| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.12.2011, 16:23
| #1 |
 |  Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 Hallo, könnt ihr mir bitte helfen? Auch bei mir öffnen sich etliche Fenster, in denen "Failed to save all the components for the file System32. The file is corrupted or unreadable. This Error maybe caused by a Pc hardware Problem." steht. Desktop-Symbole, Ordner und auch Programme sind weg, so auch der Firefox und der IE. In einem ähnlichen Thread steht, man soll einen eigenen Thread eröffnen und dann evtl. auf angepasste Scripts warten. Das mache ich dann hiermit mal und hoffe wirklich auf Hilfe. |
|
01.12.2011, 16:26
| #2 |
| /// Malware-holic   | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 klappt das im abgesicherten modus mit netzwerk, da kommst du hin wenn du f8 bei system start drückst:
__________________Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
__________________ |
|
01.12.2011, 16:33
| #3 |
| /// Malware-holic | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 fals das nicht geht, nutze erst mal unhide im abges.modus
__________________http://filepony.de/download-unhide/ doppelklicken, dateien werden sichtbar
__________________ |
|
01.12.2011, 16:41
| #4 |
| | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 nein, auch im abgesicherten modus klappt internet nicht, muss jetzt mit stick arbeiten. und sorry, wenns länger dauert, ich bin nicht wirklich fit in solchen sachen.OTL Logfile: Code:
ATTFilter OTL logfile created on: 01.12.2011 16:32:36 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Angela\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,91 Gb Total Physical Memory | 2,91 Gb Available Physical Memory | 74,24% Memory free 7,82 Gb Paging File | 6,83 Gb Available in Paging File | 87,28% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 657,54 Gb Total Space | 617,81 Gb Free Space | 93,96% Space Free | Partition Type: NTFS Drive D: | 37,99 Gb Total Space | 13,84 Gb Free Space | 36,43% Space Free | Partition Type: NTFS Drive E: | 116,44 Gb Total Space | 39,42 Gb Free Space | 33,86% Space Free | Partition Type: NTFS Drive F: | 104,73 Gb Total Space | 66,17 Gb Free Space | 63,19% Space Free | Partition Type: NTFS Drive H: | 1,88 Gb Total Space | 0,27 Gb Free Space | 14,21% Space Free | Partition Type: FAT Computer Name: LÄPPI | User Name: Angela | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.12.01 15:56:40 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Angela\Desktop\OTL.exe ========== Modules (No Company Name) ========== ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.05.02 22:27:50 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV:64bit: - [2011.05.02 22:13:54 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS) SRV:64bit: - [2011.05.02 22:10:26 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV:64bit: - [2011.04.21 17:34:16 | 001,136,640 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3) SRV:64bit: - [2011.04.21 16:42:50 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr) SRV:64bit: - [2010.12.17 15:46:34 | 000,198,784 | ---- | M] (Conexant Systems Inc.) [Auto | Stopped] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg) SRV:64bit: - [2010.09.23 02:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2011.09.05 09:04:54 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.07.21 11:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.04.30 08:32:54 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R) SRV - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.02.22 21:20:21 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R) SRV - [2011.02.22 21:20:17 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R) SRV - [2011.02.11 20:40:00 | 000,997,712 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service) SRV - [2011.02.11 20:39:58 | 001,304,912 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe -- (Bluetooth Media Service) SRV - [2011.02.11 20:39:54 | 000,907,600 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe -- (Bluetooth Device Monitor) SRV - [2010.11.03 18:31:44 | 000,558,592 | ---- | M] (Hauppauge Computer Works) [Auto | Stopped] -- C:\PROGRA~2\WinTV\TVServer\HAUPPA~1.EXE -- (HauppaugeTVServer) SRV - [2010.10.07 01:46:42 | 000,159,752 | R--- | M] () [Auto | Stopped] -- C:\Program Files (x86)\PHotkey\GFNEXSrv.exe -- (GFNEXSrv) SRV - [2010.03.18 21:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.03.10 13:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) [Auto | Stopped] -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2) SRV - [2009.12.18 23:40:48 | 000,104,968 | R--- | M] () [Auto | Stopped] -- C:\Program Files (x86)\PHotkey\ASLDRSrv.exe -- (ASLDRService) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.08.01 14:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64) DRV:64bit: - [2011.07.21 11:11:10 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.07.21 11:11:09 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.05.17 17:27:52 | 000,025,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus) DRV:64bit: - [2011.05.17 17:27:50 | 000,034,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible) DRV:64bit: - [2011.05.01 22:33:06 | 008,593,920 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R) DRV:64bit: - [2011.04.26 19:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2011.04.21 17:09:26 | 000,294,912 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP) Intel(R) Centrino(R) DRV:64bit: - [2011.04.21 17:09:26 | 000,294,912 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL) Intel(R) Centrino(R) DRV:64bit: - [2011.04.15 10:08:26 | 012,228,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2011.04.15 00:16:08 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd) DRV:64bit: - [2011.04.13 17:30:54 | 000,207,872 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2011.04.13 17:30:50 | 000,087,552 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.03.10 16:01:40 | 001,581,184 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2011.01.24 10:24:52 | 000,058,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btmaux.sys -- (btmaux) DRV:64bit: - [2011.01.24 10:22:48 | 000,059,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iBtFltCoex.sys -- (iBtFltCoex) DRV:64bit: - [2011.01.24 09:56:06 | 000,274,944 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btmhsf.sys -- (btmhsf) DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2010.10.20 01:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R) DRV:64bit: - [2010.10.15 00:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R) DRV:64bit: - [2010.09.27 10:32:28 | 000,632,704 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw10bda.sys -- (hcw10bda) DRV:64bit: - [2010.09.23 21:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd) DRV:64bit: - [2010.08.24 17:55:44 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:64bit: - [2010.05.10 08:29:16 | 000,046,080 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\hcw10cir.sys -- (hcw10cir) DRV:64bit: - [2010.01.27 03:09:02 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (npf) DRV:64bit: - [2010.01.22 10:26:50 | 000,305,200 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2009.10.23 16:26:14 | 000,046,592 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2011.09.03 10:43:36 | 000,001,722 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysWow64\NULL -- (Null) DRV - [2009.09.11 22:11:46 | 000,014,344 | R--- | M] (PEGATRON) [Kernel | Auto | Stopped] -- C:\Program Files (x86)\PHotkey\PEGAGFN.sys -- (PEGAGFN) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.bwin.com/de/sportsbook.aspx IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://my.ebay.de/ws/eBayISAPI.dll?MyEbayBeta&CurrentPage=MyeBayNextSelling&ssPageName=STRK:ME:LNLK:MESEX" FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.09 17:11:31 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.09.28 05:39:50 | 000,000,000 | ---D | M] [2011.09.02 05:46:24 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Angela\AppData\Roaming\mozilla\Extensions [2011.12.01 15:37:12 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Angela\AppData\Roaming\mozilla\Firefox\Profiles\xhtjj79a.default\extensions [2011.12.01 15:37:12 | 000,000,000 | -H-D | M] (BitDefender QuickScan) -- C:\Users\Angela\AppData\Roaming\mozilla\Firefox\Profiles\xhtjj79a.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2011.11.03 11:27:59 | 000,000,933 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\11-suche.xml [2011.10.30 10:37:20 | 000,002,399 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\askcom.xml [2011.11.03 11:27:59 | 000,002,419 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\englische-ergebnisse.xml [2011.09.02 18:07:03 | 000,010,525 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\gmx-suche.xml [2011.11.03 11:27:59 | 000,002,457 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\lastminute.xml [2011.11.03 11:27:59 | 000,005,508 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\webde-suche.xml [2011.11.09 17:11:34 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.09.27 21:37:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} () (No name found) -- C:\USERS\ANGELA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XHTJJ79A.DEFAULT\EXTENSIONS\TOOLBAR@GMX.NET.XPI [2011.11.09 17:11:30 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.07.19 04:05:25 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.03.08 11:24:04 | 000,103,168 | ---- | M] (Midasplayer Ltd) -- C:\Program Files (x86)\mozilla firefox\plugins\npmidas.dll [2011.09.10 08:20:16 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.09.10 08:20:16 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.09.10 08:20:16 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.09.10 08:20:16 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.09.10 08:20:16 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.09.10 08:20:16 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (GMX Toolbar BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O2 - BHO: (GMX Toolbar BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O3:64bit: - HKLM\..\Toolbar: (GMX Toolbar BETA 1) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O3 - HKLM\..\Toolbar: (GMX Toolbar BETA 1) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3:64bit: - HKCU\..\Toolbar\WebBrowser: (GMX Toolbar BETA 1) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O3 - HKCU\..\Toolbar\WebBrowser: (GMX Toolbar BETA 1) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKCU..\Run: [NfWOkoyrvDaoRQH.exe] C:\ProgramData\NfWOkoyrvDaoRQH.exe () O4 - Startup: C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A Note.lnk = C:\Program Files (x86)\A Note\A Note.exe (A Note) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8068FE7C-7296-400B-9019-82B7F3A7BDB2}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F1AEB345-498B-4D3D-A2B8-DB5469020C02}: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\gmx {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\gmx {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.12.01 16:30:24 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Angela\Desktop\OTL.exe [2011.12.01 15:37:28 | 000,000,000 | -H-D | C] -- C:\Users\Angela\AppData\Roaming\QuickScan [2011.12.01 15:13:19 | 000,000,000 | -H-D | C] -- C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix [2011.11.19 17:54:26 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\Dichtung-einbauen-Dateien [2011.11.19 10:35:43 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\fensterdichtung-t22388-Dateien [2011.11.17 18:49:12 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\DisplayProductInformation-SearchDetail-Dateien [2011.11.16 14:14:01 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\Schokokekse mit Karamell _ Pi mal Butter-Dateien [2011.11.12 10:32:00 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\111112_wolfsabend-Dateien [2011.11.12 09:27:43 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed [2011.11.10 10:18:42 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\Fotos November [2011.11.10 08:55:45 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\150678567191-Dateien [2011.11.04 19:29:11 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\13234098-Rueschenschal-in-schwarz-Dateien [2011.11.01 19:02:40 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\Steuerkram [2011.11.01 19:02:30 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\Mietkram [2011.10.30 10:33:45 | 003,623,592 | ---- | C] (Ask) -- C:\Program Files (x86)\Common Files\ApnToolbarInstaller.exe [2011.10.30 10:33:45 | 000,143,240 | ---- | C] (Ask.com) -- C:\Program Files (x86)\Common Files\ApnStub.exe [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.12.01 16:28:54 | 000,067,584 | -H-- | M] () -- C:\Windows\bootstat.dat [2011.12.01 16:28:52 | 3151,327,232 | -HS- | M] () -- C:\hiberfil.sys [2011.12.01 15:56:40 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Angela\Desktop\OTL.exe [2011.12.01 15:50:29 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.12.01 15:50:29 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.12.01 15:49:16 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.12.01 15:49:16 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.12.01 15:49:16 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.12.01 15:49:16 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.12.01 15:49:16 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.12.01 15:18:18 | 000,000,456 | -H-- | M] () -- C:\ProgramData\jTsDdw9NssHWjx [2011.12.01 15:16:41 | 000,000,312 | -H-- | M] () -- C:\ProgramData\~jTsDdw9NssHWjx [2011.12.01 15:16:41 | 000,000,216 | -H-- | M] () -- C:\ProgramData\~jTsDdw9NssHWjxr [2011.12.01 15:13:19 | 000,000,653 | -H-- | M] () -- C:\Users\Angela\Desktop\System Fix.lnk [2011.12.01 15:12:32 | 000,370,688 | -H-- | M] () -- C:\ProgramData\jTsDdw9NssHWjx.exe [2011.12.01 15:05:47 | 000,464,896 | -H-- | M] () -- C:\ProgramData\NfWOkoyrvDaoRQH.exe [2011.11.30 22:13:24 | 000,033,923 | -H-- | M] () -- C:\Users\Angela\Desktop\monatl. Überweisungen.odt [2011.11.25 19:30:03 | 000,020,676 | -H-- | M] () -- C:\Users\Angela\Desktop\komplette liste erstellen.odt [2011.11.20 18:39:39 | 000,010,635 | -H-- | M] () -- C:\Users\Angela\Desktop\zinn.odt [2011.11.19 17:54:26 | 000,009,275 | -H-- | M] () -- C:\Users\Angela\Desktop\Dichtung-einbauen.html [2011.11.19 10:35:43 | 000,072,045 | -H-- | M] () -- C:\Users\Angela\Desktop\fensterdichtung-t22388.html [2011.11.17 18:49:12 | 000,260,637 | -H-- | M] () -- C:\Users\Angela\Desktop\DisplayProductInformation-SearchDetail.htm [2011.11.16 14:14:02 | 000,071,086 | -H-- | M] () -- C:\Users\Angela\Desktop\Schokokekse mit Karamell _ Pi mal Butter.htm [2011.11.12 10:32:01 | 000,039,398 | -H-- | M] () -- C:\Users\Angela\Desktop\111112_wolfsabend.html [2011.11.12 09:27:46 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2011.11.11 18:11:50 | 000,030,040 | -H-- | M] () -- C:\Users\Angela\Desktop\November.odt [2011.11.10 08:55:46 | 000,109,425 | -H-- | M] () -- C:\Users\Angela\Desktop\150678567191.htm [2011.11.09 07:44:12 | 000,406,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.11.07 16:48:53 | 000,019,031 | -H-- | M] () -- C:\Users\Angela\Desktop\Bücherliste.odt [2011.11.07 07:53:26 | 000,849,359 | -H-- | M] () -- C:\Users\Angela\Desktop\maxx.jpg [2011.11.06 15:24:38 | 000,026,373 | -H-- | M] () -- C:\Users\Angela\Desktop\ordnungsamt.odt [2011.11.04 19:29:11 | 000,128,519 | -H-- | M] () -- C:\Users\Angela\Desktop\13234098-Rueschenschal-in-schwarz.htm [2011.11.04 17:42:02 | 000,016,818 | -H-- | M] () -- C:\Users\Angela\Desktop\komplette liste erstellen - Rest.odt [2011.11.04 17:17:45 | 280,909,672 | -H-- | M] () -- C:\Users\Angela\Desktop\Standard_20111104_171645.zip [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.12.01 15:13:20 | 000,000,216 | -H-- | C] () -- C:\ProgramData\~jTsDdw9NssHWjxr [2011.12.01 15:13:19 | 000,000,653 | -H-- | C] () -- C:\Users\Angela\Desktop\System Fix.lnk [2011.12.01 15:13:19 | 000,000,312 | -H-- | C] () -- C:\ProgramData\~jTsDdw9NssHWjx [2011.12.01 15:13:12 | 000,000,456 | -H-- | C] () -- C:\ProgramData\jTsDdw9NssHWjx [2011.12.01 15:12:32 | 000,370,688 | -H-- | C] () -- C:\ProgramData\jTsDdw9NssHWjx.exe [2011.12.01 15:09:22 | 000,464,896 | -H-- | C] () -- C:\ProgramData\NfWOkoyrvDaoRQH.exe [2011.11.20 18:39:35 | 000,010,635 | -H-- | C] () -- C:\Users\Angela\Desktop\zinn.odt [2011.11.19 17:54:26 | 000,009,275 | -H-- | C] () -- C:\Users\Angela\Desktop\Dichtung-einbauen.html [2011.11.19 10:35:43 | 000,072,045 | -H-- | C] () -- C:\Users\Angela\Desktop\fensterdichtung-t22388.html [2011.11.17 18:49:11 | 000,260,637 | -H-- | C] () -- C:\Users\Angela\Desktop\DisplayProductInformation-SearchDetail.htm [2011.11.16 14:14:01 | 000,071,086 | -H-- | C] () -- C:\Users\Angela\Desktop\Schokokekse mit Karamell _ Pi mal Butter.htm [2011.11.12 10:32:00 | 000,039,398 | -H-- | C] () -- C:\Users\Angela\Desktop\111112_wolfsabend.html [2011.11.10 08:55:44 | 000,109,425 | -H-- | C] () -- C:\Users\Angela\Desktop\150678567191.htm [2011.11.07 07:53:26 | 000,849,359 | -H-- | C] () -- C:\Users\Angela\Desktop\maxx.jpg [2011.11.06 11:54:27 | 000,026,373 | -H-- | C] () -- C:\Users\Angela\Desktop\ordnungsamt.odt [2011.11.05 09:27:02 | 000,019,031 | -H-- | C] () -- C:\Users\Angela\Desktop\Bücherliste.odt [2011.11.04 19:29:10 | 000,128,519 | -H-- | C] () -- C:\Users\Angela\Desktop\13234098-Rueschenschal-in-schwarz.htm [2011.11.04 17:17:08 | 280,909,672 | -H-- | C] () -- C:\Users\Angela\Desktop\Standard_20111104_171645.zip [2011.11.01 19:10:56 | 000,030,040 | -H-- | C] () -- C:\Users\Angela\Desktop\November.odt [2011.10.30 10:33:46 | 000,444,283 | ---- | C] () -- C:\Program Files (x86)\Common Files\WinPcapNmap.exe [2011.09.27 17:43:41 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI [2011.09.27 17:43:41 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI [2011.09.27 17:43:25 | 000,037,574 | ---- | C] () -- C:\Windows\Irremote.ini [2011.09.27 17:43:14 | 000,142,337 | ---- | C] () -- C:\Windows\SysWow64\Wait.exe [2011.09.27 17:42:34 | 000,005,110 | ---- | C] () -- C:\Windows\HCWPNP.INI [2011.09.02 19:23:54 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2011.09.02 19:23:53 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2011.09.02 19:23:53 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2011.09.02 19:23:52 | 000,074,752 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2011.09.02 17:16:39 | 000,032,608 | ---- | C] () -- C:\Windows\king-uninstall.exe [2011.06.08 20:34:59 | 013,359,616 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll [2011.06.08 20:34:59 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2011.05.27 02:14:01 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2011.05.27 02:14:00 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2011.05.27 02:14:00 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin [2010.01.27 03:09:02 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll [2009.07.14 06:38:36 | 000,067,584 | -H-- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat < End of report > |
|
01.12.2011, 16:47
| #5 |
| | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 sorry, hab das mit dem unhide erst hinterher gesehen, mache ich gerade. soll ich im abgesicherten modus bleiben? |
|
01.12.2011, 16:53
| #6 |
| /// Malware-holic | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 hi wir arbeiten hier nicht auf geschwindigkeit, nimm dir die zeit die du benötigst. den fix kannst du erst mal im abgesicherten modus machen, danach kannst du dann wieder in den normalen modus starten achtung! dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
[2011.10.30 10:37:20 | 000,002,399 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\askcom.xml
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found
O4 - HKCU..\Run: [NfWOkoyrvDaoRQH.exe] C:\ProgramData\NfWOkoyrvDaoRQH.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
File not found
O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
File not found
O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
[2011.12.01 15:13:19 | 000,000,000 | -H-D | C] -- C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix
[2011.12.01 15:18:18 | 000,000,456 | -H-- | M] () -- C:\ProgramData\jTsDdw9NssHWjx
[2011.12.01 15:16:41 | 000,000,312 | -H-- | M] () -- C:\ProgramData\~jTsDdw9NssHWjx
[2011.12.01 15:16:41 | 000,000,216 | -H-- | M] () -- C:\ProgramData\~jTsDdw9NssHWjxr
[2011.12.01 15:13:19 | 000,000,653 | -H-- | M] () -- C:\Users\Angela\Desktop\System Fix.lnk
[2011.12.01 15:12:32 | 000,370,688 | -H-- | M] () -- C:\ProgramData\jTsDdw9NssHWjx.exe
[2011.12.01 15:05:47 | 000,464,896 | -H-- | M] () -- C:\ProgramData\NfWOkoyrvDaoRQH.exe
[2011.12.01 15:12:32 | 000,370,688 | -H-- | C] () -- C:\ProgramData\jTsDdw9NssHWjx.exe
:Files
C:\ProgramData\NfWOkoyrvDaoRQH.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. neustart in den normalen modus sollte funktionieren. rechtsklick auf den desktop, eigenschaften, bild aussuchen. lade unhide: http://www.trojaner-board.de/54791-a...ner-board.html
__________________ --> Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 |
|
01.12.2011, 17:15
| #7 |
| | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 All processes killed ========== OTL ========== Prefs.js: "Ask.com" removed from browser.search.defaultengine Prefs.js: "Ask.com" removed from browser.search.defaultenginename Prefs.js: "Ask.com" removed from browser.search.order.1 C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\askcom.xml moved successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\NfWOkoyrvDaoRQH.exe deleted successfully. C:\ProgramData\NfWOkoyrvDaoRQH.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges not found. 64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully. File res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ not found. File res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found. File hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found. File hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found. 64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found. C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix folder moved successfully. C:\ProgramData\jTsDdw9NssHWjx moved successfully. C:\ProgramData\~jTsDdw9NssHWjx moved successfully. C:\ProgramData\~jTsDdw9NssHWjxr moved successfully. C:\Users\Angela\Desktop\System Fix.lnk moved successfully. C:\ProgramData\jTsDdw9NssHWjx.exe moved successfully. File C:\ProgramData\NfWOkoyrvDaoRQH.exe not found. File C:\ProgramData\jTsDdw9NssHWjx.exe not found. ========== FILES ========== File\Folder C:\ProgramData\NfWOkoyrvDaoRQH.exe not found. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Angela ->Flash cache emptied: 79646 bytes User: Default ->Flash cache emptied: 56468 bytes User: Default User ->Flash cache emptied: 0 bytes User: Public Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: All Users User: Angela ->Temp folder emptied: 45578940 bytes ->Temporary Internet Files folder emptied: 223377287 bytes ->Java cache emptied: 38772 bytes ->FireFox cache emptied: 47078996 bytes ->Flash cache emptied: 0 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 99053919 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes RecycleBin emptied: 1122965844 bytes Total Files Cleaned = 1.467,00 mb OTL by OldTimer - Version 3.2.31.0 log created on 12012011_170328 Files\Folders moved on Reboot... C:\Users\Angela\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. Registry entries deleted on Reboot... bei den moved files komme ich nicht weiter, wenn ich rechtsklicke, finde ich nix mit zip oder rar hinzufügen |
|
01.12.2011, 17:19
| #8 |
| /// Malware-holic | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 ok http://filepony.de/download-7-zip/ lade dir mal 7zip, instaliere es. dann bitte rechtsklick auf moved files, 7zip menü aufklappen, hinzufügen zu movedfiles.7zip wählen und dann das archiv wie beschrieben hochladen
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
01.12.2011, 17:36
| #9 |
| | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 och, ich krieg das nich hin. 7zip installiert, aber ich kann bei 7zip nix öffnen, weil zugriff verweigert. |
|
01.12.2011, 17:37
| #10 |
| /// Malware-holic | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 du kannst keinen rechtsklick in _otl auf moved files machen und zum archiv hinzufügen wählen? versuchs mal nach neustart
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
01.12.2011, 17:40
| #11 |
| | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 nein, gibt nix mit hinzufügen. hätte ich nach7zip-installation erst neustarten sollen? |
|
01.12.2011, 17:42
| #12 |
| /// Malware-holic | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 versuchs mal. um genau zu sein, rechtsklick, 7zip menü auswählen, aufklappen, hinzu fügen zu au moved files..." auswählen
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
01.12.2011, 17:52
| #13 |
| | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 nein, bei rechtsklick kommt nix und wenn ich in 7zip die datei suchen will, heisst es Zugriff verweigert. |
|
01.12.2011, 17:56
| #14 |
| /// Malware-holic | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 ok dann anders. lade winrar zieller ... Ergebnisdetails WinRAR Download und Support Deutschland | winrar.de - offizieller WinRAR-Distributor instalieren, evtl. neustarten und dann über rechtsklick zu moved files.rar hinzufügen
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
01.12.2011, 18:10
| #15 |
| | Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 mit rar hats geklappt, habs hochgeladen. |
|
| Themen zu Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 |
| corrupted, error, etliche, failed, fenster, file, firefox, hardware, hoffe, ordner, probleme, programme, scripts, system, system32, the file is corrupted, this, thread, win, win7, wirklich, öffnen |
Linear-Darstellung
