| |
| |||||||
Log-Analyse und Auswertung: Weißer Bildschirm beim Start von WindowsWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
04.10.2012, 21:59
| #1 |
| |  Weißer Bildschirm beim Start von Windows Hallo, habe ein ähnliches Problem wie viele hier: Wenn ich meinen Rechner einschalte wird mir kurz mein Desktop angezeigt und dann wird der Bildschirm weiß. Ich habe OTL heruntergeladen und die Anweisungen befolgt. Das kam dabei heraus: OTL logfile created on: 04.10.2012 22:08:48 - Run 1 OTL by OldTimer - Version 3.2.70.2 Folder = C:\Users\Ich\Desktop Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,61 Gb Available Physical Memory | 86,96% Memory free 5,99 Gb Paging File | 5,64 Gb Available in Paging File | 94,11% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 116,21 Gb Total Space | 9,25 Gb Free Space | 7,96% Space Free | Partition Type: NTFS Drive D: | 115,21 Gb Total Space | 14,60 Gb Free Space | 12,67% Space Free | Partition Type: NTFS Computer Name: ICH-PC | User Name: Ich | Logged in as Administrator. Boot Mode: SafeMode | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.10.04 22:04:38 | 000,601,088 | ---- | M] (OldTimer Tools) -- C:\Users\Ich\Desktop\OTL.exe PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== MOD - [2010.09.22 21:12:20 | 000,016,832 | ---- | M] () -- C:\Program Files\Adobe\Reader 9.0\Reader\ViewerPS.dll MOD - [2010.03.15 11:28:22 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll ========== Services (SafeList) ========== SRV - [2012.09.04 18:35:37 | 000,246,112 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Mobile Partner\UpdateDog\ouc.exe -- (Mobile Partner. RunOuc) SRV - [2012.08.30 19:37:24 | 000,722,528 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe -- (vToolbarUpdater12.2.6) SRV - [2012.08.13 03:24:48 | 005,167,736 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent) SRV - [2012.06.27 13:01:14 | 000,096,768 | ---- | M] (Freemake) [Auto | Stopped] -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver) SRV - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe -- (avgwd) SRV - [2012.01.06 15:30:55 | 000,109,168 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Online Visions\Payback-Reporting.exe -- (Payback-Reporting-Service) SRV - [2012.01.06 15:30:54 | 000,186,992 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Online Visions\Payback-Updater.exe -- (Payback-Update-Service) SRV - [2012.01.04 14:32:36 | 000,718,888 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2011.03.14 17:27:28 | 000,271,712 | ---- | M] () [Auto | Stopped] -- C:\ProgramData\DatacardService\HWDeviceService.exe -- (HWDeviceService.exe) SRV - [2010.09.06 09:11:32 | 000,217,088 | ---- | M] (Teruten) [Auto | Stopped] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService) SRV - [2010.04.30 13:55:54 | 000,145,064 | R--- | M] (4G Systems GmbH & Co. KG) [Auto | Stopped] -- C:\Windows\service4g.exe -- (XS Stick Service) SRV - [2010.04.12 18:03:44 | 000,329,168 | ---- | M] () [Auto | Stopped] -- C:\Program Files\XSManager\WTGService.exe -- (WTGService) SRV - [2010.03.22 16:40:22 | 000,009,728 | ---- | M] (Deutsche Telekom AG) [Auto | Stopped] -- C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe -- (Netzmanager Service) SRV - [2009.08.18 02:36:08 | 000,176,128 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.02.26 19:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service) SRV - [2007.05.31 16:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2007.05.31 16:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\dgderdrv.sys -- (dgderdrv) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (ac1z13yu) DRV - [2012.09.04 18:35:37 | 000,353,280 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbwwan.sys -- (ewusbmbb) DRV - [2012.09.04 18:35:37 | 000,194,816 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2012.09.04 18:35:37 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV - [2012.09.04 18:35:37 | 000,073,216 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV - [2012.08.30 19:37:27 | 000,027,496 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtpx86.sys -- (avgtp) DRV - [2012.08.24 15:43:18 | 000,301,920 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix) DRV - [2012.07.26 03:21:30 | 000,237,408 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86) DRV - [2012.04.19 04:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX) DRV - [2012.04.04 17:16:26 | 000,103,424 | ---- | M] (Mobile Connector) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\cmnsusbser.sys -- (cmnsusbser) DRV - [2012.01.31 04:46:50 | 000,031,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86) DRV - [2012.01.09 18:28:20 | 000,137,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdnsu.sys -- (nmwcdnsu) DRV - [2012.01.09 18:28:20 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2012.01.09 18:28:20 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2012.01.09 18:28:20 | 000,008,576 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc) DRV - [2011.12.23 13:32:14 | 000,041,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Stopped] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86) DRV - [2011.12.23 13:32:08 | 000,017,232 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim) DRV - [2011.12.23 13:32:06 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avgidsfilterx.sys -- (AVGIDSFilter) DRV - [2011.12.23 13:32:00 | 000,139,856 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver) DRV - [2011.06.02 07:47:22 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm) DRV - [2011.06.02 07:47:22 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus) DRV - [2011.06.02 07:47:22 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl) DRV - [2010.12.21 07:55:02 | 000,132,424 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm) DRV - [2010.12.21 07:55:02 | 000,104,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) DRV - [2010.12.21 07:55:02 | 000,014,920 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl) DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 12:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.09.06 09:11:32 | 000,036,640 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2010.05.11 08:58:10 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2010.01.13 16:36:40 | 006,755,840 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw5s32.sys -- (NETw5s32) DRV - [2009.08.18 03:48:06 | 004,994,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2009.07.14 00:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008.02.15 18:01:18 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2007.11.09 05:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ) DRV - [2007.07.30 11:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2007.07.30 10:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=ae622736-1b98-4ad6-b3af-0c6bc8c101cc&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=ae622736-1b98-4ad6-b3af-0c6bc8c101cc&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=ae622736-1b98-4ad6-b3af-0c6bc8c101cc&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C0 8B 2D 51 6A 10 CB 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=ae622736-1b98-4ad6-b3af-0c6bc8c101cc&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=ae622736-1b98-4ad6-b3af-0c6bc8c101cc&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=ae622736-1b98-4ad6-b3af-0c6bc8c101cc&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{3500C0D2-7F31-45CB-915B-E0727474A2D7}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=VDJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=&apn_uid=BC3D28E8-AFAF-47F4-9DE3-A8AE8404C946&apn_sauid=2F428194-EACF-4F02-9AE0-C0826BA1794B IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SKPB_deDE392 IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={A0CB15AC-5584-4A81-B2D3-5FCD0AB48B5D}&mid=856b82ee1bd047d189c2d15775b25127-2428c1d093d3f4e34cc114b5ace1ec9f7f2557da&lang=de&ds=AVG&pr=fr&d=2012-07-09 19:21:53&v=12.2.5.32&sap=dsp&q={searchTerms} IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.6\\npsitesafety.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google) FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll () FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Ich\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Ich\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\gacela2@nurago.com: C:\Program Files\Online Visions [2012.10.04 06:08:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.2.5.32\ [2012.08.30 19:38:05 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Program Files\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2012.07.25 18:45:48 | 000,000,000 | ---D | M] ========== Chrome ========== CHR - homepage: hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=ae622736-1b98-4ad6-b3af-0c6bc8c101cc&affid=111583&searchtype=hp&babsrc=lnkry CHR - default_search_provider: Web (Enabled) CHR - default_search_provider: search_url = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=ae622736-1b98-4ad6-b3af-0c6bc8c101cc&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=ae622736-1b98-4ad6-b3af-0c6bc8c101cc&affid=111583&searchtype=hp&babsrc=lnkry CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Ich\AppData\Local\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Ich\AppData\Local\Google\Chrome\Application\22.0.1229.79\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Ich\AppData\Local\Google\Chrome\Application\22.0.1229.79\gcswf32.dll CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Ich\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: Gacela Plugin (Enabled) = C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\igkejcihojcegdmifcnlkhmnelneogef\11.3.1046_0\plugin/npgacela.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll CHR - Extension: AT_GoodSmileCo = C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\aecfjhbbloiepdanbklnmimlknahlfih\2\ CHR - Extension: YouTube = C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Online Visions = C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\igkejcihojcegdmifcnlkhmnelneogef\11.3.1046_0\ CHR - Extension: Freemake Video Converter = C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_0\ CHR - Extension: AVG Secure Search = C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\12.2.5.32_0\ CHR - Extension: Google Mail = C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll (BitComet) O2 - BHO: (Online Visions) - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files\Online Visions\Gacela2.dll (Payback) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.5.32\AVG Secure Search_toolbar.dll () O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (PAYBACK Toolbar Browserhilfsobjekt) - {E141F5C3-2619-4996-8AF8-AA0A9439D986} - C:\Program Files\Payback\PAYBACK Toolbar\PaybackToolbar.dll (PAYBACK GmbH) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.5.32\AVG Secure Search_toolbar.dll () O3 - HKLM\..\Toolbar: (PAYBACK Toolbar) - {9613CB43-EA4C-48b5-878D-13DFE1818EFE} - C:\Program Files\Payback\PAYBACK Toolbar\PaybackToolbar.dll (PAYBACK GmbH) O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (PAYBACK Toolbar) - {9613CB43-EA4C-48B5-878D-13DFE1818EFE} - C:\Program Files\Payback\PAYBACK Toolbar\PaybackToolbar.dll (PAYBACK GmbH) O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [GrooveMonitor] D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) O4 - HKLM..\Run: [ROC_ROC_JULY_P1] C:\Program Files\AVG Secure Search\ROC_ROC_JULY_P1.exe () O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe () O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdcBase.exe (Microsoft Corporation) O4 - HKCU..\Run: [abhhylgabrgziyq] C:\ProgramData\abhhylga.exe () O4 - HKCU..\Run: [BitComet] C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O4 - Startup: C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk = C:\Program Files\Netzmanager\netzmanager.exe (Deutsche Telekom AG) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 [2012.07.09 18:33:16 | 000,000,000 | ---D | M] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 [2012.07.09 18:33:16 | 000,000,000 | ---D | M] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 [2012.07.09 18:33:16 | 000,000,000 | ---D | M] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 [2012.07.09 18:33:16 | 000,000,000 | ---D | M] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 [2012.07.09 18:33:16 | 000,000,000 | ---D | M] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 [2012.07.09 18:33:16 | 000,000,000 | ---D | M] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 [2012.07.09 18:33:16 | 000,000,000 | ---D | M] O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O8 - Extra context menu item: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: add to &BOM - C:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: PAYBACK Toolbar - {4840E489-677C-4a08-A1B5-FFAF5196531E} - C:\Program Files\Payback\PAYBACK Toolbar\PaybackToolbar.dll (PAYBACK GmbH) O9 - Extra 'Tools' menuitem : Über Online Visions - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files\Online Visions\Gacela2.dll (Payback) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll (BitComet) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000032 - C:\Program Files\Bonjour\mdnsNSP.dll File not found O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{55D0E844-1964-404D-BA52-CD999D336008}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6CB50243-B638-45A9-B5D4-1792516E8D90}: NameServer = 193.189.244.225 193.189.244.206 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{854F0031-1A32-4290-B035-7B5A8A59D2B8}: NameServer = 193.189.244.225 193.189.244.206 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{96D7AF44-7327-4DAA-A4EC-2A6170BC3D44}: DhcpNameServer = 192.168.42.129 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E1B40336-ADB3-4086-AD5C-AB556DFE849B}: NameServer = 193.189.244.225 193.189.244.206 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll () O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{05aca2af-62a2-11df-b6b1-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{05aca2af-62a2-11df-b6b1-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{05aca2b3-62a2-11df-b6b1-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{05aca2b3-62a2-11df-b6b1-0016eab56a32}\Shell\AutoRun\command - "" = H:\AutoRun.exe O33 - MountPoints2\{393ffaad-62ab-11df-bdcf-001e3356b8d4}\Shell - "" = AutoRun O33 - MountPoints2\{393ffaad-62ab-11df-bdcf-001e3356b8d4}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{43cd82d9-f6a5-11e1-93c6-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{43cd82d9-f6a5-11e1-93c6-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{43cd82e6-f6a5-11e1-93c6-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{43cd82e6-f6a5-11e1-93c6-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{53edc2c0-f6b1-11e1-aba0-001e101f2b52}\Shell - "" = AutoRun O33 - MountPoints2\{53edc2c0-f6b1-11e1-aba0-001e101f2b52}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{53edc2f2-f6b1-11e1-aba0-001e101f2b52}\Shell - "" = AutoRun O33 - MountPoints2\{53edc2f2-f6b1-11e1-aba0-001e101f2b52}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{59d6d7ae-e2b8-11df-a843-001e3356b8d4}\Shell - "" = AutoRun O33 - MountPoints2\{59d6d7ae-e2b8-11df-a843-001e3356b8d4}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{782e8080-a89f-11df-b5df-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{782e8080-a89f-11df-b5df-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{782e808f-a89f-11df-b5df-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{782e808f-a89f-11df-b5df-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{9f57bebe-ed81-11df-a3db-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{9f57bebe-ed81-11df-a3db-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{9f57bec3-ed81-11df-a3db-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{9f57bec3-ed81-11df-a3db-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{9f923484-68d2-11df-bdb1-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{9f923484-68d2-11df-bdb1-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{9f923495-68d2-11df-bdb1-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{9f923495-68d2-11df-bdb1-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{ab6e16bf-5cca-11df-81af-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{ab6e16bf-5cca-11df-81af-0016eab56a32}\Shell\AutoRun\command - "" = G:\setup\rsrc\Autorun.exe O33 - MountPoints2\{ab6e16bf-5cca-11df-81af-0016eab56a32}\Shell\dinstall\command - "" = G:\Directx\dxsetup.exe O33 - MountPoints2\{b6130a6f-8c9e-11e1-8a99-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{b6130a6f-8c9e-11e1-8a99-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{b6130a72-8c9e-11e1-8a99-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{b6130a72-8c9e-11e1-8a99-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{b6130a74-8c9e-11e1-8a99-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{b6130a74-8c9e-11e1-8a99-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{b6130a77-8c9e-11e1-8a99-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{b6130a77-8c9e-11e1-8a99-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{c56844fc-6b2f-11df-bc8a-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{c56844fc-6b2f-11df-bc8a-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{c5684501-6b2f-11df-bc8a-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{c5684501-6b2f-11df-bc8a-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{e5d3c911-6a75-11df-ba57-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{e5d3c911-6a75-11df-ba57-0016eab56a32}\Shell\AutoRun\command - "" = F:\autorun.exe O33 - MountPoints2\{f0294904-7bd7-11e1-ad0f-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{f0294904-7bd7-11e1-ad0f-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f029490c-7bd7-11e1-ad0f-0016eab56a32}\Shell - "" = AutoRun O33 - MountPoints2\{f029490c-7bd7-11e1-ad0f-0016eab56a32}\Shell\AutoRun\command - "" = F:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.10.04 22:06:32 | 000,601,088 | ---- | C] (OldTimer Tools) -- C:\Users\Ich\Desktop\OTL.exe [2012.10.03 21:49:31 | 000,000,000 | ---D | C] -- C:\ProgramData\jevbqauabwpmrat [2012.10.01 18:05:56 | 000,000,000 | ---D | C] -- C:\Users\Ich\Desktop\Unterlagen zum Lernen [2012.09.30 17:38:41 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache [2012.09.23 16:43:15 | 000,000,000 | ---D | C] -- C:\Users\Ich\Desktop\Ebay Ira [2012.09.10 22:06:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG ========== Files - Modified Within 30 Days ========== [2012.10.04 22:07:16 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.10.04 22:07:16 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.10.04 22:07:16 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.10.04 22:07:16 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.10.04 22:04:38 | 000,601,088 | ---- | M] (OldTimer Tools) -- C:\Users\Ich\Desktop\OTL.exe [2012.10.04 21:44:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.10.04 21:44:43 | 2414,346,240 | -HS- | M] () -- C:\hiberfil.sys [2012.10.04 06:08:26 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.10.03 21:49:30 | 000,076,348 | ---- | M] () -- C:\ProgramData\iwfszhsnlfkzepp [2012.10.03 21:49:23 | 000,105,984 | ---- | M] () -- C:\ProgramData\abhhylga.exe [2012.10.03 21:49:23 | 000,105,984 | ---- | M] () -- C:\Users\Ich\0.8503512116502293.exe [2012.10.03 21:21:01 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.10.03 20:36:00 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4042552619-893366859-1901273293-1000UA.job [2012.10.03 20:23:01 | 096,372,992 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm [2012.10.03 09:20:26 | 000,016,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.10.03 09:20:26 | 000,016,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.10.02 21:36:00 | 000,001,060 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4042552619-893366859-1901273293-1000Core.job [2012.09.30 21:40:23 | 000,380,216 | ---- | M] () -- C:\Users\Ich\Desktop\Weg_zur_Monatskarte_Azubi_08_2012.pdf [2012.09.28 19:39:04 | 000,002,440 | ---- | M] () -- C:\Users\Ich\Desktop\Google Chrome.lnk [2012.09.21 13:08:24 | 000,076,903 | ---- | M] () -- C:\Users\Ich\Desktop\IMG-20120921-WA0000.jpg [2012.09.10 22:06:17 | 000,000,916 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2012.lnk [2012.09.10 19:10:29 | 000,093,727 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm ========== Files Created - No Company Name ========== [2012.10.03 21:49:29 | 000,105,984 | ---- | C] () -- C:\ProgramData\abhhylga.exe [2012.10.03 21:49:24 | 000,076,348 | ---- | C] () -- C:\ProgramData\iwfszhsnlfkzepp [2012.10.03 21:49:20 | 000,105,984 | ---- | C] () -- C:\Users\Ich\0.8503512116502293.exe [2012.09.30 21:40:22 | 000,380,216 | ---- | C] () -- C:\Users\Ich\Desktop\Weg_zur_Monatskarte_Azubi_08_2012.pdf [2012.09.21 18:57:40 | 000,076,903 | ---- | C] () -- C:\Users\Ich\Desktop\IMG-20120921-WA0000.jpg [2012.08.09 12:47:01 | 000,000,040 | ---- | C] () -- C:\ProgramData\igqwoshnmwmqvue [2012.07.31 11:05:45 | 000,000,051 | ---- | C] () -- C:\ProgramData\vsvdwzjlodqmkgx [2012.06.15 22:49:04 | 000,000,052 | ---- | C] () -- C:\ProgramData\yqzxeuexiaxubth [2012.06.03 12:18:51 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll [2012.06.03 12:18:51 | 000,036,640 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys [2011.11.08 16:45:15 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe [2011.11.08 16:42:13 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2011.10.31 18:20:50 | 000,103,736 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe [2011.10.22 12:06:27 | 000,000,000 | ---- | C] () -- C:\Users\Ich\AppData\Local\{BBB42AB2-427C-4ADC-A35A-DBAEDDC7DE55} [2011.10.15 20:34:58 | 000,000,000 | ---- | C] () -- C:\Users\Ich\AppData\Local\{088D925C-4F14-4F3B-A53C-F2CBEEA682CB} [2011.10.15 19:19:25 | 000,003,584 | ---- | C] () -- C:\Users\Ich\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.09.04 18:07:25 | 000,000,000 | ---- | C] () -- C:\Users\Ich\AppData\Local\{7FE53C8D-660F-4CA8-82C4-C973F8367913} [2011.08.31 20:04:46 | 000,000,000 | ---- | C] () -- C:\Users\Ich\AppData\Local\{1CA07FB5-C79B-4356-9090-5D3F87E7F09F} [2011.08.28 19:43:56 | 000,000,000 | ---- | C] () -- C:\Users\Ich\AppData\Local\{D299E9BD-2E5A-494F-9ABD-13EC5F535993} [2011.07.27 08:22:11 | 000,000,000 | ---- | C] () -- C:\Users\Ich\AppData\Local\{CDF06C7B-3C33-4552-B212-35DD27644F13} [2011.06.07 11:13:38 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll [2011.06.07 11:13:38 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll [2011.06.07 11:13:38 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll [2011.06.07 11:13:38 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll [2010.10.03 00:28:56 | 099,739,528 | ---- | C] () -- C:\Program Files\Virtual Pool 3 + Crack + Savegame + Manual & Info (English & Deutsch) The Most Perfect Billard & Snooker Game For PC.zip [2010.08.09 19:58:46 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.05.29 19:10:41 | 000,022,328 | ---- | C] () -- C:\Users\Ich\AppData\Roaming\PnkBstrK.sys ========== ZeroAccess Check ========== [2011.11.17 07:38:39 | 000,002,048 | -HS- | M] () -- C:\Windows\Installer\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\@ [2012.07.13 19:09:41 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\L [2012.09.28 18:44:31 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\U [2012.10.04 21:44:59 | 000,000,804 | ---- | M] () -- C:\Windows\Installer\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\L\00000004.@ [2012.07.06 18:28:05 | 000,002,048 | ---- | M] () -- C:\Windows\Installer\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\U\00000004.@ [2012.07.08 13:07:25 | 000,232,960 | ---- | M] () -- C:\Windows\Installer\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\U\00000008.@ [2012.07.07 11:02:12 | 000,001,632 | ---- | M] () -- C:\Windows\Installer\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\U\000000cb.@ [2012.07.22 18:33:05 | 000,013,312 | ---- | M] () -- C:\Windows\Installer\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\U\80000000.@ [2012.09.28 18:44:31 | 000,087,040 | ---- | M] () -- C:\Windows\Installer\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\U\80000032.@ [2012.07.08 08:51:50 | 000,002,048 | -HS- | M] () -- C:\Users\Ich\AppData\Local\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\@ [2011.11.17 07:38:39 | 000,000,000 | -HSD | M] -- C:\Users\Ich\AppData\Local\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\L [2011.11.17 07:38:39 | 000,000,000 | -HSD | M] -- C:\Users\Ich\AppData\Local\{a8697c05-e47a-2883-3c27-d3e290ddb5d5}\U [2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [2012.10.04 21:44:56 | 000,005,120 | -HS- | M] () -- C:\Windows\assembly\GAC\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.01.04 10:59:38 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== Files - Unicode (All) ========== [2011.12.08 00:48:44 | 000,010,908 | ---- | M] ()(C:\Users\Ich\Desktop\????? ???.docx) -- C:\Users\Ich\Desktop\фильм МЕЧ.docx [2011.06.19 23:00:39 | 000,010,908 | ---- | C] ()(C:\Users\Ich\Desktop\????? ???.docx) -- C:\Users\Ich\Desktop\фильм МЕЧ.docx ========== Alternate Data Streams ========== @Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:0B4227B4 < End of report > Danach konnte ich den Rechner im normalen Modus wieder starten, vorher nur im abgesicherten. Ich hoffe, das sind genug Informationen, damit mir jemand weiterhelfen kann. Danke schon mal!!! MfG |
| Themen zu Weißer Bildschirm beim Start von Windows |
| adobe, avg secure search, avg security toolbar, bho, bildschirm, bonjour, cdrom, desktop, ebay, explorer, format, homepage, microsoft, plug-in, problem, registry, rootkit.0access, rootkit.zaccess, secure, secure search, software, start von windows, trojan.0access, trojan.dropper.bcminer, trojan.ransom, trojan.small, trojaner, vtoolbarupdater, weißer bildschirm, windows, winlogon |
Baum-Darstellung