFTWARE\Classes\VLC.CDAudio\shell\play\command\(Default) = "C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file cdda:%1" ['VideoLAN Team']
    395. VLCPlayDVDMovieOnArrival\
    396. "Provider" = "VideoLAN VLC media player"
    397. "InvokeProgID" = "VLC.DVDMovie"
    398. "InvokeVerb" = "play"
    399. HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell\play\command\(Default) = "C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file dvd:%1" ['VideoLAN Team']
    401. WinampMTPHandler\
    402. "Provider" = "Winamp"
    403. "ProgID" = "Shell.HWEventHandlerShellExecute"
    404. "InitCmdLine" = "C:\Program Files\Winamp\winamp.exe"
    405. HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
    406. -> {HKLM...CLSID} = "Shell Execute Hardware Event Handler"
    407. \LocalServer32\(Default) = "C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]
    409. WinampPlayMediaOnArrival\
    410. "Provider" = "Winamp"
    411. "InvokeProgID" = "Winamp.File"
    412. "InvokeVerb" = "Play"
    413. HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ['Nullsoft']
    414. HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}"
    415. -> {HKLM...CLSID} = (no title provided)
    416. \LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ['Nullsoft']
    419. Winsock2 Service Provider DLLs:
    420. -------------------------------
    422. Namespace Service Providers
    424. HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
    425. 000000000001\LibraryPath = "%SystemRoot%\system32\NLAapi.dll" [MS]
    426. 000000000002\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
    427. 000000000003\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
    428. 000000000004\LibraryPath = "%SystemRoot%\system32\napinsp.dll" [MS]
    429. 000000000005\LibraryPath = "%SystemRoot%\system32\pnrpnsp.dll" [MS]
    430. 000000000006\LibraryPath = "%SystemRoot%\system32\pnrpnsp.dll" [MS]
    432. Transport Service Providers
    434. HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
    435. 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
    436. %SystemRoot%\system32\mswsock.dll [MS], 01 - 22
    439. Toolbars, Explorer Bars, Extensions:
    440. ------------------------------------
    442. Toolbars
    444. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
    445. "{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6}"
    446. -> {HKLM...CLSID} = "IsoBuster Toolbar"
    447. \InProcServer32\(Default) = "C:\Program Files\IsoBuster\tbIsoB.dll" ['Conduit Ltd.']
    449. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
    450. "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
    451. -> {HKLM...CLSID} = "Yahoo! Toolbar mit Pop-Up-Blocker"
    452. \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ['Yahoo! Inc.']
    453. "{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6}" = "IsoBuster Toolbar"
    454. -> {HKLM...CLSID} = "IsoBuster Toolbar"
    455. \InProcServer32\(Default) = "C:\Program Files\IsoBuster\tbIsoB.dll" ['Conduit Ltd.']
    457. Explorer Bars
    459. HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
    461. HKLM\SOFTWARE\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization"
    462. Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
    463. InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL" [MS]
    465. HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Recherchieren"
    466. Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
    467. InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL" [MS]
    469. Extensions (Tools menu items, main toolbar menu buttons)
    471. HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
    472. {2670000A-7350-4F3C-8081-5663EE0C6C49}\
    473. "ButtonText" = "An OneNote senden"
    474. "MenuText" = "An OneNote s&enden"
    475. "CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}"
    476. -> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button"
    477. \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll" [MS]
    479. {92780B25-18CC-41C8-B9BE-3C9C571A8263}\
    480. "ButtonText" = "Research"
    482. {E59EB121-F339-4851-A3BA-FE49C35617C2}\
    483. "ButtonText" = "ICQ6"
    484. "MenuText" = "ICQ6"
    485. "Exec" = "C:\Program Files\ICQ6.5\ICQ.exe" ['ICQ, Inc.']
    488. Miscellaneous IE Hijack Points
    489. ------------------------------
    491. HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
    492. <<H>> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
    493. -> {HKLM...CLSID} = "Yahoo! Toolbar mit Pop-Up-Blocker"
    494. \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ['Yahoo! Inc.']
    495. <<H>> "{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}" = (no title provided)
    496. -> {HKLM...CLSID} = "IsoBuster Toolbar"
    497. \InProcServer32\(Default) = "C:\Program Files\IsoBuster\tbIsoB.dll" ['Conduit Ltd.']
    500. Running Services (Display Name, Service Name, Path {Service DLL}):
    501. ------------------------------------------------------------------
    503. Avira AntiVir Personal - Free Antivirus Guard, AntiVirService, ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe"" ['Avira GmbH']
    504. Avira AntiVir Personal - Free Antivirus Planer, AntiVirScheduler, ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe"" ['Avira GmbH']
    505. BlueSoleil Hid Service, BlueSoleil Hid Service, "C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe" [null data]
    506. Computerbrowser, Browser, "C:\Windows\System32\svchost.exe -k netsvcs" {"C:\Windows\System32\browser.dll" [MS]}
    507. CyberGhost VPN Client, CGVPNCliSrvc, "C:\Program Files\S.A.D\CyberGhost VPN\CGVPNCliService.exe" ['mobile concepts GmbH']
    508. Google Updater Service, gusvc, ""C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"" ['Google']
    509. LightScribeService Direct Disc Labeling Service, LightScribeService, ""c:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ['Hewlett-Packard Company']
    510. NVIDIA Display Driver Service, nvsvc, "C:\Windows\system32\nvvsvc.exe" ['NVIDIA Corporation']
    511. ServiceLayer, ServiceLayer, ""C:\Program Files\PC Connectivity Solution\ServiceLayer.exe"" ['Nokia.']
    512. Steam Client Service, Steam Client Service, "C:\Program Files\Common Files\Steam\SteamService.exe /RunAsService" ['Valve Corporation']
    513. Windows Driver Foundation - Benutzermodus-Treiberframework, wudfsvc, "C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted" {"C:\Windows\System32\WUDFSvc.dll" [MS]}
    514. Windows-Bilderfassung, stisvc, "C:\Windows\system32\svchost.exe -k imgsvc" {"C:\Windows\System32\wiaservc.dll" [MS]}
    515. Zugriff auf Eingabegeräte, hidserv, "C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted" {"C:\Windows\system32\hidserv.dll" [MS]}
    518. Print Monitors:
    519. ---------------
    521. HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
    522. EPSON Stylus DX4400 Series 32MonitorBE\Driver = "E_FLBCAE.DLL" ['SEIKO EPSON CORPORATION']
    523. Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS]
    526. ---------- (launch time: 2008-12-13 20:47:22)
    527. <<!>>: Suspicious data at a malware launch point.
    528. <<H>>: Suspicious data at a browser hijack point.
    530. + This report excludes default entries except where indicated.
    531. + To see *everywhere* the script checks and *everything* it finds,
    532. launch it from a command prompt or a shortcut with the -all parameter.
    533. + To search all directories of local fixed drives for DESKTOP.INI
    534. DLL launch points, use the -supp parameter or answer "No" at the
    535. first message box and "Yes" at the second message box.
    536. ---------- (total run time: 74 seconds, including 14 seconds for message boxes)
    Alles anzeigen


    Welches Antivir Programm könnt ihr mir empfehlen?
    [COLOR="Blue"]Meine UP´s Kinder Hörspiele[/color]

  • Also in deinem HijackThis Log sind einige Sachen drin die nicht hin gehören

    beende im Taskmanager folgende Prozesse und lasse die Dateien bei VirusTotal
    einmal scannen, poste dann das Ergebnis:

    C:Windows\system32\taskeng.exe
    C:Windows\system32\Dwm.exe
    C:WINDOWS\PixArtPAC207\Monitor.exe
    C:WINDOWS\System32\svhost.exe
    C:Windows\system32\wuauclt.exe

    PS: ich kann dir jetzt schon sagen das beste wird wohl eine Neuinstallation sein. Meine Vermutung gehen zu MYDOOM
    Gruß Fotoprinz

  • oki ich hab einfach mal alle datei´n mit HijackThis gefixt die fehlerhaft waren un kaspersky installeiert

    neustart von windows hat zwart über 5 min gedauert aber jzz geht alles ohne problem un fährt jzz auch wieder schneller hoch

    ach und noch was nachdem ersten neustart waren die NETZWERKTREIBER deaktiviert also nich wundere´n wenn ihr kein Internet habt!!!

    Gruß bomber09:blink:
    [COLOR="Blue"]Meine UP´s Kinder Hörspiele[/color]

  • bomber09 schrieb:

    oki ich hab einfach mal alle datei´n mit HijackThis gefixt die fehlerhaft waren un kaspersky installeiert




    Das war das beste was Du tun konntest.Kaspersky ist meiner meinung nach immer noch das beste Antiviren Programm was es gibt.

    Freut mich das es Deinem System wieder besser geht.:)


    Greetz
    [COLOR="Blue"][SIZE="3"]Das Problem ist nicht der Computer,das Problem sitzt davor.[/SIZE][/color]