Seit heute morgen Alarm beim Starten meines PC

[Rosebud]

Ich habe mir gestern abend eine Demo Version eines elektronischen Fahrtenbuches heruntergeladen (Kramer IT Solutions GmbH). Heute morgen beim Starten meines PC kam folgender Alarm:

A startup programm ICQLite requires your approval
Programms added to the startup registry are loaded automatically when Windows starts. This change generally occurs when software is installed. You can allow this change if it is recognized and expeected.
Name: ICQLite
Description IXQLite
Publisher ICQ Ltd.

Click for more information abour this alert
What would you like to do?
Allow - Block

Wenn ich auf den Informations Button klicke, kommt folgendes:

Application Agent: Startup Registry Files
What does this Application Agent do?

The Startup Registry Files Agent monitors additions and modifications to your list of startup programs in your system registry. If a new startup program is added to any startup registry location, the agent notifies you. If the program being added is known to be safe, the agent will allow it. If it is known to be spyware, the agent blocks it and warns you.



What is a startup registry file?

Startup registry keys are a number of registry entries in the Windows registry that store paths to applications on your computer. Applications listed in any registry keys are loaded automatically when Windows starts. These keys generally apply to Windows 95, 98, ME, NT, 2000, XP, and 2003. The startup registry keys are as follows:



Registry Local Machine Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Any application path placed in this location will start when any user logs into Windows. These are the most common startup locations for programs to install auto start from. By default these keys are not executed in Safe mode. If you prefix the value of these keys with an asterisk, *, is will run in Safe Mode.



Registry Current User Run

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Any application path placed in this location will start when the current user for this key logs into Windows. These are the most common startup locations for programs to install auto start from. By default these keys are not executed in Safe mode. If you prefix the value of these keys with an asterisk, *, is will run in Safe Mode.



Registry Local Machine RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Any application path placed in this location will start when any user logs into Windows. These keys are designed to be used primarily by Setup programs. Entries in these keys are started once and then are deleted from the key. If there is an exclamation point preceding the value of the key, the entry will not be deleted until after the program completes, otherwise it will be deleted before the program runs. This is important, because if the exclamation point is not used, and the program referenced in this key fails to complete, it will not run again as it will have already been deleted. All entries in this key are started synchronously in an undefined order. Due to this, all programs in this key must be finished before any entries in HKEY_LOCAL_MACHINE\...\Run, HKEY_CURRENT_USER\...\Run, HKEY_CURRENT_USER\...\RunOnce, and Startup Folders can be loaded.



Registry Current User RunOnce

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Any application path placed in this location will start when the current user for this key logs into Windows. These keys are designed to be used primarily by Setup programs. Entries in these keys are started once and then are deleted from the key. If there a exclamation point preceding the value of the key, the entry will not be deleted until after the program completes, otherwise it will be deleted before the program runs. This is important, because if the exclamation point is not used, and the program referenced in this key fails to complete, it will not run again as it will have already been deleted. All entries in this key are started synchronously in an undefined order. Due to this, all programs in this key must be finished before any entries in HKEY_LOCAL_MACHINE\...\Run, HKEY_CURRENT_USER\...\Run, HKEY_CURRENT_USER\...\RunOnce, and Startup Folders can be loaded.



Registry Local Machine RunOnceEx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx



Registry Current User RunOnceEx

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx



Registry Local Machine RunServicesOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce



Registry Local Machine RunServices

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

This key is designed to start services as well for all users. These entries can also continue running even after you log on, but must be completed before the HKEY_LOCAL_MACHINE\...\RunServices registry can start loading its programs.



Registry Current User RunServices

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

This key is designed to start services as well for the current user. These entries can also continue running even after you log on, but must be completed before the HKEY_CURRENT_USER\...\RunServices registry can start loading its programs.



Registry Local Machine Policies\Explorer\Run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

This key is designed to start services as well for all users. These keys is generally used to load programs as part of a policy set in place on the computer or user.



Registry Current User Policies\Explorer\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

This key is designed to start services as well for the current user. These keys is generally used to load programs as part of a policy set in place on the computer or user.



Load Key

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load

This key is not commonly used, but can be used to auto start programs.

Leider kann ich nicht genug Englisch, um damit etwas anfangen zu können. Kann mir jemand einen Tip geben, was ich tun soll?

Rosebud

[roni]

Dein PC fragt Dich, ob Du erlauben willst dass ICQ automatisch mit dem Windows-Start gestartet werden soll.
Du kannst diesen Vorgang mit "Allow" erlauben und mit "Block" verhindern. Der Rest ist denke ich Erklärung was eine "Registry Datei" tut. Mit der Demo-Version hat das nix zu tun.

[Rosebud]

Danke Roni.

Ich hab mich nur erschrocken, weil heute erstmals zig Meldungen der Anti Spyware hochgepoppt sind, als ich meinen PC angeschaltet habe. Das war noch nie da und es klingt echt gefährlich, besonders, wenn man nur jedes zweite Wort übersetzen kann.

[Rosebud]

Ach du Schreck. Das ist nicht di eeinzige Warnung. es geht noch weiter:

2. A Windows shell browser requies your approval
A shell browser is a toolbar that adds functionally to Windowsw Explorer or Internet Explorer. This change generally occurs when software is installed. You can allow this change if it is recognized and expected.
Name: Google Toolbar für IE, Description: Google Toolbar für Internet Explorer Client

3. A shortcut menu item requires your approval
A programm ICQLite Shell Module is trying add an item to the shortcur menu in Windows Explorer. This change generally occurs when ´software is installed. You can allow this change if it is recognized and expected.
"/shellex/ContextMenuHandlers/ICQLiteMenu
Name: ICQLiteShellModule, Description: ICQLiteShellModule

4. An Internet Explorer bar requires your approval
An Explorer bar is a pane inside Internet Explorer that can display Favorites, History or other options. This change generally occurs when software is installed. You can allow this change if it is recognized and expected.
Name: Betriebssystem Mikrosoft Windows, Description: Blibliothek für Shell-Dokumente und -Steuerelemente

5. A startup program ICQLite requires your approval
Programs added to the startup registry are loaded automatically when Windows starts. This change generally occurs when software is installed. You can allow this change if it is recognized and expected.
Name:ICQLite, Description: ICQLite, Publisher: ICQLtd.

6. An Internet Explorer Search Page URL change requires your approval
The Internet Explorer URL for your Search Page is attemptin to be changed from http://www.microsoft.com/isapi/redir.dll?
prd=ießar=iesearch to
http://www.google.com
The default URL for your Search Page is http://www.microsoft.com/isapi/redir.dll?
prd=ießar=iesarch

7. An Internet Explorer ActiveX program requies your approval
ActiveX programs are often downloaded from Web sites and can perform any action that a typical application can. This change generally occurs when software is installed. You can allow this change if it is recognized and expected
Name: Shockwave
Description: Shockwave ActiveX Control
Publisher: Macromedia. Inc.

8. A browser helper object requires your approval
A browser helper object is a program that adds functionally to Internet Explorer. This change generally occurs when software is installed. You can allow this change if it is recognized and expected.
Name: Java(TM) 2 Platform Standard Edition 5.0 Update 9
Description: Java(TM) 2 Platform Standard
Edition binary
Publisher: Sun Microsystems, Inc.
Path: c/programme/java/ire1.50_09/bin/ssv.dll

9. An Internet Explorer toolbar button requires your approval
Toolbar buttons are added to the Internet Explorer toolbar and can run an associated program. This change generally occurs when software is installed. You can allow this change if it is recognized and expected.
Name: Microsoft Active Sync
Publisher: Microsoft Corporations
Path: c/progra~1/micros~3/inetrepl.dll

10. An Internet Explorer Web browser object requires your approval:
A Web broswer object is a program that can change Internet Explorer settings. This change generally occurs when software is installed. You can allow this change if it is recognized and expected.
Name: Yahoo! Toolbar mit Pop-Up-Blocker

Alle Meldungen stammen von:
Windows AntiSpyware Notice

[Gytha]

Doch, das kann schon sein, dass die Lite-Version zusammen mit der Demo-Version gekommen ist, sowas ist nicht selten. Und ICQ hängt sich an diversen Stellen ins System, das sind dann wohl auch diese ganzen Meldungen.

[Rosebud]

Wenn ich euch richtig verstanden habe, ist es also Geschmacksache, ob ich auf Allow (erlauben) oder Block (blocken) klicke. Passiert nix

[Gytha]

Nein, keine Geschmackssache, Rose, sondern eine Sache des Haben-Wollens oder eben auch nicht. Ein Programm, das man nicht haben und nutzen will, müllt nur die Kiste zu und sollte deshalb immer deinstalliert werden.

[Rosebud]

Danke Roni und Gytha.

Dann werde ich mal das meiste blocken. Was ich brauche, kann ich ja schließlich auch manuell starten.

LG - Rosebud

[Rosebud]

Oh Gott bin ich blöd, so was gehört bestraft.

Ich habe gestern abend nach dem Installieren des elektronischen Fahrtenbuches die Zeiteinstellung meines Systems auf 2003 verändert, weil ich wissen wollte, ob man auch nachträglich ein Fahrtenbuch für 2003 anlegen kann. Und das habe ich nicht wieder verändert.
Deshalb fragt mich Ebay auch seitdem immer, ob ich dem abgelaufenen Sicherheitszertifikat von Ebay vertrauen will. Jetzt habe ich die Systemzeit wieder auf das heutige Datum umgestellt, da sind die Fehlermeldungen verschwunden.

Mein Computer war seit gestern abend im Jahr 2003.

[Gytha]

Tja, so findet sich manchmal völlig unerwartet eine überraschend schnelle Lösung