| |
| |||||||
Log-Analyse und Auswertung: TR/Kazy.mekl.1 und Kazy3281 und Windows Recovery spinnt rum...Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
27.06.2011, 21:27
| #1 |
 |  TR/Kazy.mekl.1 und Kazy3281 und Windows Recovery spinnt rum... Hallo liebe Forums-Ritter, ich habe die o.g. Trojaner auf dem Labtop. Bildschirm schwarz, kein Zugriff auf Daten, keine Möglichkeit, einen Browser zu öffnen, Avira meldete erst den ersten Virus, und heute beim Versuch, die Defogger-Anwendung und OTL aufs Desktop zu bringen via USB-Stick, zeigte Avira noch Kazy3281 an (oder so, konnte nicht so schnell auf alles achten). Ich konnte den Defogger rüberschieben und starten, klickte dann auf die entstandene Textdatei, schrieb den Inhalt glücklicherweise ab, und gleich darauf war die Datei vom Desktop verschwunden: "defogger_disable by jpshortstuff (23.02.10.1) Log created at22:04 on 27/06/2011 (Taettchen) Checking for autostart values HKCU\~\Run values retrieved HKLM\~\Run values retrieved Checking for services/drivers..." Kurz darauf fuhr sich der Computer (Windows Vista) wieder selbst runter. Und - hilfe - ich sehe gerade, dass sich "Windows Recovery" selbst ausgelöst hat und mir nun "11 errors" meldet. Und ständig kommt eine "RunDLL"-Fehlermeldung. Was nun? Ich bin sehr dankbar über Eure Hilfe!! Grüße! Taddele (Ich schreibe dies von einem anderen Computer.) Ergänzung: Habe runtergefahren und neu gestartet, OTL gestartet, es hing sich auf, und Avira zeigt nun einen neuen Fund: "TR/Crypt.XPACK.Gen4"; habe nun nochmal runtergefahren und versuche Neustart. So, ich habe es knapp geschafft mithilfe des USB-Sticks, nun hat sich's wieder runtergefahren...:OTL Logfile: Code:
ATTFilter OTL logfile created on: 27.06.2011 23:00:22 - Run 1 OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Taettchen\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.19048) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,99 Gb Total Physical Memory | 1,89 Gb Available Physical Memory | 63,13% Memory free 6,19 Gb Paging File | 5,11 Gb Available in Paging File | 82,61% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 440,37 Gb Total Space | 143,26 Gb Free Space | 32,53% Space Free | Partition Type: NTFS Drive D: | 25,38 Gb Total Space | 12,55 Gb Free Space | 49,46% Space Free | Partition Type: FAT32 Drive F: | 979,70 Mb Total Space | 978,67 Mb Free Space | 99,89% Space Free | Partition Type: FAT Computer Name: WILMA | User Name: Taettchen | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Taettchen\Desktop\OTL.exe (OldTimer Tools) PRC - C:\ProgramData\trwKcwHFGPMgtX.exe () PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe () PRC - C:\Windows\tsnp2uvc.exe () PRC - C:\Programme\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe (Marvell Semiconductor, Inc.) PRC - C:\Windows\System32\PSIService.exe () PRC - C:\Windows\System32\spool\drivers\w32x86\3\E_FATICDE.EXE (SEIKO EPSON CORPORATION) PRC - C:\Windows\System32\attrib.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Users\Taettchen\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (resetWinService) -- C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe () SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (ProtexisLicensing) -- C:\Windows\System32\PSIService.exe () ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys () DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation) DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation ) DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Search IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.06 21:43:33 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.06 21:43:33 | 000,000,000 | ---D | M] [2009.08.03 13:57:03 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Taettchen\AppData\Roaming\mozilla\Extensions [2011.05.01 18:58:20 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Taettchen\AppData\Roaming\mozilla\Firefox\Profiles\9pro4g14.default\extensions [2009.09.02 21:51:43 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Taettchen\AppData\Roaming\mozilla\Firefox\Profiles\9pro4g14.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.04.12 13:57:05 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Taettchen\AppData\Roaming\mozilla\Firefox\Profiles\9pro4g14.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010.06.10 17:21:05 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\Taettchen\AppData\Roaming\mozilla\Firefox\Profiles\9pro4g14.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.03.23 00:30:14 | 000,000,000 | -H-D | M] (Adblock Plus) -- C:\Users\Taettchen\AppData\Roaming\mozilla\Firefox\Profiles\9pro4g14.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2011.04.12 13:57:09 | 000,000,000 | -H-D | M] (Conduit Engine) -- C:\Users\Taettchen\AppData\Roaming\mozilla\Firefox\Profiles\9pro4g14.default\extensions\engine@conduit.com [2010.06.10 18:18:35 | 000,000,881 | -H-- | M] () -- C:\Users\Taettchen\AppData\Roaming\Mozilla\Firefox\Profiles\9pro4g14.default\searchplugins\conduit.xml [2010.10.12 22:34:25 | 000,001,340 | -H-- | M] () -- C:\Users\Taettchen\AppData\Roaming\Mozilla\Firefox\Profiles\9pro4g14.default\searchplugins\wikipedia-en.xml [2010.05.14 03:53:23 | 000,002,064 | -H-- | M] () -- C:\Users\Taettchen\AppData\Roaming\Mozilla\Firefox\Profiles\9pro4g14.default\searchplugins\youtube-videosuche.xml [2010.11.15 21:01:35 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.03.02 19:48:07 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2011.03.02 19:48:07 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2011.03.02 19:48:07 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2011.03.02 19:48:07 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2011.03.02 19:48:07 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ALDI_NORD_FotoSuite_Download] C:\Program Files\ALDI Foto Service Nord\ALDI_Foto_Service\FotoSuite.exe (MAGIX AG) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [HPUsageTracking] C:\Program Files\Hewlett-Packard\HP UT\bin\hppusg.exe () O4 - HKLM..\Run: [MDS_Menu] C:\Program Files\HomeCinema\MediaShow4\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\HomeCinema\PowerDVD8\Language\Language.exe () O4 - HKLM..\Run: [PrnStatusMX] C:\Programme\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe (Marvell Semiconductor, Inc.) O4 - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [snp2uvc] File not found O4 - HKLM..\Run: [tsnp2uvc] C:\Windows\tsnp2uvc.exe () O4 - HKLM..\Run: [UCam_Menu] C:\Program Files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [{33AEBC9B-1CD9-B392-4C34-8127573B0594}] C:\Users\Taettchen\AppData\Roaming\Gidimo\esyq.exe () O4 - HKCU..\Run: [EPSON Stylus DX7400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE (SEIKO EPSON CORPORATION) O4 - HKCU..\Run: [Klosecavaleg] C:\Users\Taettchen\AppData\Local\PURPScol.dll () O4 - HKCU..\Run: [trwKcwHFGPMgtX] C:\ProgramData\trwKcwHFGPMgtX.exe () O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Taettchen\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2008.08.21 11:50:32 | 000,000,672 | RH-- | M] () - D:\autoexec.bat -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.06.27 22:24:36 | 000,000,000 | -H-D | C] -- C:\Users\Taettchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Recovery [2011.06.27 22:05:42 | 000,579,072 | -H-- | C] (OldTimer Tools) -- C:\Users\Taettchen\Desktop\OTL.exe [2009.02.27 19:17:28 | 000,225,280 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll [2009.02.27 19:17:27 | 000,176,128 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll ========== Files - Modified Within 30 Days ========== [2011.06.27 23:03:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.06.27 23:00:19 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2011.06.27 22:57:17 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.06.27 22:57:13 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.06.27 22:57:13 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.06.27 22:57:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.06.27 22:56:30 | 3215,851,520 | -HS- | M] () -- C:\hiberfil.sys [2011.06.27 22:50:33 | 000,632,956 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.06.27 22:50:33 | 000,599,604 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.06.27 22:50:33 | 000,130,450 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.06.27 22:50:33 | 000,107,082 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.06.27 22:24:38 | 000,000,587 | -H-- | M] () -- C:\Users\Taettchen\Desktop\Windows Recovery.lnk [2011.06.27 22:24:28 | 000,000,336 | -H-- | M] () -- C:\ProgramData\41672440 [2011.06.27 22:24:16 | 000,438,784 | -H-- | M] () -- C:\ProgramData\41672440.exe [2011.06.27 22:04:57 | 000,000,000 | -H-- | M] () -- C:\Users\Taettchen\defogger_reenable [2011.06.27 22:00:50 | 000,000,430 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{31953012-17AF-49BF-8516-FE30368E878C}.job [2011.06.27 21:57:29 | 000,000,000 | -H-- | M] () -- C:\Users\Taettchen\AppData\Local\Uremikikik.bin [2011.06.27 21:52:14 | 000,579,072 | -H-- | M] (OldTimer Tools) -- C:\Users\Taettchen\Desktop\OTL.exe [2011.06.27 21:49:24 | 000,050,477 | -H-- | M] () -- C:\Users\Taettchen\Desktop\Defogger.exe ========== Files Created - No Company Name ========== [2011.06.27 22:24:38 | 000,000,587 | -H-- | C] () -- C:\Users\Taettchen\Desktop\Windows Recovery.lnk [2011.06.27 22:24:28 | 000,000,336 | -H-- | C] () -- C:\ProgramData\41672440 [2011.06.27 22:24:15 | 000,438,784 | -H-- | C] () -- C:\ProgramData\41672440.exe [2011.06.27 22:04:57 | 000,000,000 | -H-- | C] () -- C:\Users\Taettchen\defogger_reenable [2011.06.27 22:03:36 | 000,050,477 | -H-- | C] () -- C:\Users\Taettchen\Desktop\Defogger.exe [2011.05.10 22:56:16 | 000,000,000 | -H-- | C] () -- C:\Users\Taettchen\AppData\Local\Uremikikik.bin [2011.05.10 22:56:15 | 000,000,120 | -H-- | C] () -- C:\Users\Taettchen\AppData\Local\Bnamoz.dat [2011.02.12 20:09:12 | 000,000,008 | RHS- | C] () -- C:\Windows\System32\09C10B4EB8.sys [2010.04.12 18:22:54 | 000,000,680 | -H-- | C] () -- C:\Users\Taettchen\AppData\Local\d3d9caps.dat [2010.02.01 20:13:49 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll [2010.02.01 20:13:36 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini [2010.02.01 20:13:13 | 000,409,287 | -H-- | C] () -- C:\Users\Taettchen\AppData\Roaming\mdbu.bin [2009.12.30 15:00:30 | 000,000,182 | ---- | C] () -- C:\Windows\PAVER01.INI [2009.09.21 12:05:52 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat [2009.09.21 12:05:52 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat [2009.09.21 12:05:52 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat [2009.09.21 12:05:52 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat [2009.09.21 12:05:52 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat [2009.09.21 12:05:52 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat [2009.09.21 12:05:52 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat [2009.09.21 12:05:52 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat [2009.09.21 12:05:52 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat [2009.09.21 12:05:52 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat [2009.09.21 12:05:52 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat [2009.09.21 12:05:52 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat [2009.09.21 12:05:52 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat [2009.09.21 12:05:52 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat [2009.09.21 12:05:52 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat [2009.09.21 12:05:52 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat [2009.09.21 12:05:52 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat [2009.09.21 12:05:52 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat [2009.09.21 12:05:52 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini [2009.09.21 12:02:24 | 000,000,025 | ---- | C] () -- C:\Windows\CDE DX7400DEFGIPS.ini [2009.09.17 09:37:39 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.09.17 09:37:38 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.09.17 09:37:37 | 000,118,784 | -H-- | C] () -- C:\Users\Taettchen\AppData\Local\PURPScol.dll [2009.08.11 13:33:13 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2009.08.11 12:30:21 | 000,058,368 | -H-- | C] () -- C:\Users\Taettchen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.07.09 20:00:07 | 001,965,071 | -H-- | C] () -- C:\Users\Taettchen\AppData\Roaming\UserTile.png [2009.06.30 18:12:13 | 000,002,986 | -H-- | C] () -- C:\Users\Taettchen\AppData\Roaming\wklnhst.dat [2009.02.27 19:17:28 | 001,799,808 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys [2009.02.27 19:17:28 | 000,233,472 | ---- | C] () -- C:\Windows\tsnp2uvc.exe [2009.02.27 19:17:28 | 000,028,544 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys [2009.02.27 19:17:28 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini [2009.02.26 22:09:31 | 000,002,828 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys [2009.02.26 22:09:31 | 000,000,008 | RHS- | C] () -- C:\Windows\System32\F928A0FA17.sys [2009.02.26 20:50:53 | 000,000,276 | ---- | C] () -- C:\Windows\System32\drivers\SamSfPa.dat [2009.02.19 16:18:34 | 000,632,956 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2009.02.19 16:18:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2009.02.19 16:18:34 | 000,130,450 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2009.02.19 16:18:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2009.02.19 07:31:30 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008.02.07 10:05:18 | 000,163,840 | ---- | C] () -- C:\Windows\System32\hppatusg01.dll [2007.06.05 14:20:32 | 000,177,704 | ---- | C] () -- C:\Windows\System32\PSIService.exe [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 000,438,232 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,599,604 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,107,082 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2005.04.06 17:27:14 | 000,237,568 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2005.04.06 17:24:40 | 001,216,512 | ---- | C] () -- C:\Windows\System32\xvidcore.dll ========== LOP Check ========== [2011.03.08 11:09:49 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\Audacity [2011.02.16 01:19:44 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\DVDVideoSoftIEHelpers [2011.02.13 16:15:06 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\EPSON [2011.05.10 22:54:20 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\Gidimo [2009.09.02 18:08:59 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\Marvell [2009.09.21 11:20:38 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\OpenOffice.org [2009.08.03 13:59:43 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\Opera [2010.06.13 22:04:30 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\Scribus [2009.06.30 18:12:24 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\Template [2011.02.24 23:04:24 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\uTorrent [2011.03.02 20:35:04 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\Windows Live Writer [2011.05.10 23:06:55 | 000,000,000 | -H-D | M] -- C:\Users\Taettchen\AppData\Roaming\Wuim [2011.06.27 22:54:32 | 000,032,528 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.06.27 22:00:50 | 000,000,430 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{31953012-17AF-49BF-8516-FE30368E878C}.job ========== Purity Check ========== ========== Files - Unicode (All) ========== [2010.03.30 18:16:35 | 000,007,962 | -H-- | M] ()(C:\Users\Taettchen\Documents\?????.odt) -- C:\Users\Taettchen\Documents\णसेन्.odt [2010.03.30 18:16:28 | 000,007,962 | -H-- | C] ()(C:\Users\Taettchen\Documents\?????.odt) -- C:\Users\Taettchen\Documents\णसेन्.odt < End of report > OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 27.06.2011 23:00:22 - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Taettchen\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,99 Gb Total Physical Memory | 1,89 Gb Available Physical Memory | 63,13% Memory free
6,19 Gb Paging File | 5,11 Gb Available in Paging File | 82,61% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 440,37 Gb Total Space | 143,26 Gb Free Space | 32,53% Space Free | Partition Type: NTFS
Drive D: | 25,38 Gb Total Space | 12,55 Gb Free Space | 49,46% Space Free | Partition Type: FAT32
Drive F: | 979,70 Mb Total Space | 978,67 Mb Free Space | 99,89% Space Free | Partition Type: FAT
Computer Name: WILMA | User Name: Taettchen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{26A5DBAD-5E4A-4B44-9B19-2BD6169E8944}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{C07C4097-EB2B-44FB-B24E-11C5B71BF84B}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{CEE72266-600B-4AE0-A9C1-A2BC1CD5E9D7}" = lport=2869 | protocol=6 | dir=in | app=system |
"{CFEAB678-DD21-4DBB-9D49-9905817C5B0E}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1BCB666B-E6E3-406A-BE94-2CE4CF962050}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{471EC9AE-95D7-49C2-B7CA-9C08724E6A1C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5E6D0C49-70E8-4417-84AC-74AD1D18F721}" = dir=in | app=c:\program files\homecinema\powerdirector\pdr.exe |
"{618AFA50-A545-41BC-8FFD-CAF36CD61C84}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{7773820C-3574-4D55-905B-C264A9D79B91}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{94904FE8-C4D1-4322-8770-E8C68D6681AC}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{B8276A8F-8B82-4686-B463-A4F63BE94BAF}" = dir=in | app=c:\program files\homecinema\powerdvd8\powerdvd8.exe |
"{EC201A21-D750-4768-AA51-55F12127C1AE}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"TCP Query User{51259E77-1724-4957-B17B-4B92EA03E587}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{715CEAB2-FD96-445F-922E-166DC72D83BF}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{F27880DB-4E28-4FB3-BE52-B0B26BEA03F1}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{C58F7650-5057-4D3F-8D01-F5282524AC32}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"UDP Query User{D17E02EC-4319-471B-B3C7-E75B941556AB}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{E6911C3C-9822-432C-A7F1-CF41E70D8160}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1E187923-04E5-4E1F-9BF2-40E32D93A1C4}" = HP Color LaserJet CP1210 Series Toolbox
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 12
"{26DDB12A-CB5E-4C0B-89AF-817CA0E59CC9}" = HP LaserJet Toolbox
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"{2EB81825-E9EE-44F4-8F51-1240C3898DC6}" = EPSON File Manager
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = USB Video Device
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3D78F2A2-C893-4ABD-B5FE-AD7011837755}" = EPSON Easy Photo Print
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{47948554-90C6-4AAC-8CFA-D23CE11C1031}" = Nero 8 Essentials
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{54360A73-B080-4A69-BFD4-53C190DD3AB0}" = HP Color LaserJet CP1210 Series
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7902E313-FF0F-4493-ACB1-A8147B78DCD0}" = HPSSupply
"{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93EA9C3E-BDFD-4309-A605-9B5BBC0CCEFD}" = Camera RAW Plug-In for EPSON Creativity Suite
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C09E3A4-850A-40B2-B94F-EBFB5349C238}" = hppusgCP1215
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A062A15F-9CAC-4B88-98DF-87628A0BD721}" = Corel MediaOne
"{A334F1BA-0A1D-4ED6-B4F9-4066157CA15D}" = DE
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A82D052A-0806-42DF-80CD-1730A1AC0ED3}" = MrvlUsgTracking
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D765F1CE-5AE5-4C47-B134-AE58AC474740}" = OpenOffice.org 3.1
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1BBBAC5-2857-4155-82A6-54492CE88620}" = Opera 9.64
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"7-Zip" = 7-Zip 4.65
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"ALDI Foto Service Nord D" = ALDI Foto Service Nord
"Aldi Nord Fotoservice_is1" = Aldi Nord Fotoservice
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.12 (Unicode)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Badaboom" = Badaboom 1.1.1.194
"conduitEngine" = Conduit Engine
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EPSON Scanner" = EPSON Scan
"EPSON Stylus CX7300_CX8300_DX7400_DX8400 Benutzerhandbuch" = EPSON Stylus CX7300_CX8300_DX7400_DX8400 Handbuch
"FFmpeg for Audacity on Windows_is1" = FFmpeg for Audacity on Windows
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free RAR Extract Frog" = Free RAR Extract Frog
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"Google Updater" = Google Updater
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"HP Color LaserJet CP1210 Series" = HP Color LaserJet CP1210 Series
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.14)" = Mozilla Firefox (3.6.14)
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"Rossmann Fotoservice_is1" = Rossmann Fotoservice
"Scribus 1.3.6" = Scribus 1.3.6
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.1
"WinLiveSuite" = Windows Live Essentials
"XviD" = XviD MPEG-4 Codec
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 27.06.2011 16:02:02 | Computer Name = Wilma | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung explorer.exe, Version 6.0.6002.18005, Zeitstempel
0x49e01da5, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18327, Zeitstempel 0x4cb73436,
Ausnahmecode 0xc0000374, Fehleroffset 0x000b06fc, Prozess-ID 0x125c, Anwendungsstartzeit
01cc3504e83039ab.
Error - 27.06.2011 16:24:28 | Computer Name = Wilma | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 27.06.2011 16:24:28 | Computer Name = Wilma | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 27.06.2011 16:25:20 | Computer Name = Wilma | Source = WinMgmt | ID = 10
Description =
Error - 27.06.2011 16:42:56 | Computer Name = Wilma | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 27.06.2011 16:42:56 | Computer Name = Wilma | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 27.06.2011 16:43:58 | Computer Name = Wilma | Source = WinMgmt | ID = 10
Description =
Error - 27.06.2011 16:57:41 | Computer Name = Wilma | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 27.06.2011 16:57:41 | Computer Name = Wilma | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 27.06.2011 16:58:13 | Computer Name = Wilma | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 30.04.2010 06:50:13 | Computer Name = Wilma | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.50 für die Netzwerkkarte mit der Netzwerkadresse
0022FA234C9C wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
Error - 01.05.2010 06:05:20 | Computer Name = Wilma | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.50 für die Netzwerkkarte mit der Netzwerkadresse
0022FA234C9C wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
Error - 02.05.2010 14:28:53 | Computer Name = Wilma | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.50 für die Netzwerkkarte mit der Netzwerkadresse
0022FA234C9C wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
Error - 03.05.2010 01:10:48 | Computer Name = Wilma | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.50 für die Netzwerkkarte mit der Netzwerkadresse
0022FA234C9C wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
Error - 03.05.2010 08:32:34 | Computer Name = Wilma | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.50 für die Netzwerkkarte mit der Netzwerkadresse
0022FA234C9C wurde durch den DHCP-Server 0.0.0.0 abgelehnt (der DHCP-Server hat
eine DHCPNACK-Meldung gesendet).
Error - 09.05.2010 06:14:41 | Computer Name = Wilma | Source = DCOM | ID = 10005
Description =
Error - 09.05.2010 06:14:41 | Computer Name = Wilma | Source = Service Control Manager | ID = 7009
Description =
Error - 09.05.2010 06:14:41 | Computer Name = Wilma | Source = Service Control Manager | ID = 7000
Description =
Error - 09.05.2010 19:29:31 | Computer Name = Wilma | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.178.22 für die Netzwerkkarte mit der Netzwerkadresse
0022FA234C9C wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
Error - 09.05.2010 19:34:47 | Computer Name = Wilma | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.50 für die Netzwerkkarte mit der Netzwerkadresse
0022FA234C9C wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
< End of report >
(habe aus Versehen doppelt gepostet, sorry) Gmer konnte ich nicht fertig kriegen, das System fährt sich immer runter, bevor GMER fertig ist. Habe es etwa 5-mal versucht, es fährt immer schneller runter... Jetzt findet Avira auch noch "TR/Kazy.22832". Bitte helft mir, leider kann ich GMER auch nach 2 Stunden sturem Wiederhochfahren nicht erfolgreich beenden... |
| Themen zu TR/Kazy.mekl.1 und Kazy3281 und Windows Recovery spinnt rum... |
| 7-zip, adblock, bildschirm, bildschirm schwarz, desktop verschwunden, google earth, install.exe, kein zugriff, malware.trace, ntdll.dll, nvlddmkm.sys, plug-in, rogue.installer.gen, sched.exe, spyware.passwords.xgen, start menu, tr/crypt.xpack.ge, tr/crypt.xpack.gen4, tr/kazy.mekl.1, tr/kazy.mekl.1 und kazy3281, trojan.agent, trojan.agent.gen, trojan.fakealert, trojan.fakeav, trojan.hiloti, verschwunden |
Baum-Darstellung