| |  Internetseite(Tesyxaltert.us) öffnet sich nach hochfahren automatisch, kann nichts machen.
 Hallo liebe Helfer,
wenn ich mein PC starte, öffnet sich sofort der Internet Explorer und die Seite "Tesyxalter.us" öffnet sich im Vollbildmodus und ich kann nichts machen...
Habe die Logfiles vom defogger, OTL und GMER geposet, falls noch etwas erforderlich ist, bitte bescheid sagen, hatte noch nie mit solchen Problemen zu tun. Auf dem Rechner läuft Windows 7 Ultimate 32bit und avast FreeAntivirus.
Ich bedanke mich schonmal vielmals im Voraus.
defogger Zitat:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:37 on 10/01/2013 (Heiko)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
| OTL Zitat:
뿃뻃OTL logfile created on: 10.01.2013 17:41:08 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Heiko\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,99 Gb Total Physical Memory | 1,65 Gb Available Physical Memory | 82,72% Memory free
3,98 Gb Paging File | 3,67 Gb Available in Paging File | 92,10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 58,59 Gb Total Space | 13,79 Gb Free Space | 23,53% Space Free | Partition Type: NTFS
Drive D: | 239,49 Gb Total Space | 213,37 Gb Free Space | 89,09% Space Free | Partition Type: NTFS
Computer Name: HEIKO-PC | User Name: Heiko | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.01.10 17:32:32 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Heiko\Desktop\OTL.exe
PRC - [2010.03.09 11:49:11 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
========== Modules (No Company Name) ==========
========== Services (SafeList) ==========
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.06.01 02:59:04 | 000,099,840 | ---- | M] (PostgreSQL Global Development Group) [Auto | Stopped] -- C:\Program Files\WM-Kat_Technik\pgsql\bin\pg_ctl.exe -- (WorkshopDbService)
SRV - [2011.11.08 11:54:25 | 000,554,160 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto | Stopped] -- C:\Programme\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 7.0 OnlineUpdate)
SRV - [2010.03.18 21:25:55 | 000,126,976 | ---- | M] (CrypKey (Canada) Ltd.) [Auto | Stopped] -- C:\Windows\System32\Crypserv.exe -- (CrypKey License)
SRV - [2010.03.09 11:45:29 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.14 02:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2006.10.26 18:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006.10.26 13:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
========== Driver Services (SafeList) ==========
DRV - [2012.07.16 16:36:06 | 000,083,872 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2012.07.16 16:36:06 | 000,025,888 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010.03.19 00:11:11 | 000,023,360 | ---- | M] () [Kernel | System | Stopped] -- C:\Windows\System32\Ckldrv.sys -- (NetworkX)
DRV - [2009.07.14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009.07.14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009.07.14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 69 C7 DA 4B CB 1A CC 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{22473430-1697-47DD-AE17-17314EC6A8F9}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{41964964-29F5-482C-B773-2A0BD86439AC}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{5CE1414F-3909-447B-8DC8-8B7E0A1066F8}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{625E3914-FC82-44D7-8037-AABBE55C959B}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADRA_de
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Heiko\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Heiko\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
========== Chrome ==========
CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google riginalQueryForSuggestion}{google:searchFieldtrialParameter}sou rceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Heiko\AppData\Local\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Heiko\AppData\Local\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Heiko\AppData\Local\Google\Chrome\Application\23.0.1271.97\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.250.6 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U25 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: YouTube = C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google-Suche = C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Google Mail = C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll (Google Inc.)
O2 - BHO: (WEB.DE MailCheck BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O3 - HKLM\..\Toolbar: (WEB.DE MailCheck) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (WEB.DE MailCheck) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O4 - HKLM..\Run: [SedServer] C:\Program Files\WM-Kat_Technik\Sed.exe ()
O4 - HKLM..\Run: [WEB.DE MailCheck Broker] C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
O4 - HKCU..\Run: [sv뇃栀쌀®st] C:\Users\Heiko\4068654.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D328F53D-6755-43C6-8CB3-A2C008BF3783}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{667ece8c-d024-11e1-9089-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{667ece8c-d024-11e1-9089-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autoDS.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013.01.10 17:36:07 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Heiko\Desktop\OTL.exe
[2013.01.10 08:21:46 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.01.01 12:13:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WM-KAT ATRis
========== Files - Modified Within 30 Days ==========
[2013.01.10 17:37:16 | 000,000,000 | ---- | M] () -- C:\Users\Heiko\defogger_reenable
[2013.01.10 17:37:03 | 000,643,628 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.01.10 17:37:03 | 000,606,992 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.01.10 17:37:03 | 000,126,188 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.01.10 17:37:03 | 000,103,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.01.10 17:33:14 | 000,365,568 | ---- | M] () -- C:\Users\Heiko\Desktop\gmer-2.0.18444.exe
[2013.01.10 17:32:32 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Heiko\Desktop\OTL.exe
[2013.01.10 17:31:26 | 000,050,477 | ---- | M] () -- C:\Users\Heiko\Desktop\Defogger.exe
[2013.01.10 17:14:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.10 17:14:31 | 1602,347,008 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.10 17:01:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.10 16:51:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4138367750-3481807868-3657384447-1001UA.job
[2013.01.10 13:31:54 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.10 08:24:24 | 000,017,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.10 08:24:24 | 000,017,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.08 14:50:08 | 000,029,184 | RHS- | M] () -- C:\Users\Heiko\4068654.exe
[2013.01.04 07:51:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4138367750-3481807868-3657384447-1001Core.job
[2013.01.01 12:52:35 | 000,001,848 | ---- | M] () -- C:\Users\Public\Desktop\WM-Kat_Technik.lnk
[2013.01.01 12:40:48 | 000,000,575 | ---- | M] () -- C:\Windows\setup.iss
[2013.01.01 12:13:17 | 000,001,562 | ---- | M] () -- C:\Users\Public\Desktop\WM-KAT ATRis.lnk
[2013.01.01 12:13:16 | 000,000,339 | ---- | M] () -- C:\Windows\ODBC.INI
[2013.01.01 12:13:16 | 000,000,295 | ---- | M] () -- C:\Windows\Atris_WM.INI
[2012.12.12 13:53:28 | 000,002,487 | ---- | M] () -- C:\Users\Heiko\Desktop\Google Chrome.lnk
========== Files Created - No Company Name ==========
[2013.01.10 17:37:16 | 000,000,000 | ---- | C] () -- C:\Users\Heiko\defogger_reenable
[2013.01.10 17:36:07 | 000,365,568 | ---- | C] () -- C:\Users\Heiko\Desktop\gmer-2.0.18444.exe
[2013.01.10 17:36:07 | 000,050,477 | ---- | C] () -- C:\Users\Heiko\Desktop\Defogger.exe
[2013.01.08 14:50:08 | 000,029,184 | RHS- | C] () -- C:\Users\Heiko\4068654.exe
[2013.01.01 12:13:17 | 000,001,562 | ---- | C] () -- C:\Users\Public\Desktop\WM-KAT ATRis.lnk
[2013.01.01 12:13:16 | 000,000,295 | ---- | C] () -- C:\Windows\Atris_WM.INI
[2012.07.16 16:36:06 | 000,083,872 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2012.07.16 16:36:06 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2012.01.08 11:55:05 | 000,000,087 | ---- | C] () -- C:\Windows\Crypkey.ini
[2012.01.08 11:54:56 | 000,023,360 | ---- | C] () -- C:\Windows\System32\Ckldrv.sys
[2012.01.08 11:54:56 | 000,011,776 | ---- | C] () -- C:\Windows\Ckrfresh.exe
[2011.05.25 15:16:25 | 000,003,072 | ---- | C] () -- C:\Windows\System32\CNCFLbNL.DLL
[2011.05.25 13:25:50 | 000,000,339 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.05.25 13:25:50 | 000,000,200 | ---- | C] () -- C:\Windows\ODBCINST.INI
========== ZeroAccess Check ==========
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010.08.11 14:52:26 | 012,867,584 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2012.08.21 12:35:27 | 000,000,000 | ---D | M] -- C:\Users\Heiko\AppData\Roaming\1&1 Mail & Media GmbH
[2011.06.14 13:55:51 | 000,000,000 | ---D | M] -- C:\Users\Heiko\AppData\Roaming\DVSE GmbH
========== Purity Check ==========
< End of report >
| OTL Extras Zitat:
뿃뻃OTL Extras logfile created on: 10.01.2013 17:41:08 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Heiko\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,99 Gb Total Physical Memory | 1,65 Gb Available Physical Memory | 82,72% Memory free
3,98 Gb Paging File | 3,67 Gb Available in Paging File | 92,10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 58,59 Gb Total Space | 13,79 Gb Free Space | 23,53% Space Free | Partition Type: NTFS
Drive D: | 239,49 Gb Total Space | 213,37 Gb Free Space | 89,09% Space Free | Partition Type: NTFS
Computer Name: HEIKO-PC | User Name: Heiko | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "D:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05B6203F-B66E-4193-A1E6-1B015C0DDA58}" = lport=138 | protocol=17 | dir=in | app=system |
"{2608C9D6-1B22-4ED3-BCA7-9C08EBB513AC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{306D028F-A0D1-437D-A58E-834823424D27}" = lport=2869 | protocol=6 | dir=in | app=system |
"{438BAC40-A474-4B65-9C4E-451F189AD100}" = lport=137 | protocol=17 | dir=in | app=system |
"{4FC854C8-3A9B-44FC-8860-3942ACD7BEB1}" = rport=139 | protocol=6 | dir=out | app=system |
"{55A46C08-4855-4BB4-A814-98C9070721DD}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{61413241-9148-4DC7-9886-0AA89F3ED720}" = rport=445 | protocol=6 | dir=out | app=system |
"{656CF75B-C164-49A6-8308-4E400B6DD87F}" = rport=137 | protocol=17 | dir=out | app=system |
"{6CE26F5E-A48B-4E1C-815F-4BFCB0EA83A3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6EB89953-716D-4959-9223-4C09727D9204}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{739D2700-0F58-4164-8363-42D7814B90FA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{74B354F5-480C-4113-AEE8-084FB1E96B3F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{777CA6F3-68B9-4C87-A249-F01618BD9911}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8077D51B-16E5-4CF8-9EBA-53A69407B8C3}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8510AD99-9066-4E85-944C-B7C367439594}" = lport=139 | protocol=6 | dir=in | app=system |
"{915BC8E5-6C71-405F-ACBF-0DB76ABA5B06}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{9F826D36-F8F2-416D-AA86-822F2E517625}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B5991978-28EF-4CBD-82CD-D9B1127D3A0E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BC5B70BE-804C-4E06-A385-ABBACF5DDDEC}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BF434906-616D-427E-A3D9-A5513E4B380F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{D7C1A47A-3F53-4208-95F1-B487C5C6F10C}" = lport=445 | protocol=6 | dir=in | app=system |
"{DF317069-5D1C-4B35-8D35-6C7C1E8E8E1C}" = rport=10243 | protocol=6 | dir=out | app=system |
"{E82E8FBC-5AB5-4CE6-AA90-D74A0C928055}" = rport=138 | protocol=17 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A84803F-9B02-430D-8042-8A0EAFD4A70E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0E3E207B-C367-4811-B440-0AB85C44E1BF}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{17C56511-1CCC-485E-8DA8-38753DC28ACB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{19D3149B-F57E-4E8A-B583-E6768275034C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2CD4C3CA-6A2F-41B1-9625-EAD3A340BAEB}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{32800DA2-2843-48E9-82C1-12B1D4D96BA4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4215F915-B1C5-43C2-9EE8-645636B516FA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4C42A1A1-2BD2-490E-A036-59DB49E096A7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4CF2E2A3-5C03-4704-B036-22696C328F30}" = protocol=6 | dir=in | app=c:\program files\starmoney 7.0\ouservice\starmoneyonlineupdate.exe |
"{530B86AF-4C54-42EB-B986-6AE072640768}" = protocol=17 | dir=in | app=c:\program files\starmoney 7.0\app\starmoney.exe |
"{6050BAE1-8D94-4BC1-9B4E-4F73C79E44F7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{7679D146-75D7-468F-A62C-6BDE435191FA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{80BAFAB2-4066-4125-90BE-806399B15D03}" = protocol=17 | dir=in | app=c:\program files\starmoney 7.0\ouservice\starmoneyonlineupdate.exe |
"{80BF74CF-74CC-45AB-8CD0-506774739041}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{81A10485-411E-49D4-92E7-7EB0AE35CE59}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AEABA9A0-E40F-4021-85C4-4CC9D3680C01}" = protocol=6 | dir=out | app=system |
"{C21537D3-D5A9-4A9E-9B09-820181A907A7}" = protocol=6 | dir=in | app=c:\program files\starmoney 7.0\app\starmoney.exe |
"{CFDF638B-CAD7-4300-85E2-968A196E5B31}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E18F5D4B-388E-405D-82F3-DC2152091889}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F3B1C533-36AA-4C75-9E28-AB84953BB686}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{112699A6-EDCE-451F-89F3-3A5978A98D04}C:\atris_wm\katcd\atris_wm.exe" = protocol=6 | dir=in | app=c:\atris_wm\katcd\atris_wm.exe |
"TCP Query User{33087FEB-9870-4AAE-B5F6-BA8D7D010474}C:\users\heiko\appdata\local\programs\andi 2012\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\users\heiko\appdata\local\programs\andi 2012\jre6\bin\javaw.exe |
"TCP Query User{FB76DC6B-6FAF-44EE-AC23-8302D9A768C0}C:\program files\wm-kat_technik\sed.exe" = protocol=6 | dir=in | app=c:\program files\wm-kat_technik\sed.exe |
"UDP Query User{5239040B-C73A-4514-8221-8A3E06AAA88E}C:\users\heiko\appdata\local\programs\andi 2012\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\users\heiko\appdata\local\programs\andi 2012\jre6\bin\javaw.exe |
"UDP Query User{70A37E4C-7B73-433A-88B6-83474CA18684}C:\program files\wm-kat_technik\sed.exe" = protocol=17 | dir=in | app=c:\program files\wm-kat_technik\sed.exe |
"UDP Query User{F63A1C2F-2322-4E1F-B656-8B1E719A8565}C:\atris_wm\katcd\atris_wm.exe" = protocol=17 | dir=in | app=c:\atris_wm\katcd\atris_wm.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08C919D4-4993-482C-ABC6-781962BB3618}" = ANDI 2011
"{0D25F7CC-B99C-44ee-9945-B14532B2BB7B}" = Canon MP830
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 25
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{3B850B40-DFD6-4E75-AD94-4E7AF66C544A}" = Bestellsystem
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E95F911-B344-48FB-8E5E-1CED78E0FBDE}" = ATRis Wessels+M볃氀氀攀爀 ⠀ ⼀㈀ ㌀⤀ഀ∀笀㔀㈀㘀㜀䈀 䌀ⴀ䘀䈀㔀䐀ⴀ㐀㌀䔀㜀ⴀ䈀䔀䌀㔀ⴀ㈀㐀䔀䔀㘀䈀䔀䔀㈀䈀䄀 紀∀ 㴀 䐀嘀匀䔀 唀瀀搀愀琀攀爀ഀ∀笀㘀㌀ ㌀ ⴀ㈀㈀㠀䐀ⴀ㐀㔀䐀䌀ⴀ䄀㌀ 䄀ⴀ㜀䔀䘀䘀䘀㐀㌀䄀䈀㔀㠀㐀紀∀ 㴀 匀琀愀爀䴀漀渀攀礀 㜀⸀ ഀ∀笀㘀㌀䈀㤀㈀㈀ 㐀䄀ⴀ㠀㤀䌀㤀ⴀ㐀㐀䔀㘀ⴀ㠀㈀㔀㈀ⴀ㔀䘀㈀䘀㜀㌀䄀㜀䌀㔀㐀紀∀ 㴀 匀琀愀爀䴀漀渀攀礀ഀ∀笀㜀㐀㠀䘀 䄀㠀ⴀ㘀㠀㌀ⴀ䐀㘀ⴀ䄀㜀㜀䈀ⴀ 䈀 䐀 㐀㈀ 紀∀ 㴀 䨀愀瘀愀 ㈀ 刀甀渀琀椀洀攀 䔀渀瘀椀爀漀渀洀攀渀琀Ⰰ 匀䔀 瘀⸀㐀⸀㈀ഀ∀笀㜀㘀䔀 ㌀ 㘀ⴀ㠀㌀㠀ⴀ㐀㌀㘀㐀ⴀ㠀 䈀㠀䘀ⴀ 䌀䌀㐀䔀㤀㌀㜀㘀䈀䄀䌀紀∀ 㴀 䴀匀堀䴀䰀 㐀⸀ 匀倀㈀ 倀愀爀猀攀爀 甀渀搀 匀䐀䬀ഀ∀笀㜀㔀㤀㠀䔀㌀䐀㠀ⴀ㐀㠀䐀䔀ⴀ㐀䌀㜀䈀ⴀ㤀䔀㠀䔀ⴀ㤀㐀㔀䈀㘀䄀䐀䈀 㜀䄀紀∀ 㴀 䄀一䐀䤀 ㈀ ㈀ഀ∀笀㠀㜀㤀䌀㔀㈀䄀㈀ⴀ䘀䘀㤀䄀ⴀ㐀䌀䈀㔀ⴀ䈀䈀㜀㐀ⴀ䈀 䐀䄀㤀㤀㐀䄀䈀䈀㈀䄀紀∀ 㴀 匀琀 愀爀䴀漀渀攀礀ഀ∀笀㤀 ㈀ ⴀ 㔀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 䄀挀挀攀猀猀 䴀唀䤀 ⠀䜀攀爀洀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 㘀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀 昀椀挀攀 䔀砀挀攀氀 䴀唀䤀 ⠀䜀攀爀洀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 㠀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 倀漀眀攀爀倀漀椀渀琀 䴀唀䤀 ⠀䜀攀爀洀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 㤀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 倀甀戀氀椀猀栀攀爀 䴀唀䤀 ⠀䜀攀爀洀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 䄀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 伀甀琀氀漀漀欀 䴀唀䤀 ⠀䜀攀爀洀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 䈀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 圀漀爀搀 䴀唀䤀 ⠀䜀攀爀洀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 䘀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 倀爀漀漀昀 ⠀䜀攀爀 洀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 䘀ⴀ 㐀 㤀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 倀爀漀漀昀 ⠀䔀渀最氀椀猀栀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 䘀ⴀ 㐀 䌀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀 挀攀 倀爀漀漀昀 ⠀䘀爀攀渀挀栀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 䘀ⴀ 㐀 ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 倀爀漀漀昀 ⠀䤀琀愀氀椀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ ㈀䌀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀 椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 倀爀漀漀昀椀渀最 ⠀䜀攀爀洀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ ㌀ ⴀ ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 䔀渀琀攀爀瀀爀椀猀攀 ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 㐀㐀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 䤀渀昀漀倀愀琀栀 䴀唀䤀 ⠀䜀攀爀洀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 㘀䔀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 匀栀愀爀攀搀 䴀唀䤀 ⠀䜀攀爀洀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 䄀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 伀渀攀一漀琀攀 䴀唀䤀 ⠀䜀攀爀洀愀渀⤀ ㈀ 㜀ഀ∀笀㤀 ㈀ ⴀ 䈀䄀ⴀ 㐀 㜀ⴀ ⴀ 䘀䘀䌀䔀紀∀ 㴀 䴀椀挀爀漀猀漀昀琀 伀昀昀椀挀攀 䜀爀漀漀瘀攀 䴀唀䤀 ⠀ 䜀攀爀洀愀渀⤀ ㈀ 㜀ഀ∀笀䄀㤀㈀䐀䄀䈀㌀㤀ⴀ㐀䔀㈀䌀ⴀ㐀㌀ 㐀ⴀ㤀䄀䈀㘀ⴀ䈀䌀㐀㐀䔀㘀㠀䈀㔀㔀䔀㈀紀∀ 㴀 䜀漀漀最氀攀 唀瀀搀愀琀攀 䠀攀氀瀀攀爀ഀ∀笀䄀䌀㜀㘀䈀䄀㠀㘀ⴀ㜀䄀䐀㜀ⴀ ㌀ⴀ㜀䈀㐀㐀ⴀ䄀䄀 紀∀ 㴀 䄀搀漀戀攀 刀攀愀搀攀爀 堀 ⠀ ⸀⸀㔀⤀ ⴀ 䐀攀 甀琀猀挀栀ഀ∀笀䔀㌀ ㌀ ㈀㌀䘀ⴀ䐀 䐀㈀ⴀ㐀㔀㜀䌀ⴀ㠀䄀䈀䈀ⴀ㘀㘀䐀㈀㐀㈀䐀䘀䐀䄀㤀㈀紀∀ 㴀 䐀愀琀攀渀猀攀爀瘀椀挀攀ഀ∀☀ 䴀愀椀氀 ☀ 䴀攀搀椀愀 䜀洀戀䠀 甀渀搀匀漀昀琀眀愀爀攀愀欀琀甀愀氀椀猀椀攀爀甀渀最∀ 㴀 圀䔀䈀⸀䐀䔀 匀漀昀琀眀愀爀攀愀欀琀甀愀氀椀猀椀攀爀甀渀最ഀ∀ ☀ 䴀愀椀氀 ☀ 䴀攀搀椀愀 䜀洀戀䠀 吀漀漀氀戀愀爀 䤀䔀㠀∀ 㴀 圀䔀䈀⸀䐀䔀 䴀愀椀氀䌀栀攀挀欀 昀쌀¼r Internet Explorer
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"ENTERPRISE" = Microsoft Office Enterprise 2007
"H&S Teilefinder SmartClient" = H&S Teilefinder SmartClient
"H+R Gutachten" = H+R Gutachten
"sv.net" = sv.net
"WM-Kat_Technik" = WM-Kat_Technik
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 17.07.2012 12:41:10 | Computer Name = Heiko-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Setup.EXE_InstallShield (R), Version:
10.0.0.159, Zeitstempel: 0x4083592c Name des fehlerhaften Moduls: iuser.dll, Version:
10.0.0.159, Zeitstempel: 0x408357fe Ausnahmecode: 0xc0000005 Fehleroffset: 0x00010e45
ID
des fehlerhaften Prozesses: 0x450 Startzeit der fehlerhaften Anwendung: 0x01cd643af190b5c3
Pfad
der fehlerhaften Anwendung: C:\Users\Heiko\AppData\Local\Temp\DVSE_DVD\Setup.EXE
Pfad
des fehlerhaften Moduls: C:\Program Files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iuser.dll
Berichtskennung:
36342750-d02e-11e1-9089-00241d151f98
Error - 19.07.2012 13:14:39 | Computer Name = Heiko-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: atris_wm.exe, Version: 1.0.0.1, Zeitstempel:
0x4fd9ba49 Name des fehlerhaften Moduls: SHW32.dll, Version: 4.0.1.0, Zeitstempel:
0x363f46f9 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000249f ID des fehlerhaften Prozesses:
0x254 Startzeit der fehlerhaften Anwendung: 0x01cd657407e32939 Pfad der fehlerhaften
Anwendung: C:\ATRIS_WM\KatCd\atris_wm.exe Pfad des fehlerhaften Moduls: C:\ATRIS_WM\KatCd\SHW32.dll
Berichtskennung:
38672056-d1c5-11e1-8562-00241d151f98
Error - 27.07.2012 02:29:15 | Computer Name = Heiko-PC | Source = VSS | ID = 8194
Description =
Error - 28.08.2012 07:14:45 | Computer Name = Heiko-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: atris_wm.exe, Version: 1.0.0.1, Zeitstempel:
0x4fd9ba49 Name des fehlerhaften Moduls: SHW32.dll, Version: 4.0.1.0, Zeitstempel:
0x363f46f9 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00001fc0 ID des fehlerhaften Prozesses:
0xdd8 Startzeit der fehlerhaften Anwendung: 0x01cd84e30367a589 Pfad der fehlerhaften
Anwendung: C:\ATRIS_WM\KatCd\atris_wm.exe Pfad des fehlerhaften Moduls: C:\ATRIS_WM\KatCd\SHW32.dll
Berichtskennung:
91e83372-f101-11e1-a3ec-00241d151f98
Error - 03.10.2012 04:52:03 | Computer Name = Heiko-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Setup.EXE_InstallShield (R), Version:
10.0.0.159, Zeitstempel: 0x4083592c Name des fehlerhaften Moduls: iuser.dll, Version:
10.0.0.159, Zeitstempel: 0x408357fe Ausnahmecode: 0xc0000005 Fehleroffset: 0x00010e45
ID
des fehlerhaften Prozesses: 0xe6c Startzeit der fehlerhaften Anwendung: 0x01cda14453321849
Pfad
der fehlerhaften Anwendung: C:\Users\Heiko\AppData\Local\Temp\DVSE_DVD\Setup.EXE
Pfad
des fehlerhaften Moduls: C:\Program Files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iuser.dll
Berichtskennung:
998462e9-0d37-11e2-a8a2-00241d151f98
Error - 03.10.2012 04:52:48 | Computer Name = Heiko-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Setup.EXE_InstallShield (R), Version:
10.0.0.159, Zeitstempel: 0x4083592c Name des fehlerhaften Moduls: iuser.dll, Version:
10.0.0.159, Zeitstempel: 0x408357fe Ausnahmecode: 0xc0000005 Fehleroffset: 0x00010e45
ID
des fehlerhaften Prozesses: 0x428 Startzeit der fehlerhaften Anwendung: 0x01cda1446fe1acbb
Pfad
der fehlerhaften Anwendung: C:\Users\Heiko\AppData\Local\Temp\DVSE_DVD\Setup.EXE
Pfad
des fehlerhaften Moduls: C:\Program Files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iuser.dll
Berichtskennung:
b4877fa8-0d37-11e2-a8a2-00241d151f98
Error - 26.11.2012 08:17:38 | Computer Name = Heiko-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 8.0.7600.16385 kann nicht mehr unter
Windows ausgef볃栀爀琀 眀攀爀搀攀渀 甀渀搀 眀甀爀搀攀 戀攀攀渀搀攀琀⸀ 쌀œberpr볃昀攀渀 匀椀攀 搀攀渀 倀爀漀戀氀攀洀瘀攀爀氀愀甀昀 ഀ椀渀 搀攀爀 圀愀爀琀甀渀最猀挀攀渀琀攀爀ⴀ匀礀猀琀攀洀猀琀攀甀攀爀甀渀最Ⰰ 甀洀 渀愀挀栀 眀攀椀琀攀爀攀渀 䤀渀昀漀爀洀愀琀椀漀渀攀渀 稀甀洀 倀爀 漀戀氀攀洀ഀ 稀甀 猀甀挀栀攀渀⸀ 倀爀漀稀攀猀猀ⴀ䤀䐀㨀 昀㐀 匀琀愀爀琀稀攀椀琀㨀 挀搀挀戀戀愀㠀挀挀㈀㌀㘀㠀 䔀渀搀稀攀椀琀㨀 㐀㘀 䄀渀眀攀渀搀甀渀最猀瀀昀愀搀㨀 ഀ䌀㨀尀倀爀漀最爀愀洀 䘀椀氀攀猀尀䤀渀琀攀爀渀攀琀 䔀砀瀀氀漀爀攀爀尀椀攀砀瀀氀漀爀攀⸀攀 砀攀 䈀攀爀椀挀栀琀猀ⴀ䤀䐀㨀 㐀搀㐀㔀愀㈀㈀ⴀ㌀㜀挀㌀ⴀ攀㈀ⴀ㠀㜀㜀愀ⴀ ㈀㐀搀㔀昀㤀㠀ഀഀ ഀ䔀爀爀漀爀 ⴀ ⸀ ⸀㈀ ㌀ 㘀㨀㔀㐀㨀㐀㘀 簀 䌀漀洀瀀甀琀攀爀 一愀洀攀 㴀 䠀攀椀欀漀ⴀ倀䌀 簀 匀漀甀爀挀攀 㴀 䄀瀀瀀氀椀挀愀琀椀漀渀 䔀爀爀漀爀 簀 䤀䐀 㴀 ഀ䐀攀猀挀爀椀瀀琀椀漀渀 㴀 一愀洀攀 搀攀爀 昀攀栀氀攀爀栀愀昀琀攀渀 䄀渀眀攀渀搀甀渀最㨀 匀攀琀甀瀀⸀䔀堀䔀开䤀渀猀琀愀氀氀匀栀椀攀氀搀 ⠀刀⤀Ⰰ 嘀攀爀猀椀漀渀㨀ഀ ⸀ ⸀ ⸀㔀㤀Ⰰ 娀攀椀琀猀琀攀洀瀀攀氀㨀 砀㐀 㠀㌀㔀㤀㈀挀 一愀洀攀 搀攀猀 昀攀栀氀攀爀栀愀 昀琀攀渀 䴀漀搀甀氀猀㨀 椀甀猀攀爀⸀搀氀氀Ⰰ 嘀攀爀猀椀漀渀㨀ഀ ⸀ ⸀ ⸀㔀㤀Ⰰ 娀攀椀琀猀琀攀洀瀀攀氀㨀 砀㐀 㠀㌀㔀㜀昀攀 䄀甀猀渀愀栀洀攀挀漀搀攀㨀 砀挀 㔀 䘀攀栀氀攀爀漀昀昀猀攀琀㨀 砀 攀㐀㔀ഀ䤀䐀ഀ 搀攀猀 昀攀栀氀攀爀栀愀昀琀攀渀 倀爀漀稀 攀猀猀攀猀㨀 砀愀攀㐀 匀琀愀爀琀稀攀椀琀 搀攀爀 昀攀栀氀攀爀栀愀昀琀攀渀 䄀渀眀攀渀搀甀渀最㨀 砀 挀搀攀㠀 攀㘀㔀愀戀挀㌀㠀㤀ഀ倀昀愀搀ഀ 搀攀爀 昀攀栀氀攀爀栀愀昀琀攀渀 䄀渀眀攀渀搀甀渀最㨀 䌀㨀尀唀猀攀爀猀尀䠀攀椀欀漀尀䄀瀀瀀䐀愀琀愀尀䰀漀挀愀氀尀吀攀洀瀀尀䐀嘀匀䔀开䐀嘀䐀尀 匀攀琀甀瀀⸀䔀堀䔀ഀ倀昀愀搀ഀ 搀攀猀 昀攀栀氀攀爀栀愀昀琀攀渀 䴀漀搀甀氀猀㨀 䌀㨀尀倀爀漀最爀愀洀 䘀椀氀攀猀尀䌀漀洀洀漀渀 䘀椀氀攀猀尀䤀渀猀琀愀氀氀匀栀椀攀氀搀尀倀爀漀昀攀猀猀椀漀渀愀氀尀刀甀渀吀椀洀攀尀 尀 尀䤀渀琀攀氀㌀㈀尀椀甀猀攀爀⸀搀氀氀ഀ䈀攀爀椀挀栀琀猀欀攀渀渀甀渀最㨀ഀ 愀㜀㔀搀搀㤀㘀㌀ⴀ㔀㐀 ⴀ攀㈀ⴀ㤀㤀愀㘀ⴀ ㈀㐀搀㔀昀㤀㠀ഀ ഀ䔀爀爀漀爀 ⴀ ⸀ ⸀㈀ ㌀ 㤀㨀㈀㨀㔀 簀 䌀漀洀瀀甀琀攀爀 一愀洀攀 㴀 䠀攀椀欀漀ⴀ倀䌀 簀 匀漀甀爀挀攀 㴀 匀椀搀攀䈀礀匀椀搀攀 簀 䤀䐀 㴀 㘀㠀㐀㈀㜀㠀㔀ഀ䐀攀猀挀爀椀瀀琀椀漀渀 㴀 䘀攀栀氀攀爀 戀攀椀洀 䜀攀渀攀爀椀攀爀攀渀 搀攀猀 䄀欀琀椀瘀椀攀爀甀渀最猀欀漀渀琀攀砀琀攀猀 昀쌀¼r "c:\program files\wm-kat_technik\Updater\RunAsAdmin3.exe".
Die
abh꓃渀最椀最攀 䄀猀猀攀洀戀氀椀攀爀甀渀最 ∀䴀椀挀爀漀猀漀昀琀⸀嘀䌀㤀 ⸀䐀攀戀甀最䌀刀吀Ⰰ瀀爀漀挀攀猀猀漀爀䄀爀挀栀椀琀攀挀琀甀爀攀㴀∀砀㠀㘀∀Ⰰ瀀甀戀氀椀挀䬀攀礀吀漀欀攀渀㴀∀昀挀㠀戀㌀戀㤀愀攀㠀攀㌀戀∀Ⰰ琀礀瀀攀㴀∀眀椀渀㌀㈀∀Ⰰ瘀攀爀猀椀漀渀㴀∀㤀⸀ ⸀㈀ ㈀㈀⸀㠀∀∀ഀ 欀 漀渀渀琀攀 渀椀挀栀琀 最攀昀甀渀搀攀渀 眀攀爀搀攀渀⸀ 嘀攀爀眀攀渀搀攀渀 匀椀攀 昀쌀¼r eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 10.01.2013 03:36:23 | Computer Name = Heiko-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes f볃爀 ∀挀㨀尀瀀爀漀最爀愀洀 昀椀氀攀猀尀眀洀ⴀ欀愀琀开琀攀挀栀渀椀欀尀唀瀀搀愀琀攀爀尀刀甀渀䄀猀䄀搀洀椀渀㌀⸀攀砀攀∀⸀ഀ䐀椀攀ഀ 愀戀栀쌀¤ngige Assemblierung "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
konnte nicht gefunden werden. Verwenden Sie f볃爀 攀椀渀攀 搀攀琀愀椀氀氀椀攀爀琀攀 䐀椀愀最渀漀猀攀 搀愀猀 倀爀漀最爀愀洀洀ഀ ∀猀砀猀琀爀愀挀攀⸀攀砀攀∀⸀ഀ ഀ嬀 匀礀猀琀攀洀 䔀瘀攀渀琀猀 崀ഀ䔀爀爀漀爀 ⴀ 㔀⸀ 㐀⸀㈀ ㈀ 㤀㨀㨀㈀㘀 簀 䌀漀洀瀀甀琀攀爀 一愀洀攀 㴀 䠀攀椀欀漀ⴀ倀䌀 簀 匀漀甀爀挀攀 㴀 匀挀栀愀渀渀攀氀 簀 䤀䐀 㴀 ㌀㘀㠀㠀㜀ഀ䐀攀猀挀爀椀瀀琀椀漀渀 㴀 䔀猀 眀甀爀搀攀 攀椀渀攀 猀挀栀眀攀爀眀椀攀最攀渀搀攀 圀愀爀渀甀渀最 攀洀瀀昀愀渀最攀渀㨀 ㈀ ⸀ഀ ഀ䔀爀爀漀爀 ⴀ 㔀⸀ 㐀⸀㈀ ㈀ ㈀㨀㌀㔀㨀 ㈀ 簀 䌀漀洀瀀甀琀攀爀 一愀洀攀 㴀 䠀攀椀欀漀ⴀ倀䌀 簀 匀漀甀爀挀攀 㴀 瘀漀氀猀渀愀瀀 簀 䤀䐀 㴀 ㌀㤀㌀㈀㔀㈀ഀ䐀攀猀挀爀椀瀀琀椀漀渀 㴀 䐀椀攀 匀挀栀愀琀琀攀渀欀漀瀀椀攀渀 瘀漀渀 嘀漀氀甀洀攀 ∀䌀㨀∀ 眀甀爀搀攀渀 愀戀最攀戀爀漀挀栀攀渀Ⰰ 眀攀椀氀 搀攀爀 匀挀栀愀琀琀攀渀欀漀瀀椀攀猀瀀攀椀挀栀攀爀ഀ 渀椀挀栀琀 愀甀昀 攀椀渀 戀 攀渀甀琀稀攀爀搀攀昀椀渀椀攀爀琀攀猀 䰀椀洀椀琀 瘀攀爀最爀쌀¶鿃攀爀琀 眀攀爀搀攀渀 欀漀渀渀琀攀⸀ഀ ഀ䔀爀爀漀爀 ⴀ 㔀⸀ 㐀⸀㈀ ㈀ ㌀㨀 㨀㐀 簀 䌀漀洀瀀甀琀攀爀 一愀洀攀 㴀 䠀攀椀欀漀ⴀ倀䌀 簀 匀漀甀爀挀攀 㴀 挀搀爀漀洀 簀 䤀䐀 㴀 ㈀㘀㈀㔀ഀ䐀攀猀挀爀椀瀀 琀椀漀渀 㴀 䘀攀栀氀攀爀栀愀昀琀攀爀 䈀氀漀挀欀 戀攀椀 䜀攀爀쌀¤t \Device\CdRom0.
Error - 05.04.2012 13:10:24 | Computer Name = Heiko-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Ger꓃琀 尀䐀攀瘀椀挀攀尀䌀搀刀漀洀 ⸀ഀ ഀ䔀爀爀漀爀 ⴀ 㔀⸀ 㐀⸀㈀ ㈀ ㌀㨀 㨀㌀㔀 簀 䌀漀洀瀀甀琀攀爀 一愀洀攀 㴀 䠀攀椀欀漀ⴀ倀䌀 簀 匀漀甀爀挀攀 㴀 挀搀爀漀洀 簀 䤀䐀 㴀 ㈀㘀㈀㔀ഀ䐀攀猀挀爀椀瀀琀椀漀渀 㴀 䘀攀栀氀攀爀栀愀昀琀攀爀 䈀氀漀挀欀 戀攀椀 䜀攀爀쌀¤t \Device\CdRom0.
Error - 06.04.2012 08:49:19 | Computer Name = Heiko-PC | Source = cdrom | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.
Error - 06.04.2012 08:49:26 | Computer Name = Heiko-PC | Source = cdrom | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.
Error - 06.04.2012 09:32:03 | Computer Name = Heiko-PC | Source = cdrom | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.
< End of report >
| Gmer Zitat:
GMER 2.0.18444 - hxxp://www.gmer.net
Rootkit scan 2013-01-10 17:53:45
Windows 6.1.7600 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HD322HJ rev.1AC01113 298,09GB
Running: gmer-2.0.18444.exe; Driver: C:\Users\Heiko\AppData\Local\Temp\ugloipoc.sys
---- Kernel code sections - GMER 2.0 ----
.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 81C82599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 81CA6F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
---- EOF - GMER 2.0 ----
|
|
11.01.2013, 00:00
+ E Taste.
Linear-Darstellung
