| |
| |||||||
Log-Analyse und Auswertung: Pc hängt sich beim Hochfahren auf (vermutliche Ursache Virus)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
03.01.2012, 20:04
| #1 |
 |  Pc hängt sich beim Hochfahren auf (vermutliche Ursache Virus) Hallo, ich habe folgendes Problem. Vor ein paar Tagen hab ich mir den Bundespolizeivirus gezogen. Das heist der Bildschirm wurde blockiert von einem weißem Bildschirm, auf dem stand geschrieben das ich 100 Euro überweisen muss da ich bei einer Straftat erwischt worden bin. Da ich von Pc´s keine Ahnung habe fiel mir nichts besseres ein als in abgesicherten Modus hochzufahren und anschliesend eine Systemwiederherstellung zu machen. Dann hab ich Antivir durchlaufen lassen und es wurden 3 Viren gefunden. Allerdings hab ich seitdem das Problem das der Pc sich beim Hochfahren sehr oft aufhängt. Ich habe nach Anweisung eine OTL datei erstellt, aber leider hat das mit der Extra datei nicht funktioniert. Ich komm leider nicht drauf warum. Hier ist auf jeden Fall schonmal der OTL Inhalt: OTL logfile created on: 03.01.2012 19:42:37 - Run 3 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\Gagibär77\Eigene Dateien\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,50 Gb Total Physical Memory | 3,12 Gb Available Physical Memory | 89,22% Memory free 5,34 Gb Paging File | 5,12 Gb Available in Paging File | 96,01% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 149,04 Gb Total Space | 39,79 Gb Free Space | 26,70% Space Free | Partition Type: NTFS Drive D: | 316,72 Gb Total Space | 315,80 Gb Free Space | 99,71% Space Free | Partition Type: NTFS Computer Name: HOME | User Name: Gagibär77 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.01.03 19:04:08 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Gagibär77\Eigene Dateien\Downloads\OTL.exe PRC - [2011.04.27 15:13:55 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.03.30 05:59:06 | 000,937,920 | R--- | M] (Adobe Systems Incorporated) -- C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe PRC - [2010.12.06 17:13:03 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.05.14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2010.03.25 02:32:30 | 002,499,584 | ---- | M] (Vodafone) -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe ========== Modules (No Company Name) ========== MOD - [2011.12.31 13:57:54 | 000,031,232 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Ou#\a4414dbd4a4c8c1beae197ab9d3033b5\VMC.BaseServices.OutlookConnector.ni.dll MOD - [2011.10.13 17:49:53 | 000,715,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.WwanWrapper\82bd2774e23541b803dae653d58b95bd\VMC.WwanWrapper.ni.dll MOD - [2011.10.13 17:49:53 | 000,248,832 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.WindowsService.#\079f44608f6aab1b391be5a070193418\VMC.WindowsService.Core.ni.dll MOD - [2011.10.13 17:49:52 | 000,329,728 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CancelAutoPlay\172dbb0e7bdd2f81e2bbba6eee011c87\CancelAutoPlay.ni.dll MOD - [2011.10.13 17:49:52 | 000,247,296 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.CsUtil\55b4dcefe733fbe3c6348e1373e360d7\VMC.CsUtil.ni.dll MOD - [2011.10.13 17:49:52 | 000,050,176 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.ConnectionServi#\9bf58f97ec261e6b792d4b39753e538c\VMC.ConnectionServices.TrafficOptimiser.ni.dll MOD - [2011.10.13 17:49:51 | 001,552,896 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.ConnectionServi#\20e71985eec4780a02dce43a1e7f442c\VMC.ConnectionServices.ni.dll MOD - [2011.10.13 17:49:51 | 000,101,888 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\23a7e89d9096f537f33a83d984a748ad\Interop.Shell32.ni.dll MOD - [2011.10.13 17:49:48 | 000,675,840 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Xm#\1fd623c8e77b51fa6fff585b273c0ded\VMC.BaseServices.XmlSerializers.ni.dll MOD - [2011.10.13 17:49:48 | 000,218,624 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Interop.FNCClient11#\a12a8d0f2ab42ff65ecfbaad590239b9\Interop.FNCClient11Lib.ni.dll MOD - [2011.10.13 17:49:47 | 000,492,544 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Da#\7023c41897a6ea2da8908734b91109bb\VMC.BaseServices.DataAccessor.ni.dll MOD - [2011.10.13 17:49:44 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\abef85f2fb8ba830eda73e2d12e8d41e\System.ServiceProcess.ni.dll MOD - [2011.10.13 17:49:44 | 000,070,656 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.WindowsService.#\225624e27ebc9e81644bf389bfabba77\VMC.WindowsService.Messaging.ni.dll MOD - [2011.10.13 17:49:31 | 000,497,152 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.ConnectionServi#\943deb1292a45204f8d2a223fffb75aa\VMC.ConnectionServicesInterface.ni.dll MOD - [2011.10.13 17:49:30 | 000,946,688 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.BaseServices.Pl#\171f32ccb0523f9c5511f06eff655d65\VMC.BaseServices.Platform.ni.dll MOD - [2011.10.13 17:49:30 | 000,357,888 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\VMC.UI.CommonDialogs\6d27529c47bd2b7fbdd72d8a95eb83b0\VMC.UI.CommonDialogs.ni.dll MOD - [2011.10.13 17:49:25 | 004,332,032 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\MobileConnect\2db82666e8463efcba707a7a09112270\MobileConnect.ni.exe MOD - [2011.10.13 17:49:25 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\bce0720436dc6cb76006377f295ea365\System.Configuration.ni.dll MOD - [2011.10.13 16:41:42 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\70cacc44f0b4257f6037eda7a59a0aeb\System.Xml.ni.dll MOD - [2011.10.13 16:41:37 | 012,430,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\71a2ae9ad561a62181cbd9fb11e9de7a\System.Windows.Forms.ni.dll MOD - [2011.10.13 16:41:25 | 001,587,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\c10bea3c4bb7ef654651141bf9419090\System.Drawing.ni.dll MOD - [2011.10.13 16:40:23 | 007,950,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll MOD - [2011.10.13 16:40:13 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll MOD - [2010.01.28 12:57:53 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ========== Win32 Services (SafeList) ========== SRV - [2011.07.10 18:14:53 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.04.27 15:13:55 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.03.25 02:32:16 | 000,009,216 | ---- | M] (Vodafone) [Auto | Stopped] -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService) SRV - [2010.03.04 22:38:00 | 000,071,096 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Running] -- -- (xpsec) DRV - File not found [Kernel | On_Demand | Running] -- -- (xcpip) DRV - [2011.07.10 18:14:54 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011.07.10 18:14:54 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010.05.18 16:00:43 | 000,015,172 | ---- | M] (Prassi Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\Drivers\PzWDM.sys -- (PzWDM) DRV - [2010.03.11 09:36:26 | 000,024,192 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpipBM.sys -- (tcpipBM) DRV - [2010.03.11 09:36:24 | 000,013,184 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\BMLoad.sys -- (BMLoad) DRV - [2010.03.01 18:35:22 | 000,080,000 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vodafone_K3805-z_dc_enum.sys -- (vodafone_K3805-z_dc_enum) DRV - [2009.11.12 13:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen) DRV - [2009.11.04 17:59:38 | 000,113,280 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbnet.sys -- (ewusbnet) DRV - [2009.11.04 17:59:38 | 000,102,528 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2009.11.04 17:59:38 | 000,100,736 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbfake.sys -- (hwusbfake) DRV - [2009.05.22 16:37:50 | 005,082,624 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2009.05.20 07:00:50 | 000,038,400 | R--- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\l1e51x86.sys -- (L1e) DRV - [2009.05.11 11:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.08.05 13:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt) DRV - [2007.12.12 07:35:46 | 000,212,992 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV - [2007.03.16 09:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\drivers\TBPanel.sys -- (TBPanel) DRV - [2007.03.16 09:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TBPanel.sys -- (Cardex) DRV - [2006.10.18 12:44:48 | 000,007,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor) DRV - [2006.03.22 18:57:44 | 000,073,984 | ---- | M] (Fuzhou Rockchip Electronics Co,Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rockusb.sys -- (rockusb) DRV - [2006.01.04 08:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt) DRV - [2005.10.13 07:15:18 | 000,124,928 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcd.sys -- (Nokia USB Phone Parent) DRV - [2005.10.13 07:15:18 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcj.sys -- (Nokia USB Port) DRV - [2005.10.13 07:15:18 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcm.sys -- (Nokia USB Modem) DRV - [2005.10.13 07:15:18 | 000,008,704 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdc.sys -- (Nokia USB Generic) DRV - [2005.09.07 11:24:50 | 000,444,416 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fpcibase.sys -- (fpcibase) DRV - [2005.09.07 11:24:02 | 000,037,568 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avmwan.sys -- (AVMWAN) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "SweetIM Search" FF - prefs.js..browser.search.defaultthis.engineName: "Elf 1.15 Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2866295&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledItems: {464F169E-ACE1-4C5F-A778-A433A3DABBAE}:1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?src=2&q=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Bing" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://www.bing.com/search?FORM=IEFM1&q=" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.myspace.com/" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://www.bing.com/search?FORM=IEFM1&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Programme\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Programme\Vodafone\Vodafone Mobile Connect\Optimization Client\addon\ [2010.11.03 22:40:28 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.11.23 07:27:06 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.09.09 18:50:30 | 000,000,000 | ---D | M] [2010.04.27 19:57:01 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Mozilla\Extensions [2011.01.23 09:26:40 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Mozilla\Firefox\Profiles\vuisessk.default\extensions [2010.07.20 14:26:30 | 000,001,819 | ---- | M] () -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Mozilla\Firefox\Profiles\vuisessk.default\searchplugins\bing.xml [2010.12.30 17:16:58 | 000,000,919 | ---- | M] () -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Mozilla\Firefox\Profiles\vuisessk.default\searchplugins\conduit.xml [2010.07.23 14:09:18 | 000,003,915 | ---- | M] () -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Mozilla\Firefox\Profiles\vuisessk.default\searchplugins\sweetim.xml [2010.04.27 20:21:48 | 000,001,196 | ---- | M] () -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Mozilla\Firefox\Profiles\vuisessk.default\searchplugins\winamp-search.xml [2011.11.23 07:27:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.08.01 11:39:59 | 000,000,000 | ---D | M] (VMLoad) -- C:\Programme\Mozilla Firefox\extensions\{464F169E-ACE1-4C5F-A778-A433A3DABBAE} [2011.11.23 07:27:05 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2011.01.28 21:49:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll [2010.01.13 23:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\mozilla firefox\plugins\npwachk.dll [2011.05.09 05:28:52 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.05.09 05:28:52 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2011.05.09 05:28:52 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2011.05.09 05:28:53 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2011.05.09 05:28:53 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2011.05.09 05:28:53 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2001.03.28 11:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (VMLoadHBO Class) - {C17C7688-31D1-46D7-8C9B-5D253E4F5D5E} - C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\VMLoad\addin\VMLoad.dll (TODO: <Company name>) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found. O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [MobileConnect] C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe () O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [AdobeBridge] File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetIcon = 1 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = net.ms O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DA1BA893-67BF-4AF7-9112-EAD178242EA3}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.04.24 18:29:14 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{313fa550-e70d-11df-99d1-001e90bb8ce8}\Shell - "" = AutoRun O33 - MountPoints2\{313fa550-e70d-11df-99d1-001e90bb8ce8}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{313fa550-e70d-11df-99d1-001e90bb8ce8}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{313fa551-e70d-11df-99d1-001e90bb8ce8}\Shell - "" = AutoRun O33 - MountPoints2\{313fa551-e70d-11df-99d1-001e90bb8ce8}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{313fa551-e70d-11df-99d1-001e90bb8ce8}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353) ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE NetSvcs: 6to4 - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Reboot.exe - - File not found MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Gagibär77^Startmenü^Programme^Autostart^VMLoad.lnk - - File not found MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: Adobe Photo Downloader - hkey= - key= - C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: CTFMON.EXE - hkey= - key= - File not found MsConfig - StartUpReg: HDAudDeck - hkey= - key= - C:\Programme\VIA\VIAudioi\HDADeck\HDeck.exe (VIA Technologies, Inc.) MsConfig - StartUpReg: msnmsgr - hkey= - key= - File not found MsConfig - StartUpReg: Pando Media Booster - hkey= - key= - File not found MsConfig - StartUpReg: PCSuiteTrayApplication - hkey= - key= - C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe (Nokia) MsConfig - StartUpReg: PcSync - hkey= - key= - C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.) MsConfig - StartUpReg: TBPanel - hkey= - key= - C:\Programme\Vtune\TBPanel.exe () MsConfig - StartUpReg: WinampAgent - hkey= - key= - C:\Programme\Winamp\winampa.exe (Nullsoft, Inc.) MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.12.31 13:29:21 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2011.12.30 18:23:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Skype [2011.12.28 15:56:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Skype [2011.12.28 15:56:35 | 000,000,000 | R--D | C] -- C:\Programme\Skype [2011.12.28 15:56:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype [2011.12.13 18:34:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Gagibär77\restore [2011.12.09 09:02:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Gagibär77\Desktop\BilderBadReichenhall [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.01.03 19:46:38 | 000,000,426 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{022EACD6-2F37-4A8D-A9BA-889C25E3080E}.job [2012.01.03 19:41:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.01.03 19:03:02 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Gagibär77\defogger_reenable [2012.01.03 11:53:43 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [2012.01.01 13:51:51 | 000,068,240 | ---- | M] () -- C:\Dokumente und Einstellungen\Gagibär77\Desktop\LKMBMF0000288.jpg [2011.12.31 13:29:00 | 000,526,480 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2011.12.31 13:29:00 | 000,501,518 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011.12.31 13:29:00 | 000,104,548 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2011.12.31 13:29:00 | 000,087,146 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011.12.29 04:00:22 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2011.12.28 18:07:31 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.12.14 16:25:55 | 003,439,216 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.12.14 07:37:57 | 000,000,593 | ---- | M] () -- C:\WINDOWS\imsins.BAK [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.01.03 19:03:02 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Gagibär77\defogger_reenable [2012.01.01 13:46:07 | 000,068,240 | ---- | C] () -- C:\Dokumente und Einstellungen\Gagibär77\Desktop\LKMBMF0000288.jpg [2011.12.30 18:23:12 | 000,002,243 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [2011.01.15 16:27:57 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2011.01.15 16:17:58 | 000,240,592 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin [2011.01.15 16:17:55 | 000,240,592 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin [2011.01.15 16:17:55 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin [2011.01.15 16:17:34 | 002,293,194 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin [2011.01.15 16:12:51 | 000,001,769 | ---- | C] () -- C:\WINDOWS\Language_trs.ini [2010.11.20 18:01:43 | 000,000,732 | ---- | C] () -- C:\WINDOWS\BTI.INI [2010.11.20 18:01:15 | 000,183,040 | ---- | C] () -- C:\WINDOWS\PI.EXE [2010.11.03 22:43:20 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\{79A64F98-1796-4FA2-B5FF-C90F83D8BACD}.ini [2010.11.03 22:39:14 | 000,000,219 | ---- | C] () -- C:\WINDOWS\{79A64F98-1796-4FA2-B5FF-C90F83D8BACD}.ini [2010.08.15 15:06:12 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2010.05.18 16:00:41 | 000,091,923 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat [2010.05.18 16:00:41 | 000,076,956 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat [2010.05.18 16:00:41 | 000,039,121 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat [2010.05.18 16:00:41 | 000,027,965 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_JP.dat [2010.04.27 22:08:38 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2010.04.27 20:24:10 | 000,039,936 | ---- | C] () -- C:\Dokumente und Einstellungen\Gagibär77\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.04.27 19:56:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2010.04.27 19:50:55 | 000,001,732 | R--- | C] () -- C:\WINDOWS\System32\drivers\nvphy.bin [2010.04.24 19:09:05 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2010.04.24 19:08:22 | 003,439,216 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010.04.24 18:33:18 | 000,000,142 | ---- | C] () -- C:\Dokumente und Einstellungen\Gagibär77\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2010.04.24 18:31:04 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2010.04.24 18:27:07 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2010.03.15 20:15:34 | 000,156,430 | R--- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DeviceManager.xml.rc4 [2009.06.16 17:46:54 | 272,117,807 | ---- | C] () -- C:\Programme\Setup.exe [2009.04.09 16:47:02 | 000,013,824 | ---- | C] () -- C:\WINDOWS\System32\CallSimReader.dll [2009.04.09 16:46:02 | 000,055,808 | ---- | C] () -- C:\WINDOWS\System32\SimReader.dll [2001.03.28 11:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2001.03.28 11:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2001.03.28 11:00:00 | 000,526,480 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2001.03.28 11:00:00 | 000,501,518 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2001.03.28 11:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2001.03.28 11:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2001.03.28 11:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2001.03.28 11:00:00 | 000,104,548 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2001.03.28 11:00:00 | 000,087,146 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2001.03.28 11:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2001.03.28 11:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2001.03.28 11:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2001.03.28 11:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2001.03.28 11:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2001.03.28 11:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2001.03.28 11:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat ========== LOP Check ========== [2011.01.01 21:25:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ableton [2010.08.15 15:06:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited [2010.04.28 16:10:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ConeXware [2010.09.03 12:43:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Downloaded Installations [2010.08.06 06:40:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NCH Swift Sound [2010.04.27 20:13:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle [2011.10.31 10:20:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\regid.1986-12.com.adobe [2011.12.21 17:46:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp [2010.11.03 22:48:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vodafone [2011.01.01 21:25:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Ableton [2010.11.03 06:48:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Bytemobile [2010.08.15 15:06:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Canneverbe Limited [2010.09.03 13:00:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\DataLayer [2010.05.04 17:12:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\FreeMoviesToDVD [2011.07.26 14:20:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Gaasm [2010.12.26 15:05:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Leadertech [2011.01.22 14:31:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\NCH Swift Sound [2010.09.03 13:00:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Nokia [2010.09.03 12:52:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Nokia Multimedia Player [2010.08.15 15:06:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\OpenCandy [2010.09.03 12:44:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\PC Suite [2011.10.31 10:21:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2011.12.30 15:20:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\StarOffice8 [2010.08.15 15:06:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Uniblue [2011.06.30 08:21:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\VMLoad [2010.11.03 06:48:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Vodafone [2010.11.04 08:00:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Vodafone Mobile Connect [2011.05.01 20:55:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Gagibär77\Anwendungsdaten\Zyena [2012.01.03 19:46:38 | 000,000,426 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{022EACD6-2F37-4A8D-A9BA-889C25E3080E}.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2010.04.27 20:10:50 | 000,000,000 | ---D | M] -- C:\Backup [2011.01.05 20:06:21 | 000,000,000 | ---D | M] -- C:\berni eigene dateien berni [2011.12.31 13:30:14 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2010.04.24 18:33:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen [2011.12.28 15:56:35 | 000,000,000 | ---D | M] -- C:\Programme [2010.04.27 19:45:30 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2011.01.15 16:27:57 | 000,000,000 | ---D | M] -- C:\Service [2011.01.21 16:43:00 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2010.11.20 18:01:43 | 000,000,000 | ---D | M] -- C:\TK_FAST [2012.01.03 17:50:22 | 000,000,000 | ---D | M] -- C:\WINDOWS < %PROGRAMFILES%\*.exe > [2009.06.16 17:46:54 | 272,117,807 | ---- | M] () -- C:\Programme\Setup.exe Invalid Environment Variable: LOCALAPPDATA < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < MD5 for: AFD.SYS > [2011.08.17 14:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\WINDOWS\system32\DllCache\afd.sys [2011.08.17 14:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\WINDOWS\system32\drivers\afd.sys [2008.04.14 00:49:24 | 000,138,112 | ---- | M] (Microsoft Corporation) MD5=322D0E36693D6E24A2398BEE62A268CD -- C:\WINDOWS\ServicePackFiles\i386\afd.sys [2011.02.16 14:22:48 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=355556D9E580915118CD7EF736653A89 -- C:\WINDOWS\$NtUninstallKB2592799$\afd.sys [2008.10.16 16:07:58 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=38D7B715504DA4741DF35E3594FE2099 -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\afd.sys [2008.10.16 15:43:01 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7618D5218F2A614672EC61A80D854A37 -- C:\WINDOWS\$NtUninstallKB2503665$\afd.sys [2008.08.14 11:04:36 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7E775010EF291DA96AD17CA4B17137D7 -- C:\WINDOWS\$NtUninstallKB2509553$\afd.sys [2011.02.16 14:25:05 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=8D499B1276012EB907E7A9E0F4D8FDA4 -- C:\WINDOWS\$hf_mig$\KB2503665\SP3QFE\afd.sys [2011.08.17 14:41:46 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=F6B7B1ECD7B41736BDB6FF4B092BCB79 -- C:\WINDOWS\$hf_mig$\KB2592799\SP3QFE\afd.sys < MD5 for: EXPLORER.EXE > [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe < MD5 for: IPSEC.SYS > [2008.04.14 00:49:44 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\ServicePackFiles\i386\ipsec.sys [2008.04.14 00:49:44 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\system32\drivers\ipsec.sys < MD5 for: REGEDIT.EXE > [2008.04.14 07:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\regedit.exe [2008.04.14 07:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\ServicePackFiles\i386\regedit.exe < MD5 for: USERINIT.EXE > [2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe < MD5 for: WINLOGON.EXE > [2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2011.11.23 15:40:13 | 001,859,712 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-12-31 12:30:14 < End of report > |
| Themen zu Pc hängt sich beim Hochfahren auf (vermutliche Ursache Virus) |
| 0x00000001, antivir, avira, bho, bildschirm, blockiert, c:\windows\system32\rundll32.exe, cdburnerxp, desktop, downloader, einstellungen, euro, firefox, format, helper, home, hängt, logfile, object, pando media booster, plug-in, port, realtek, registry, required, rundll, scan, security, security update, software, sweetim, viren, virus, vodafone, win32k.sys, wrapper |
Baum-Darstellung