| |
| |||||||
Log-Analyse und Auswertung: Windows - Delayed Write FailedWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
24.12.2011, 22:34
| #1 |
| |  Windows - Delayed Write Failed hallo! ich habe das gleiche Problem wie "Tim!182" (06.11.2011), welches er so beschreibt: "Ich habe seit gestern Abend einen Virus auf meinem Computer, der Desktop komplett schwarz gemacht, alle Ordner die auf dem Desktop waren versteckt oder entfernt hat und die auch die Dateien der Schnellstartleiste versteckt hat. Wenn ich meinen Rechner starte kommt unzählige male diese Fehlermeldung Windows - Delayed Write Failed .. Failed to save all the components for the file \\System32\\00004509. The file is corrupted or unreadable. This may be caused by a PC hardware problem. Die Zahl hinter "\\System32\\" variiert bei den Fehlermeldungen immer. Ordner lassen sich nicht oder nur langsam öffnen und dann werden sie meistens als Leer angezeigt. bitte um Hilfe." Hab zunächst Malwarebytes scannen lassen, der dann auch fündig wurde und diverse Trojaner gelöscht hat. Seitdem sind die Fehlermeldungen weg, der Desktop ist jedoch immer noch schwarz (leer) und die Daten sind auch nicht wieder aufgetaucht. Hier der OTL-Log: OTL logfile created on: 24.12.2011 22:26:57 - Run 2 OTL by OldTimer - Version 3.2.31.0 Folder = c:\Users\HP\Downloads Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation Internet Explorer (Version = 7.0.6000.17037) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,47 Gb Available Physical Memory | 48,96% Memory free 6,17 Gb Paging File | 4,11 Gb Available in Paging File | 66,65% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 221,38 Gb Total Space | 104,99 Gb Free Space | 47,43% Space Free | Partition Type: NTFS Drive D: | 11,51 Gb Total Space | 10,87 Gb Free Space | 94,52% Space Free | Partition Type: NTFS Drive F: | 243,88 Mb Total Space | 210,03 Mb Free Space | 86,12% Space Free | Partition Type: FAT Computer Name: PHILIPP | User Name: HP | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.12.24 15:48:09 | 000,584,192 | ---- | M] (OldTimer Tools) -- c:\Users\HP\Downloads\OTL.exe PRC - [2011.12.09 01:44:22 | 004,616,064 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe PRC - [2011.12.01 13:34:46 | 001,469,248 | ---- | M] (Piriform Ltd) -- C:\Program Files\Recuva\Recuva.exe PRC - [2011.11.26 16:22:32 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2011.11.22 21:47:50 | 000,610,304 | -H-- | M] (naveta) -- C:\Users\HP\AppData\Local\qcvgbmw.exe PRC - [2011.08.31 17:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011.08.12 00:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe PRC - [2011.05.20 15:56:18 | 000,724,536 | ---- | M] (Nokia) -- C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe PRC - [2011.03.31 15:48:36 | 001,540,096 | ---- | M] (Nokia) -- C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe PRC - [2011.03.31 13:43:48 | 000,156,672 | ---- | M] (Nokia) -- C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe PRC - [2011.03.31 13:32:14 | 000,134,144 | ---- | M] (Nokia) -- C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe PRC - [2011.03.21 22:10:00 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe PRC - [2011.03.21 12:21:24 | 000,632,832 | ---- | M] (Nokia) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe PRC - [2011.03.21 12:19:36 | 000,120,832 | ---- | M] (Nokia) -- C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe PRC - [2011.02.09 15:55:43 | 000,132,624 | ---- | M] (PolderbitS Software) -- C:\Program Files\PolderbitS\Recorder\Driver\PBDriverMonitor_de.exe PRC - [2009.07.01 17:37:06 | 000,037,888 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe PRC - [2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.10.26 17:02:50 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe PRC - [2008.10.26 17:02:48 | 000,151,297 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe PRC - [2008.07.18 08:50:06 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe PRC - [2008.03.13 19:09:10 | 002,060,288 | ---- | M] (Vodafone) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe PRC - [2008.03.13 19:08:58 | 000,024,576 | ---- | M] (Vodafone) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe PRC - [2007.11.05 16:21:48 | 000,431,104 | -H-- | M] (Hauppauge Computer Works) -- C:\Program Files\WinTV\EPG Services\System\EPGService.exe PRC - [2007.10.26 16:56:05 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe PRC - [2007.09.15 09:29:10 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPStart.exe PRC - [2007.08.01 02:26:54 | 000,675,840 | -H-- | M] (Hauppauge Inc.) -- C:\Program Files\WinTV\EPG Services\System\EPGClient.exe PRC - [2007.05.16 14:17:06 | 000,978,944 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe PRC - [2007.03.29 15:41:26 | 000,222,128 | ---- | M] (Macrovision Corporation) -- C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe PRC - [2006.11.02 10:44:59 | 000,068,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2005.01.14 15:32:38 | 000,053,248 | ---- | M] () -- C:\Windows\System32\PAStiSvc.exe PRC - [2004.05.27 17:50:30 | 000,286,720 | ---- | M] () -- C:\Program Files\TCM\TCM Mouse Only\MouseDrv.exe ========== Modules (No Company Name) ========== MOD - [2011.12.24 20:47:19 | 000,052,736 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll MOD - [2011.12.24 20:47:18 | 000,063,488 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll MOD - [2011.12.24 16:44:57 | 000,117,760 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL MOD - [2011.12.24 16:44:57 | 000,052,224 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll MOD - [2011.11.26 16:22:31 | 001,989,592 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll MOD - [2011.05.20 15:54:16 | 010,837,504 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\QtWebKit4.dll MOD - [2011.05.20 15:54:16 | 008,166,912 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\QtGui4.dll MOD - [2011.05.20 15:54:16 | 002,551,296 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\QtXmlPatterns4.dll MOD - [2011.05.20 15:54:16 | 002,282,496 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\QtCore4.dll MOD - [2011.05.20 15:54:16 | 002,246,656 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\QtDeclarative4.dll MOD - [2011.05.20 15:54:16 | 001,288,192 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\QtScript4.dll MOD - [2011.05.20 15:54:16 | 000,913,920 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\QtNetwork4.dll MOD - [2011.05.20 15:54:16 | 000,676,864 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\QtOpenGL4.dll MOD - [2011.05.20 15:54:16 | 000,340,480 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\QtXml4.dll MOD - [2011.05.20 15:54:16 | 000,266,752 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\phonon4.dll MOD - [2011.05.20 15:54:16 | 000,196,608 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\Imageformats\qjpeg4.dll MOD - [2011.05.20 15:54:16 | 000,190,464 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\QtSql4.dll MOD - [2011.05.20 15:54:16 | 000,026,624 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\Imageformats\qgif4.dll MOD - [2011.05.20 15:30:06 | 000,508,416 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\QtMultimediaKit1.dll MOD - [2011.05.20 15:30:04 | 000,109,568 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\mediaservice\dsengine.dll MOD - [2011.05.20 15:29:34 | 000,924,672 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\Maps Service API.dll MOD - [2011.05.20 15:29:18 | 000,422,800 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\ssoengine.dll MOD - [2011.05.20 15:29:18 | 000,387,976 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\OviShareLib.dll MOD - [2011.05.20 15:29:18 | 000,060,816 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\securestorage.dll MOD - [2011.05.20 15:28:18 | 000,687,616 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\CommonUpdateChecker.dll MOD - [2011.03.21 22:10:36 | 000,096,112 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2011.03.21 22:10:00 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe MOD - [2011.02.15 12:25:29 | 006,053,536 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll MOD - [2009.10.15 13:25:05 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\22e348e7fee20fcb2013d3dfe016ae8e\System.Management.ni.dll MOD - [2009.10.15 13:25:04 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\ae77b2b91367f11d340cf3bf2428af59\System.ServiceProcess.ni.dll MOD - [2009.10.15 13:24:58 | 000,627,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ae383808b3f5ee9287358378f9a2cad3\System.EnterpriseServices.ni.dll MOD - [2009.10.15 13:24:58 | 000,280,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ae383808b3f5ee9287358378f9a2cad3\System.EnterpriseServices.Wrapper.dll MOD - [2009.10.15 13:24:57 | 000,627,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\b98385fbfc00adacf4fd7896ba064032\System.Transactions.ni.dll MOD - [2009.10.15 13:24:46 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\23281812ddf7a1fab881b5322e577ac4\System.Runtime.Remoting.ni.dll MOD - [2009.10.15 13:24:38 | 000,676,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\a0fa9d672445167efeefa37ebc1fbf23\System.Security.ni.dll MOD - [2009.10.15 13:24:34 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e6001d416f7c468334934a2c6a41c631\System.Configuration.ni.dll MOD - [2009.10.15 13:23:15 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\7208ffa39630e9b923331f9df0947a12\System.Xml.ni.dll MOD - [2009.10.15 13:22:55 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1941d7639299344ae28fb6b23da65247\System.Windows.Forms.ni.dll MOD - [2009.10.15 13:22:45 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6312464f64727a2a50d5ce3fd73ad1bb\System.Drawing.ni.dll MOD - [2009.10.15 13:22:30 | 006,616,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\813556b5a2722045b0ea14467fd00227\System.Data.ni.dll MOD - [2009.10.15 13:22:16 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a122c56b60812fb5cbc2e941d4875a87\PresentationFramework.Aero.ni.dll MOD - [2009.10.15 13:22:14 | 014,327,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\29eb51a21ce62ed759b162307bd65e32\PresentationFramework.ni.dll MOD - [2009.10.15 13:21:47 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\dc8dccca85718096c895b74094e09e5a\PresentationCore.ni.dll MOD - [2009.10.15 13:21:31 | 003,313,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\c049bc39cb33f7459936a689484285d6\WindowsBase.ni.dll MOD - [2009.10.15 13:21:26 | 007,868,416 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\52e1ea3c7491e05cda766d7b3ce3d559\System.ni.dll MOD - [2009.10.15 13:20:56 | 011,486,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\17f572b09facdc5fda9431558eb7a26e\mscorlib.ni.dll MOD - [2009.07.01 17:37:06 | 000,037,888 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe MOD - [2008.07.27 19:19:30 | 000,113,664 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll MOD - [2008.07.27 19:00:27 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll MOD - [2008.07.27 19:00:26 | 002,933,248 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll MOD - [2008.07.27 19:00:17 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll MOD - [2008.07.27 19:00:17 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2008.07.01 00:03:50 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll MOD - [2007.10.01 15:11:02 | 000,036,864 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Content.XmlSerializers.dll MOD - [2007.10.01 15:11:00 | 000,007,168 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll MOD - [2007.10.01 15:10:50 | 000,057,344 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll MOD - [2007.10.01 15:10:28 | 000,036,864 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll MOD - [2007.10.01 15:10:20 | 000,040,960 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll MOD - [2007.10.01 15:10:20 | 000,028,672 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll MOD - [2007.10.01 15:10:20 | 000,006,144 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll MOD - [2007.09.30 19:34:52 | 000,345,384 | ---- | M] () -- C:\Program Files\Hp\QuickPlay\Kernel\TV\CLTinyDB.dll MOD - [2007.09.30 19:34:42 | 000,255,384 | ---- | M] () -- C:\Program Files\Hp\QuickPlay\Kernel\TV\CLCapEngine.dll MOD - [2007.09.30 19:34:42 | 000,120,208 | ---- | M] () -- C:\Program Files\Hp\QuickPlay\Kernel\TV\CLSchMgr.dll MOD - [2007.09.30 19:34:42 | 000,038,184 | ---- | M] () -- C:\Program Files\Hp\QuickPlay\Kernel\TV\CLCapSvcps.dll MOD - [2007.09.30 19:33:32 | 000,066,856 | ---- | M] () -- C:\Program Files\Hp\QuickPlay\Kernel\common\MCEMediaStatus.dll MOD - [2007.08.14 15:43:46 | 006,365,184 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll MOD - [2007.07.12 13:55:52 | 000,131,072 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll MOD - [2007.07.12 13:55:28 | 001,581,056 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll MOD - [2006.11.02 10:46:09 | 000,364,544 | ---- | M] () -- C:\Windows\System32\msjetoledb40.dll MOD - [2005.07.20 10:48:10 | 000,059,904 | ---- | M] () -- C:\Program Files\Nokia\Nokia Ovi Suite\zlib1.dll MOD - [2004.05.27 17:51:12 | 000,028,672 | ---- | M] () -- C:\Program Files\TCM\TCM Mouse Only\MouseHook.dll MOD - [2004.05.27 17:50:30 | 000,286,720 | ---- | M] () -- C:\Program Files\TCM\TCM Mouse Only\MouseDrv.exe ========== Win32 Services (SafeList) ========== SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.08.12 00:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE) SRV - [2011.03.21 12:21:24 | 000,632,832 | ---- | M] (Nokia) [On_Demand | Running] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2009.08.24 13:47:07 | 000,378,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc) SRV - [2008.10.26 17:02:50 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler) SRV - [2008.10.26 17:02:48 | 000,151,297 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService) SRV - [2008.03.13 19:08:58 | 000,024,576 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService) SRV - [2007.11.07 09:28:34 | 000,815,104 | -H-- | M] (Hauppauge Computer Works) [On_Demand | Stopped] -- C:\Program Files\WinTV\HCWTVServer.exe -- (HauppaugeTVServer) SRV - [2007.11.05 16:21:48 | 000,431,104 | -H-- | M] (Hauppauge Computer Works) [Auto | Running] -- C:\Program Files\WinTV\EPG Services\System\EPGService.exe -- (EPGService) SRV - [2007.10.26 16:56:05 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.03.05 10:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb) SRV - [2005.01.14 15:32:38 | 000,053,248 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PAStiSvc.exe -- (STI Simulator) ========== Driver Services (SafeList) ========== DRV - [2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.07.22 17:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV) DRV - [2011.07.12 22:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2011.02.16 21:36:37 | 000,037,920 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tbhsd.sys -- (tbhsd) DRV - [2011.02.09 15:55:43 | 000,103,824 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pbsaudrv.sys -- (PbsAuDrv) DRV - [2010.12.02 14:13:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2010.12.02 14:13:28 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2010.12.02 14:13:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2010.12.02 14:13:22 | 000,018,304 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2010.12.01 20:06:29 | 000,108,104 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AnyDVD.sys -- (AnyDVD) DRV - [2009.05.27 18:42:03 | 000,075,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2009.05.27 18:41:56 | 000,052,056 | ---- | M] (Avira GmbH) [File_System | On_Demand | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt) DRV - [2009.05.27 18:41:53 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio) DRV - [2008.08.26 09:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008.04.17 15:05:32 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2007.10.25 09:52:00 | 000,015,488 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hcw95rc.sys -- (hcw95rc) DRV - [2007.10.25 09:47:44 | 000,487,424 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hcw95bda.sys -- (hcw95bda) DRV - [2007.10.15 16:27:10 | 000,099,200 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nwusbser.sys -- (NWUSBPort) DRV - [2007.10.15 16:27:10 | 000,099,200 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nwusbmdm.sys -- (NWUSBModem) DRV - [2007.10.10 00:57:52 | 000,101,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2007.09.19 21:05:00 | 007,626,400 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2007.09.09 23:12:28 | 000,176,640 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDART.sys -- (HdAudAddService) DRV - [2007.07.11 10:30:22 | 000,007,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqRemHid.sys -- (HpqRemHid) DRV - [2007.07.10 15:27:56 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio) DRV - [2007.06.18 17:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr) DRV - [2007.05.30 15:40:42 | 000,735,232 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2007.03.21 22:02:04 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2007.03.07 03:15:58 | 001,059,112 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD) DRV - [2007.02.24 14:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2007.02.16 22:50:32 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu) DRV - [2007.01.23 16:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2005.10.18 17:48:38 | 000,154,752 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PA707UCM.SYS -- (PAC7311) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/ymj/*hxxp://www.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*hxxp://www.yahoo.com/ext/search/search.html IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/ymj/*hxxp://www.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = hxxp://us.rd.yahoo.com/customize/ie/defaults/cs/ymj/*hxxp://www.yahoo.com/ext/search/search.html IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Pavilion&pf=laptop IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*hxxp://www.yahoo.com/ext/search/search.html IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/ymj/*hxxp://www.yahoo.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://vshare.toolbarhome.com/?hp=df IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5 FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.2 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94 FF - prefs.js..keyword.URL: "hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@ptc.com/ProductViewLite: C:\Program Files\Common Files\PTC\np6_pvapplite9.dll (PTC) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc) FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc) FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\HP\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll (Move Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009.11.19 15:00:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.04.03 21:45:19 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.04.03 21:45:19 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.26 16:22:35 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.26 16:11:04 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.06.29 16:35:50 | 000,000,000 | ---D | M] [2008.11.04 17:15:55 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\HP\AppData\Roaming\mozilla\Extensions [2011.05.14 13:56:05 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\HP\AppData\Roaming\mozilla\Firefox\Profiles\12slu5zy.default\extensions [2010.07.28 20:00:32 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\HP\AppData\Roaming\mozilla\Firefox\Profiles\12slu5zy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.01.22 15:31:45 | 000,000,000 | -H-D | M] (vShare) -- C:\Users\HP\AppData\Roaming\mozilla\Firefox\Profiles\12slu5zy.default\extensions\vshare@toolbar [2011.12.22 15:07:09 | 000,000,950 | -H-- | M] () -- C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\12slu5zy.default\searchplugins\icqplugin-4.xml [2011.05.09 21:13:19 | 000,000,950 | -H-- | M] () -- C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\12slu5zy.default\searchplugins\icqplugin-5.xml [2011.05.14 14:10:42 | 000,000,950 | -H-- | M] () -- C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\12slu5zy.default\searchplugins\icqplugin-6.xml [2010.06.21 16:35:24 | 000,001,042 | -H-- | M] () -- C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\12slu5zy.default\searchplugins\icqplugin.xml [2011.11.26 16:22:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2009.07.18 16:25:42 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.08.31 09:28:45 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011.11.26 16:11:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2011.11.26 16:22:32 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011.10.23 10:52:22 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.23 10:52:22 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.10.23 10:52:22 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.10.23 10:52:22 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.23 10:52:22 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.23 10:52:22 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found. O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [EPGServiceTool] C:\Program Files\WinTV\EPG Services\System\EPGClient.exe (Hauppauge Inc.) O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia) O4 - HKLM..\Run: [NokiaMusic FastStart] C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe (Nokia) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation) O4 - HKLM..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.) O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [WireLessMouse] C:\Program Files\TCM\TCM Mouse Only\MouseDrv.exe () O4 - HKCU..\Run: [] File not found O4 - HKCU..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.) O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation) O4 - HKCU..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia) O4 - HKCU..\Run: [Orb] C:\Program Files\Winamp Remote\bin\OrbTray.exe (Orb Networks) O4 - HKCU..\Run: [qcvgbmw] c:\users\hp\appdata\local\qcvgbmw.exe (naveta) O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html () O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7DFA8138-F1C7-4989-8DE2-F5FF3480A373}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5BE34DE-D2A4-4F67-8E7C-1288CBBD7811}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com) O24 - Desktop WallPaper: C:\Users\HP\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\HP\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O29 - HKLM SecurityProviders - (credssp.dll) -credssp.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2005.09.11 16:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ] O33 - MountPoints2\{1000d979-d14d-11dd-b6d1-001e68219f6a}\Shell\Auto\command - "" = AdobeR.exe e O33 - MountPoints2\{1000d979-d14d-11dd-b6d1-001e68219f6a}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e O33 - MountPoints2\{38f5bd0c-f991-11e0-b78e-001e68219f6a}\Shell - "" = AutoRun O33 - MountPoints2\{38f5bd0c-f991-11e0-b78e-001e68219f6a}\Shell\AutoRun\command - "" = G:\setup.exe O33 - MountPoints2\{3c97661f-105f-11e1-af5f-001e68219f6a}\Shell - "" = AutoRun O33 - MountPoints2\{3c97661f-105f-11e1-af5f-001e68219f6a}\Shell\AutoRun\command - "" = G:\Install.exe O33 - MountPoints2\{432f41a5-19d6-11dd-a43d-001e68219f6a}\Shell\Auto\command - "" = AdobeR.exe e O33 - MountPoints2\{432f41a5-19d6-11dd-a43d-001e68219f6a}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e O33 - MountPoints2\{52661f45-fd62-11e0-a07a-001e68219f6a}\Shell - "" = AutoRun O33 - MountPoints2\{52661f45-fd62-11e0-a07a-001e68219f6a}\Shell\AutoRun\command - "" = G:\setup.exe O33 - MountPoints2\{52661f56-fd62-11e0-a07a-001e68219f6a}\Shell - "" = AutoRun O33 - MountPoints2\{52661f56-fd62-11e0-a07a-001e68219f6a}\Shell\AutoRun\command - "" = G:\setup.exe O33 - MountPoints2\{7df0be80-fa75-11e0-bea6-001e68219f6a}\Shell - "" = AutoRun O33 - MountPoints2\{7df0be80-fa75-11e0-bea6-001e68219f6a}\Shell\AutoRun\command - "" = G:\setup.exe O33 - MountPoints2\{7df0be82-fa75-11e0-bea6-001e68219f6a}\Shell - "" = AutoRun O33 - MountPoints2\{7df0be82-fa75-11e0-bea6-001e68219f6a}\Shell\AutoRun\command - "" = G:\setup.exe O33 - MountPoints2\{8d833d62-2333-11e1-ac2b-001e68219f6a}\Shell\AutoRun\command - "" = G:\CD_Start.exe O33 - MountPoints2\{b157e39a-0c0c-11de-984d-001e68219f6a}\Shell - "" = AutoRun O33 - MountPoints2\{b157e39a-0c0c-11de-984d-001e68219f6a}\Shell\AutoRun\command - "" = G:\starter.exe O33 - MountPoints2\{b8ddcda9-0d67-11e1-a076-001e68219f6a}\Shell - "" = AutoRun O33 - MountPoints2\{b8ddcda9-0d67-11e1-a076-001e68219f6a}\Shell\AutoRun\command - "" = G:\setup.exe O33 - MountPoints2\{b8ddcdbd-0d67-11e1-a076-001e68219f6a}\Shell - "" = AutoRun O33 - MountPoints2\{b8ddcdbd-0d67-11e1-a076-001e68219f6a}\Shell\AutoRun\command - "" = G:\setup.exe O33 - MountPoints2\{da57a157-f819-11e0-9d2b-001e68219f6a}\Shell - "" = AutoRun O33 - MountPoints2\{da57a157-f819-11e0-9d2b-001e68219f6a}\Shell\AutoRun\command - "" = G:\setup.exe O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\setup.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.12.24 21:57:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva [2011.12.24 21:57:56 | 000,000,000 | ---D | C] -- C:\Program Files\Recuva [2011.12.24 21:22:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GridinSoft [2011.12.24 21:22:10 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer [2011.12.24 16:44:21 | 000,000,000 | ---D | C] -- C:\Users\HP\AppData\Roaming\SUPERAntiSpyware.com [2011.12.24 16:43:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware [2011.12.24 16:43:37 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware [2011.12.24 16:43:36 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com [2011.12.24 16:06:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.12.24 16:06:12 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2011.12.24 15:16:54 | 000,000,000 | ---D | C] -- C:\Users\HP\AppData\Roaming\Malwarebytes [2011.12.24 15:16:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.12.24 15:16:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.12.24 15:16:22 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.12.24 15:16:21 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2011.12.22 19:18:18 | 000,000,000 | -H-D | C] -- C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix [2011.12.15 21:48:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [2011.12.15 21:46:14 | 000,000,000 | -H-D | C] -- C:\Users\HP\AppData\Local\Google [2011.12.10 14:42:36 | 000,000,000 | -H-D | C] -- C:\Users\HP\Desktop\mathe.lös [2011.12.10 14:21:25 | 000,000,000 | -H-D | C] -- C:\Users\HP\Desktop\Bücher [2011.11.26 16:11:44 | 000,000,000 | -H-D | C] -- C:\ProgramData\Sun [2011.11.26 16:11:04 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll [2011.11.26 16:11:04 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2011.11.26 16:11:03 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2011.11.26 16:11:03 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2011.11.22 21:47:50 | 000,610,304 | -H-- | C] (naveta) -- C:\Users\HP\AppData\Local\qcvgbmw.exe [1 C:\Users\HP\*.tmp files -> C:\Users\HP\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.12.24 22:30:19 | 000,000,412 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{2D9B18CA-EA43-40DE-ADBB-FB4E44C8C341}.job [2011.12.24 21:51:00 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.12.24 21:51:00 | 000,001,086 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.12.24 21:45:58 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.12.24 21:45:58 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.12.24 20:52:04 | 000,665,064 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.12.24 20:52:04 | 000,623,162 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.12.24 20:52:04 | 000,125,030 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.12.24 20:52:04 | 000,111,816 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.12.24 20:46:58 | 000,000,163 | -H-- | M] () -- C:\Users\Public\Documents\hpqp.ini [2011.12.24 20:46:29 | 000,000,040 | -HS- | M] () -- C:\ProgramData\.zreglib [2011.12.24 20:45:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.12.24 20:45:49 | 3220,160,512 | -HS- | M] () -- C:\hiberfil.sys [2011.12.24 18:39:08 | 000,414,080 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.12.24 16:43:46 | 000,001,795 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2011.12.24 15:16:27 | 000,000,901 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.12.24 15:12:38 | 000,000,320 | ---- | M] () -- C:\ProgramData\~Rv3O9okRPlT5Qq [2011.12.24 15:12:38 | 000,000,224 | ---- | M] () -- C:\ProgramData\~Rv3O9okRPlT5Qqr [2011.12.22 19:27:27 | 000,005,040 | -H-- | M] () -- C:\Users\HP\AppData\Local\qcvgbmw_navps.dat [2011.12.22 19:27:09 | 000,003,594 | -H-- | M] () -- C:\Users\HP\AppData\Local\qcvgbmw.dat [2011.12.22 19:19:25 | 000,000,440 | -H-- | M] () -- C:\ProgramData\Rv3O9okRPlT5Qq [2011.12.22 19:18:18 | 000,000,636 | -H-- | M] () -- C:\Users\HP\Desktop\System Fix.lnk [2011.12.22 19:15:24 | 000,000,087 | -H-- | M] () -- C:\Users\HP\AppData\Local\wkoag.bat [2011.12.22 19:14:50 | 000,186,610 | -H-- | M] () -- C:\Users\HP\AppData\Roaming\nvModes.001 [2011.12.20 21:15:06 | 000,007,592 | -H-- | M] () -- C:\Users\HP\AppData\Local\d3d9caps.dat [2011.12.16 18:46:04 | 000,000,310 | -H-- | M] () -- C:\Windows\tasks\HPCeeScheduleForHP.job [2011.12.14 21:16:58 | 000,016,325 | -H-- | M] () -- C:\Users\HP\Desktop\plan_a_mb_2009.pdf [2011.12.14 19:39:03 | 000,000,085 | ---- | M] () -- C:\Windows\System32\std.out [2011.12.14 19:37:48 | 000,000,739 | -H-- | M] () -- C:\Users\HP\Desktop\proe_borrow - Verknüpfung.lnk [2011.12.10 16:45:00 | 000,024,576 | -H-- | M] () -- C:\Users\HP\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.12.09 22:15:21 | 000,243,738 | -H-- | M] () -- C:\Users\HP\AppData\Local\qcvgbmw_nav.dat [2011.11.29 17:58:57 | 001,221,435 | -H-- | M] () -- C:\Users\HP\Desktop\fertigungstechnik.pdf [2011.11.27 10:57:47 | 000,001,724 | -H-- | M] () -- C:\Users\HP\Documents\Default.rdp [2011.11.26 18:43:14 | 000,186,610 | -H-- | M] () -- C:\Users\HP\AppData\Roaming\nvModes.dat [1 C:\Users\HP\*.tmp files -> C:\Users\HP\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.12.24 16:43:46 | 000,001,795 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2011.12.24 15:16:27 | 000,000,901 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.12.24 15:12:38 | 000,000,320 | ---- | C] () -- C:\ProgramData\~Rv3O9okRPlT5Qq [2011.12.24 15:12:38 | 000,000,224 | ---- | C] () -- C:\ProgramData\~Rv3O9okRPlT5Qqr [2011.12.22 19:18:18 | 000,000,636 | -H-- | C] () -- C:\Users\HP\Desktop\System Fix.lnk [2011.12.22 19:18:14 | 000,000,440 | -H-- | C] () -- C:\ProgramData\Rv3O9okRPlT5Qq [2011.12.15 21:46:31 | 000,001,090 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.12.15 21:46:30 | 000,001,086 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.12.14 21:16:58 | 000,016,325 | -H-- | C] () -- C:\Users\HP\Desktop\plan_a_mb_2009.pdf [2011.12.14 19:37:48 | 000,000,739 | -H-- | C] () -- C:\Users\HP\Desktop\proe_borrow - Verknüpfung.lnk [2011.12.01 15:30:47 | 000,000,085 | ---- | C] () -- C:\Windows\System32\std.out [2011.11.29 17:58:57 | 001,221,435 | -H-- | C] () -- C:\Users\HP\Desktop\fertigungstechnik.pdf [2011.11.22 21:47:51 | 000,005,040 | -H-- | C] () -- C:\Users\HP\AppData\Local\qcvgbmw_navps.dat [2011.11.22 21:47:50 | 000,243,738 | -H-- | C] () -- C:\Users\HP\AppData\Local\qcvgbmw_nav.dat [2011.11.22 21:47:50 | 000,003,594 | -H-- | C] () -- C:\Users\HP\AppData\Local\qcvgbmw.dat [2011.10.27 19:52:58 | 000,057,344 | ---- | C] () -- C:\Windows\System32\mupkernps11.dll [2011.02.22 17:13:00 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib [2011.02.09 15:57:32 | 000,000,024 | ---- | C] () -- C:\Windows\System32\Drv32_16.ini [2011.02.09 15:55:43 | 000,103,824 | ---- | C] () -- C:\Windows\System32\drivers\pbsaudrv.sys [2010.04.13 20:39:04 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2010.03.29 17:40:36 | 000,009,310 | -H-- | C] () -- C:\Users\HP\AppData\Roaming\Kommagetrennte Werte (Windows).EML [2010.03.29 17:39:44 | 000,038,417 | -H-- | C] () -- C:\Users\HP\AppData\Roaming\Kommagetrennte Werte (Windows).ADR [2010.01.28 22:40:33 | 000,000,552 | -H-- | C] () -- C:\Users\HP\AppData\Local\d3d8caps.dat [2009.11.19 21:50:01 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll [2009.11.11 16:43:46 | 000,041,401 | -H-- | C] () -- C:\Users\HP\AppData\Roaming\NMM-MetaData.db [2009.10.16 12:38:52 | 000,000,087 | -H-- | C] () -- C:\Users\HP\AppData\Local\wkoag.bat [2009.03.31 21:12:21 | 000,053,248 | ---- | C] () -- C:\Windows\System32\PAStiSvc.exe [2009.03.25 14:26:20 | 000,298,997 | -H-- | C] () -- C:\Users\HP\AppData\Local\aamawuu_nav.dat [2009.03.25 14:26:20 | 000,002,934 | -H-- | C] () -- C:\Users\HP\AppData\Local\aamawuu.dat [2009.03.25 14:26:20 | 000,000,536 | -H-- | C] () -- C:\Users\HP\AppData\Local\aamawuu_navps.dat [2009.02.18 16:47:49 | 000,277,318 | -H-- | C] () -- C:\Users\HP\AppData\Local\gsgwm_nav.dat [2009.02.18 16:47:49 | 000,003,396 | -H-- | C] () -- C:\Users\HP\AppData\Local\gsgwm.dat [2009.02.18 16:47:49 | 000,000,321 | -H-- | C] () -- C:\Users\HP\AppData\Local\gsgwm_navps.dat [2009.01.21 20:09:29 | 000,000,087 | -H-- | C] () -- C:\Users\HP\AppData\Local\kwowise.bat [2008.11.14 22:18:59 | 000,000,085 | -H-- | C] () -- C:\Users\HP\AppData\Local\yqcasyg.bat [2008.10.16 20:24:34 | 000,007,592 | -H-- | C] () -- C:\Users\HP\AppData\Local\d3d9caps.dat [2008.09.18 18:01:55 | 000,000,088 | -H-- | C] () -- C:\Users\HP\AppData\Local\cgmans.bat [2008.07.09 13:29:42 | 001,005,774 | ---- | C] () -- C:\ProgramData\LuUninstall.LiveUpdate [2008.06.08 15:03:56 | 000,000,399 | ---- | C] () -- C:\Windows\vtplus32.ini [2008.06.08 15:03:48 | 000,000,030 | ---- | C] () -- C:\Windows\System32\UNWISE.INI [2008.06.08 15:03:42 | 000,149,504 | ---- | C] () -- C:\Windows\System32\UNWISE.EXE [2008.06.08 15:03:03 | 000,032,133 | ---- | C] () -- C:\Windows\Irremote.ini [2008.06.08 15:02:48 | 000,065,536 | ---- | C] () -- C:\Windows\System32\dmcrypto.dll [2008.06.08 15:01:30 | 000,000,507 | ---- | C] () -- C:\Windows\ODBC.INI [2008.06.08 15:01:30 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI [2008.06.08 15:01:27 | 000,159,744 | ---- | C] () -- C:\Windows\System32\hcwChDB.dll [2008.06.08 14:59:03 | 000,006,218 | ---- | C] () -- C:\Windows\HCWPNP.INI [2008.05.05 16:33:19 | 000,027,114 | ---- | C] () -- C:\Windows\maxlink.ini [2008.05.04 14:00:00 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2008.04.05 14:34:42 | 000,024,576 | -H-- | C] () -- C:\Users\HP\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.03.20 20:21:40 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2008.03.13 07:42:18 | 000,186,610 | -H-- | C] () -- C:\Users\HP\AppData\Roaming\nvModes.001 [2008.03.11 17:21:27 | 000,186,610 | -H-- | C] () -- C:\Users\HP\AppData\Roaming\nvModes.dat [2008.03.07 16:43:56 | 000,084,734 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4 [2008.03.07 12:47:30 | 000,020,270 | ---- | C] () -- C:\ProgramData\DeviceInstaller.xml [2008.02.28 14:47:38 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll [2008.02.28 14:43:34 | 000,001,732 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin [2007.10.27 02:09:32 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2007.10.27 02:09:31 | 000,665,064 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2007.10.27 02:09:31 | 000,125,030 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2007.10.27 02:09:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 13:47:37 | 000,414,080 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 11:33:01 | 000,623,162 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 11:33:01 | 000,111,816 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 11:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll [2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2006.11.02 08:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2006.11.02 08:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2006.03.09 23:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2003.02.20 16:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI [2002.03.04 09:16:34 | 000,110,592 | R--- | C] () -- C:\Windows\System32\Jpeg32.dll ========== LOP Check ========== [2011.12.24 20:44:55 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.12.24 22:30:19 | 000,000,412 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{2D9B18CA-EA43-40DE-ADBB-FB4E44C8C341}.job ========== Purity Check ========== < End of report > |
|
25.12.2011, 10:33
| #2 |
| | Windows - Delayed Write Failed Um meine Problematik noch genauer zu beschreiben:
__________________Mir geht's in erster Linie um die Daten, die noch auf der Festplatte sind. Ich hatte eh vor, ein neues Betriebssystem aufzusetzen (Win7), sodass ich vorher noch alles plattmachen würde. ich häng' noch das malwarebytes-Log an: Malwarebytes' Anti-Malware 1.51.2.1300 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 911122403 Windows 6.0.6000 Internet Explorer 7.0.6000.17037 24.12.2011 15:31:23 mbam-log-2011-12-24 (15-30-54).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 173353 Laufzeit: 12 Minute(n), 10 Sekunde(n) Infizierte Speicherprozesse: 2 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 4 Infizierte Registrierungswerte: 4 Infizierte Dateiobjekte der Registrierung: 2 Infizierte Verzeichnisse: 2 Infizierte Dateien: 5 Infizierte Speicherprozesse: c:\programdata\sbqdkhtcpjbcha.exe (Trojan.FakeAlert) -> 2104 -> No action taken. c:\programdata\rv3o9okrplt5qq.exe (Trojan.FakeAlert) -> 2752 -> No action taken. Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\OOO (Malware.Trace) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\OOO (Rogue.LivePlayer) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live-Player (Malware.Trace) -> No action taken. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sBqDkHtcpJbcHA.exe (Trojan.FakeAlert) -> Value: sBqDkHtcpJbcHA.exe -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MuXTvpYRmxcx.exe (Rogue.Agent) -> Value: MuXTvpYRmxcx.exe -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9Y7Y1ZUJYF7XWVXDKRAHVD (Trojan.SpyEyes) -> Value: 9Y7Y1ZUJYF7XWVXDKRAHVD -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2D9A2XYD5V6VZHWEFTHSLPRAHUZCP (Trojan.SpyEyes) -> Value: 2D9A2XYD5V6VZHWEFTHSLPRAHUZCP -> No action taken. Infizierte Dateiobjekte der Registrierung: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. Infizierte Verzeichnisse: c:\Recycle.Bin (Trojan.Spyeyes) -> No action taken. c:\sifgayiguha (Trojan.SpyEyes) -> No action taken. Infizierte Dateien: c:\programdata\sbqdkhtcpjbcha.exe (Trojan.FakeAlert) -> No action taken. c:\programdata\rv3o9okrplt5qq.exe (Trojan.FakeAlert) -> No action taken. c:\Users\HP\AppData\Local\Temp\mzjdb91gphag4f.exe.tmp (Trojan.FakeAlert) -> No action taken. c:\Recycle.Bin\6bf2f2ee2d8462d (Trojan.Spyeyes) -> No action taken. c:\sifgayiguha\296403ff2d8462d (Trojan.SpyEyes) -> No action taken. |
|
25.12.2011, 16:15
| #3 |
| /// Malware-holic   | Windows - Delayed Write Failed hi, das system muss eh neu gemacht werden und sämmtliche passwörter müssen geendert werden, du hast den spyeye auf dem pc.
__________________da bist du auch selbst schuld, das system ist schlecht gepflegt, keine updates, zb. du machst es damit kriminellen sehr leicht dein system zu missbrauchen. ich würde dir, wenn du das möchtest, helfen das neue system dann abzusichern. scanne noch mal mit malwarebytes, vollständiger scan, funde löschen log posten. dann: lade unhide: http://filepony.de/download-unhide/ doppelklicken, dateien werden sichtbar
__________________ |
|
| Themen zu Windows - Delayed Write Failed |
| antivir, autorun, avira, bho, c:\windows\system32\rundll32.exe, computer, desktop, failed, failed to save all the components for the file \\system32, firefox, google, google earth, helper, home, intranet, langsam, launch, logfile, mozilla, nvlddmkm.sys, object, otl-log, plug-in, problem, recuva, registry, rundll, scan, software, system, the file is corrupted, trojaner, virus, vista, vodafone, windows, windows - delayed write failed |
Linear-Darstellung
