System Fix Virus auf Laptop mit Win7 64 Bit

joerg68

Hallo liebe Retter,

ich brauche eure Hilfe, da ich gestern auch auf einer Webseite offensichtlich den System Fix Virus eingefangen habe (Laptop Windows 7, 64bit-Version).
Ich habe bereits nach der Anweisung aus vorigen Posts mit OTL die beiden logfiles erstellt.

In meinem "Rettungsaktionsismus" habe ich noch den SpyHunter heruntergeladen, die Installation dann aber abgebrochen. Hoffe, dass ich damit nicht noch mehr Schaden angerichtet habe...

Vielen Dank im Voraus für Eure Unterstützung und Grüße
Jörg



Hoffe, dass ich weiter alles richtig gemacht habe...

Hier das OTL-logfile

OTL logfile created on: 01.12.2011 16:55:53 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\...\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,99 Gb Total Physical Memory | 2,48 Gb Available Physical Memory | 62,01% Memory free
7,99 Gb Paging File | 6,36 Gb Available in Paging File | 79,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 596,07 Gb Total Space | 534,79 Gb Free Space | 89,72% Space Free | Partition Type: NTFS

Computer Name: JOGISLAPTOP | User Name: ... | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\...\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\ProgramData\uXyiVzqQw0lBPl.exe ()
PRC - C:\ProgramData\vMttfGqwJXmmgo.exe ()
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)


========== Modules (No Company Name) ==========

MOD - C:\ProgramData\uXyiVzqQw0lBPl.exe ()
MOD - C:\ProgramData\vMttfGqwJXmmgo.exe ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (nmwcdnsux64) -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys (Nokia)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (AF9035HB) -- C:\Windows\SysNative\drivers\AF9035HB.sys (ITE Technologies )
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (netw5v64) Intel(R) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation)
DRV:64bit: - (k57nd60a) Broadcom NetLink (TM) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (BrSerIf) -- C:\Windows\SysNative\drivers\BrSerIf.sys (Brother Industries Ltd.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://web.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7C 90 B1 B5 19 1D CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)



O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [vMttfGqwJXmmgo.exe] C:\ProgramData\vMttfGqwJXmmgo.exe ()
O4 - Startup: C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{279A86CC-3D64-4194-90A1-D8C5988305EE}: DhcpNameServer = 192.168.178.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.12.01 16:47:16 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\...\Desktop\OTL.exe
[2011.11.30 21:44:10 | 000,000,000 | -H-D | C] -- C:\Users\...\AppData\Roaming\Malwarebytes
[2011.11.30 21:43:59 | 000,000,000 | -H-D | C] -- C:\ProgramData\Malwarebytes
[2011.11.30 21:43:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.11.30 21:43:56 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.11.30 21:43:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.11.30 21:42:59 | 009,852,544 | -H-- | C] (Malwarebytes Corporation ) -- C:\Users\...\Desktop\mbam-setup-1.51.2.1300.exe
[2011.11.30 17:40:32 | 000,706,976 | -H-- | C] (Enigma Software Group USA, LLC.) -- C:\Users\...\Desktop\SpyHunter-Installer.exe
[2011.11.30 17:16:33 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2011.11.30 17:15:51 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2011.11.30 16:10:42 | 000,000,000 | -H-D | C] -- C:\Users\...\AppData\Roaming\Avira
[2011.11.30 16:05:49 | 000,000,000 | -H-D | C] -- C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix
[2011.11.30 15:46:31 | 000,000,000 | -H-D | C] -- C:\Users\...\Neuer Ordner
[2011.11.29 19:03:52 | 000,000,000 | -H-D | C] -- C:\ProgramData\CyberLink
[2011.11.29 19:03:49 | 000,000,000 | -H-D | C] -- C:\Users\...\Documents\CyberLink
[2011.11.29 19:03:48 | 000,000,000 | -H-D | C] -- C:\Users\...\Documents\ShadowEditFiles
[2011.11.29 19:03:47 | 000,000,000 | -H-D | C] -- C:\Users\...\AppData\Roaming\CyberLink
[2011.11.29 17:50:36 | 000,000,000 | -H-D | C] -- C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDirector
[2011.11.29 17:46:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CyberLink
[2011.11.29 17:45:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\Temp
[2011.11.29 17:39:59 | 000,907,904 | ---- | C] (ITE Technologies ) -- C:\Windows\SysNative\drivers\AF9035HB.sys
[2011.11.29 17:39:59 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2011.11.29 17:39:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\dexatek
[2011.11.12 13:46:53 | 000,000,000 | -H-D | C] -- C:\Users\...\Desktop\jugend musiziert

========== Files - Modified Within 30 Days ==========

[2011.12.01 16:53:34 | 000,014,784 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.01 16:53:34 | 000,014,784 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.01 16:49:55 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.01 16:49:55 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.01 16:49:55 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.01 16:49:55 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.01 16:49:55 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.01 16:45:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.01 16:45:27 | 3217,178,624 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.01 11:23:24 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\...\Desktop\OTL.exe
[2011.11.30 23:07:36 | 000,303,104 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.11.30 21:43:01 | 009,852,544 | -H-- | M] (Malwarebytes Corporation ) -- C:\Users\...\Desktop\mbam-setup-1.51.2.1300.exe
[2011.11.30 17:36:30 | 000,706,976 | -H-- | M] (Enigma Software Group USA, LLC.) -- C:\Users\...\Desktop\SpyHunter-Installer.exe
[2011.11.30 17:23:18 | 000,175,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msclmd.dll
[2011.11.30 17:23:18 | 000,152,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msclmd.dll
[2011.11.30 16:05:51 | 000,000,312 | -H-- | M] () -- C:\ProgramData\~uXyiVzqQw0lBPl
[2011.11.30 16:05:50 | 000,000,216 | -H-- | M] () -- C:\ProgramData\~uXyiVzqQw0lBPlr
[2011.11.30 16:05:49 | 000,000,649 | -H-- | M] () -- C:\Users\...\Desktop\System Fix.lnk
[2011.11.30 16:05:45 | 000,000,336 | -H-- | M] () -- C:\ProgramData\uXyiVzqQw0lBPl
[2011.11.30 16:05:36 | 000,351,616 | -H-- | M] () -- C:\ProgramData\uXyiVzqQw0lBPl.exe
[2011.11.30 15:58:41 | 000,445,312 | -H-- | M] () -- C:\ProgramData\vMttfGqwJXmmgo.exe
[2011.11.30 15:44:21 | 000,002,051 | -H-- | M] () -- C:\Users\...\Desktop\CyberLink PowerDirector.lnk
[2011.11.23 16:56:24 | 001,607,090 | -H-- | M] () -- C:\Users\...\Desktop\Prosp-Akkordangeber-Stimmgabelhalter[1].pdf
[2011.11.11 18:14:05 | 000,318,610 | -H-- | M] () -- C:\Users\...\Desktop\Tagebuch_von_Giorgos_Papandreou.pdf

========== Files Created - No Company Name ==========

[2011.11.30 16:05:50 | 000,000,312 | -H-- | C] () -- C:\ProgramData\~uXyiVzqQw0lBPl
[2011.11.30 16:05:50 | 000,000,216 | -H-- | C] () -- C:\ProgramData\~uXyiVzqQw0lBPlr
[2011.11.30 16:05:49 | 000,000,649 | -H-- | C] () -- C:\Users\Jörg Mienhardt\Desktop\System Fix.lnk
[2011.11.30 16:05:45 | 000,000,336 | -H-- | C] () -- C:\ProgramData\uXyiVzqQw0lBPl
[2011.11.30 16:05:36 | 000,351,616 | -H-- | C] () -- C:\ProgramData\uXyiVzqQw0lBPl.exe
[2011.11.30 16:01:42 | 000,445,312 | -H-- | C] () -- C:\ProgramData\vMttfGqwJXmmgo.exe
[2011.11.29 17:50:36 | 000,002,051 | -H-- | C] () -- C:\Users\...\Desktop\CyberLink PowerDirector.lnk
[2011.11.23 16:56:23 | 001,607,090 | -H-- | C] () -- C:\Users\...\Desktop\Prosp-Akkordangeber-Stimmgabelhalter[1].pdf
[2011.11.11 18:13:54 | 000,318,610 | -H-- | C] () -- C:\Users\...\Desktop\Tagebuch_von_Giorgos_Papandreou.pdf
[2011.06.09 10:18:43 | 000,000,425 | -H-- | C] () -- C:\Windows\BRWMARK.INI
[2011.06.09 10:18:43 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.05.28 12:32:05 | 000,033,134 | -H-- | C] () -- C:\Users\...\AppData\Roaming\UserTile.png
[2011.05.28 10:17:40 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

< End of report >


und hier die Extras logfile

OTL Extras logfile created on: 01.12.2011 16:55:53 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\...\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,99 Gb Total Physical Memory | 2,48 Gb Available Physical Memory | 62,01% Memory free
7,99 Gb Paging File | 6,36 Gb Available in Paging File | 79,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 596,07 Gb Total Space | 534,79 Gb Free Space | 89,72% Space Free | Partition Type: NTFS

Computer Name: JOGISLAPTOP | User Name: ... | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{9C98CA38-4C1A-4AC8-B55C-169497C8826B}" = Apple Mobile Device Support
"{9CD0F7D3-B67F-4BF8-8784-D73AD229FF1E}" = iTunes
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"WinGimp-2.0_is1" = GIMP 2.6.8

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 26
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{65C3253A-E984-4769-BC33-CBC8F059C408}" = Video Grabber
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Deutsch
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"Picasa 3" = Picasa 3

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 21.11.2011 12:39:29 | Computer Name = Jogislaptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 19641

Error - 21.11.2011 12:39:29 | Computer Name = Jogislaptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 19641

Error - 29.11.2011 12:36:45 | Computer Name = Jogislaptop | Source = Application Hang | ID = 1002
Description = Programm Explorer.EXE, Version 6.1.7600.16768 kann nicht mehr unter
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
zu suchen. Prozess-ID: 998 Startzeit: 01ccaeac9e7f6df1 Endzeit: 30046 Anwendungspfad:
C:\Windows\Explorer.EXE Berichts-ID: 3589d090-1aa8-11e1-b679-002219fce816

Error - 29.11.2011 16:54:19 | Computer Name = Jogislaptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: PDR.exe, Version: 7.0.0.4020, Zeitstempel:
0x4bcdb072 Name des fehlerhaften Moduls: PDR.exe, Version: 7.0.0.4020, Zeitstempel:
0x4bcdb072 Ausnahmecode: 0xc0000005 Fehleroffset: 0x003bcb53 ID des fehlerhaften Prozesses:
0xe94 Startzeit der fehlerhaften Anwendung: 0x01ccaed8ed3e1810 Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\CyberLink\PowerDirector\PDR.exe Pfad des fehlerhaften
Moduls: C:\Program Files (x86)\CyberLink\PowerDirector\PDR.exe Berichtskennung:
4e1b96ed-1acc-11e1-aece-002219fce816

Error - 30.11.2011 10:56:03 | Computer Name = Jogislaptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: PDR.exe, Version: 7.0.0.4020, Zeitstempel:
0x4bcdb072 Name des fehlerhaften Moduls: PDR.exe, Version: 7.0.0.4020, Zeitstempel:
0x4bcdb072 Ausnahmecode: 0xc0000005 Fehleroffset: 0x003bcb3d ID des fehlerhaften Prozesses:
0x12b8 Startzeit der fehlerhaften Anwendung: 0x01ccaf6e880522f9 Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\CyberLink\PowerDirector\PDR.exe Pfad des fehlerhaften
Moduls: C:\Program Files (x86)\CyberLink\PowerDirector\PDR.exe Berichtskennung:
6c126cef-1b63-11e1-b917-002219fce816

Error - 30.11.2011 12:39:15 | Computer Name = Jogislaptop | Source = Microsoft-Windows-User Profiles Service | ID = 1508
Description = Die Registrierung konnte nicht geladen werden. Dieses Problem wird
oft durch zuwenig Arbeitsspeicher oder nicht ausreichende Sicherheitsberechtigungen
verursacht. Details - Der Prozess kann nicht auf die Datei zugreifen, da sie von
einem anderen Prozess verwendet wird. for C:\Users\...\AppData\Local\Microsoft\Windows\\UsrClass.dat

Error - 30.11.2011 12:39:15 | Computer Name = Jogislaptop | Source = Microsoft-Windows-User Profiles Service | ID = 1542
Description = Die Klassenregistrierungsdatei kann nicht geladen werden. DETAIL -
Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess
verwendet wird.

Error - 30.11.2011 12:39:30 | Computer Name = Jogislaptop | Source = ESENT | ID = 488
Description = WinMail (200) WindowsMail0: Versuch, Datei "C:\Users\...\AppData\Local\Microsoft\Windows
Mail\WindowsMail.pat" zu erstellen, ist mit Systemfehler 5 (0x00000005): "Zugriff
verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Erstellen von Dateien.

Error - 30.11.2011 12:39:30 | Computer Name = Jogislaptop | Source = ESENT | ID = 217
Description = WinMail (200) WindowsMail0: Fehler (-1032) während der Sicherung einer
Datenbank (Datei C:\Users\...\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore).
Die Datenbank kann nicht wiederhergestellt werden.

Error - 30.11.2011 12:39:30 | Computer Name = Jogislaptop | Source = ESENT | ID = 215
Description = WinMail (200) WindowsMail0: Die Sicherung wurde abgebrochen, weil
sie vom Client angehalten wurde, oder weil die Verbindung mit dem Client unterbrochen
wurde.

[ System Events ]
Error - 30.11.2011 17:29:25 | Computer Name = Jogislaptop | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 30.11.2011 17:32:01 | Computer Name = Jogislaptop | Source = BROWSER | ID = 8032
Description =

Error - 30.11.2011 18:06:19 | Computer Name = Jogislaptop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 30.11.2011 18:06:19 | Computer Name = Jogislaptop | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 30.11.2011 18:07:29 | Computer Name = Jogislaptop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 30.11.2011 18:07:29 | Computer Name = Jogislaptop | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 30.11.2011 18:10:07 | Computer Name = Jogislaptop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 30.11.2011 18:10:07 | Computer Name = Jogislaptop | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 01.12.2011 11:45:33 | Computer Name = Jogislaptop | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 01.12.2011 11:45:33 | Computer Name = Jogislaptop | Source = atikmdag | ID = 43029
Description = Display is not active


< End of report >