| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Bundestrojaner (weißer Bildschirm)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
24.05.2013, 06:52
| #1 |
| |  Bundestrojaner (weißer Bildschirm) Mahlzeit, mein Chef hat mir heute seinen privaten Rechner mitgebracht, er hat sich den Bundestrojander (weißer Bildschirm) eingefangen. Rechner hat im Moment keine Internetverbindung. Wenn ich Windows normal starte, habe ich nur einen weißen Bildschirm, im abgesicherten Modus, wird Windows sofort beendet. Via USB Stick, habe ich den Rechner mit der Rescue CD von Kaspersky gestartet und den Scan durchlaufen lassen. Die betroffenen Datein habe ich dann in Quarantäne geschoben, für den Fall, das irgendwas daran wichtig ist - löschen kann man sie später auch noch. Jetzt kann ich den Rechner wieder normal, ohne weißen Bildschirm starten. Aber ich bezweifel das der Trojaner weg ist. Habe beim ersten durchstöbern gemerkt, das die eine oder andere Toolbar installiert ist, das Problem gehe ich später an, aber wer weiß was da noch alles zu finden ist  Vielen Dank. MfG BadDay NACHTRAG: Wenn ich den Rechner runterfahren will, benötigt der Rechner verdammt lange, bleibt scheinbar hängen, seit 5 Min zeigt mit Windows den Bildschirm "Herunterfahren...." an. Irgendwann fährt er dann runter und startet neu. - Beim zweiten Versuch ging es aber normal, daher hoffe ich mal, das es einfach nur ein Windows problem war, das Log habe ich dennoch eingefügt. Code:
ATTFilter Windows wird nach unerwartetem Herrunterfahren wieder ausgeführt.
Problemsignatur:
Problemereignisname: BlueScreen
Betriebsystemversion: 6.1.7601.2.1.0.768.3
Gebietsschema-ID: 1031
Zusatzinformationen zum Problem:
BCCode: 1000009f
BCP1: 0000000000000004
BCP2: 0000000000000258
BCP3: FFFFFA80036F8040
BCP4: FFFFF80000B9C510
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1
Dateien, die bei der Beschreibung des Problems hilfreich sind:
C:\Windows\Minidump\052413-18720-01.dmp
C:\Users\Klaus\AppData\Local\Temp\WER-39889-0.sysdata.xml
Lesen Sie unsere Datenschutzbestimmungen online:
hxxp://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0407
Wenn die Onlinedatenschutzbestimmungen nicht verfügbar sind, lesen Sie unsere Datenschutzbestimmungen offline:
C:\Windows\system32\de-DE\erofflps.txt
Code:
ATTFilter Untersuchung von Objekten: wurde abgeschlossen vor weniger als einer Minute (Ereignis: 40, Objekte: 907137, Zeit: 02:21:18)
23.05.13 14:52 Aufgabe wurde abgeschlossen
23.05.13 14:52 Desinfiziert: HEUR:Trojan.Win32.Generic HKEY_USERS\S-1-5-21-775475283-77959746-1030976294-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon/Shell
23.05.13 14:52 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat
23.05.13 14:52 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd
23.05.13 14:51 Gefunden: HEUR:Trojan.Win32.Generic C:/ProgramData/Microsoft/Microsoft Antimalware/LocalCopy/{EB555C29-E4BC-5496-9A38-CD8EAE4A1C88}-feibtyd/PE-Crypt.XorPE
23.05.13 14:51 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat Zurückgestellt
23.05.13 14:51 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat
23.05.13 14:29 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat Zurückgestellt
23.05.13 14:29 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat
23.05.13 14:29 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat Zurückgestellt
23.05.13 14:29 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat
23.05.13 14:23 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd Zurückgestellt
23.05.13 14:23 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd
23.05.13 14:11 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd Zurückgestellt
23.05.13 14:11 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd
23.05.13 13:55 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/ProgramData/Microsoft/Microsoft Antimalware/LocalCopy/{EB555C29-E4BC-5496-9A38-CD8EAE4A1C88}-feibtyd/PE-Crypt.XorPE Zurückgestellt
23.05.13 13:55 Gefunden: HEUR:Trojan.Win32.Generic C:/ProgramData/Microsoft/Microsoft Antimalware/LocalCopy/{EB555C29-E4BC-5496-9A38-CD8EAE4A1C88}-feibtyd/PE-Crypt.XorPE
23.05.13 13:50 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/ProgramData/Microsoft/Microsoft Antimalware/LocalCopy/{EB555C29-E4BC-5496-9A38-CD8EAE4A1C88}-feibtyd/PE-Crypt.XorPE Zurückgestellt
23.05.13 13:50 Gefunden: HEUR:Trojan.Win32.Generic C:/ProgramData/Microsoft/Microsoft Antimalware/LocalCopy/{EB555C29-E4BC-5496-9A38-CD8EAE4A1C88}-feibtyd/PE-Crypt.XorPE
23.05.13 13:42 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat Zurückgestellt
23.05.13 13:42 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat
23.05.13 13:41 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat Zurückgestellt
23.05.13 13:41 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat
23.05.13 13:36 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd Zurückgestellt
23.05.13 13:36 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd
23.05.13 13:24 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd Zurückgestellt
23.05.13 13:24 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd
23.05.13 13:08 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/ProgramData/Microsoft/Microsoft Antimalware/LocalCopy/{EB555C29-E4BC-5496-9A38-CD8EAE4A1C88}-feibtyd/PE-Crypt.XorPE Zurückgestellt
23.05.13 13:08 Gefunden: HEUR:Trojan.Win32.Generic C:/ProgramData/Microsoft/Microsoft Antimalware/LocalCopy/{EB555C29-E4BC-5496-9A38-CD8EAE4A1C88}-feibtyd/PE-Crypt.XorPE
23.05.13 13:07 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat Zurückgestellt
23.05.13 13:07 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat
23.05.13 13:07 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat Zurückgestellt
23.05.13 13:07 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Roaming/skype.dat
23.05.13 13:01 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd Zurückgestellt
23.05.13 13:01 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd
23.05.13 12:49 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd Zurückgestellt
23.05.13 12:49 Gefunden: HEUR:Trojan.Win32.Generic C:/Users/Klaus/AppData/Local/Temp/feibtyd
23.05.13 12:32 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/ProgramData/Microsoft/Microsoft Antimalware/LocalCopy/{EB555C29-E4BC-5496-9A38-CD8EAE4A1C88}-feibtyd/PE-Crypt.XorPE Zurückgestellt
23.05.13 12:32 Gefunden: HEUR:Trojan.Win32.Generic C:/ProgramData/Microsoft/Microsoft Antimalware/LocalCopy/{EB555C29-E4BC-5496-9A38-CD8EAE4A1C88}-feibtyd/PE-Crypt.XorPE
23.05.13 12:31 Aufgabe wurde gestartet
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:25 on 23/05/2013 (Klaus)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
OTL Logfile: Code:
ATTFilter OTL logfile created on: 23.05.2013 15:29:44 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = J:\ 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16540) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,99 Gb Total Physical Memory | 2,58 Gb Available Physical Memory | 64,55% Memory free 7,98 Gb Paging File | 6,60 Gb Available in Paging File | 82,70% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 407,62 Gb Total Space | 332,96 Gb Free Space | 81,69% Space Free | Partition Type: NTFS Drive D: | 523,89 Gb Total Space | 523,79 Gb Free Space | 99,98% Space Free | Partition Type: NTFS Drive J: | 3,73 Gb Total Space | 3,73 Gb Free Space | 99,98% Space Free | Partition Type: FAT32 Computer Name: KLAUS-PC | User Name: Klaus | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.05.23 15:22:10 | 000,602,112 | ---- | M] (OldTimer Tools) -- J:\OTL.exe PRC - [2013.02.26 00:32:22 | 001,260,320 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.12.18 16:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.10.13 17:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2011.05.24 10:33:30 | 001,840,128 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe PRC - [2010.05.04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe PRC - [2007.06.15 13:57:42 | 000,145,504 | ---- | M] (B.H.A Corporation) -- C:\Windows\SysWOW64\bgsvcgen.exe ========== Modules (No Company Name) ========== ========== Services (SafeList) ========== SRV - [2013.02.26 00:32:22 | 001,260,320 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2013.01.27 12:34:32 | 000,379,360 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV - [2013.01.27 12:34:32 | 000,022,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.12.18 16:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.10.21 15:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011.10.13 17:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate) SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2011.05.24 10:33:30 | 001,840,128 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs) SRV - [2011.04.26 13:54:12 | 002,702,848 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2010.05.04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2007.06.15 13:57:42 | 000,145,504 | ---- | M] (B.H.A Corporation) [Auto | Running] -- C:\Windows\SysWOW64\bgsvcgen.exe -- (bgsvcgen) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.01.20 16:59:04 | 000,130,008 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2012.05.14 18:41:32 | 000,926,824 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL8192cu.sys -- (RTL8192cu) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2011.09.08 20:27:22 | 010,203,648 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2011.09.08 18:52:40 | 000,310,784 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2011.07.08 01:21:28 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.03.17 14:04:20 | 000,188,544 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdxhc.sys -- (amdxhc) DRV:64bit: - [2011.03.17 14:04:18 | 000,087,168 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdhub30.sys -- (amdhub30) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.03.04 16:00:14 | 000,390,632 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci) DRV:64bit: - [2011.03.04 16:00:14 | 000,126,952 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3) DRV:64bit: - [2010.12.15 17:06:46 | 000,047,232 | R--- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter) DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.21 05:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2010.07.27 23:01:42 | 001,918,976 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athurx.sys -- (athur) DRV:64bit: - [2010.04.28 08:57:50 | 000,061,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2010.02.18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6D BB 4A 3E 0F 4F CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKCU\..\SearchScopes\{46624C93-101E-4C21-87D3-70838B7BF461}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=MGX&o=15359&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=JQ&apn_dtid=YYYYYYYYDE&apn_uid=D64067E8-1AB3-4975-9E85-636B89D1E84C&apn_sauid=A1B5A558-10CD-426B-9ABA-8D8740682185 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programme\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1FF8872E-17AF-4932-A8A1-43265C56DB80}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4A7050D7-87A0-4B61-8D62-58E1195FC319}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0859CE4-87F4-4696-B4E5-94552ABDDD86}: DhcpNameServer = 192.168.123.254 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.05.23 14:30:46 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0 [2013.05.12 11:01:04 | 000,000,000 | ---D | C] -- C:\Users\Klaus\Documents\Druckerpatronen,Leuchtmittel,Getränke [2013.05.11 15:15:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation ========== Files - Modified Within 30 Days ========== [2013.05.23 16:09:01 | 000,000,054 | ---- | M] () -- C:\.directory [2013.05.23 15:26:09 | 001,500,254 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.05.23 15:26:09 | 000,654,594 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.05.23 15:26:09 | 000,616,476 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.05.23 15:26:09 | 000,130,208 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.05.23 15:26:09 | 000,106,598 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.05.23 15:25:34 | 000,000,000 | ---- | M] () -- C:\Users\Klaus\defogger_reenable [2013.05.23 15:01:55 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.05.23 15:01:55 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.05.23 14:54:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.05.23 14:54:22 | 3212,910,592 | -HS- | M] () -- C:\hiberfil.sys [2013.05.23 11:52:48 | 000,000,004 | ---- | M] () -- C:\Users\Klaus\AppData\Roaming\skype.ini [2013.05.09 19:09:55 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf [2013.05.09 19:09:54 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf ========== Files Created - No Company Name ========== [2013.05.23 16:09:01 | 000,000,054 | ---- | C] () -- C:\.directory [2013.05.23 15:25:34 | 000,000,000 | ---- | C] () -- C:\Users\Klaus\defogger_reenable [2013.05.13 18:15:37 | 000,000,004 | ---- | C] () -- C:\Users\Klaus\AppData\Roaming\skype.ini [2013.05.11 12:34:52 | 002,953,448 | ---- | C] () -- C:\Windows\SysNative\nvcoproc.bin [2013.05.09 19:09:55 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf [2013.05.09 19:09:54 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf [2012.06.20 15:52:48 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat [2012.06.20 15:52:48 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat [2012.06.20 15:52:48 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat [2012.06.20 15:52:48 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat [2012.06.20 15:52:48 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat [2012.06.20 15:52:48 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat [2012.06.20 15:52:48 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat [2012.06.20 15:52:48 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat [2012.06.20 15:52:48 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat [2012.06.20 15:52:48 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat [2012.06.20 15:52:48 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat [2012.06.20 15:52:48 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat [2012.06.20 15:52:48 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat [2012.06.20 15:52:48 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat [2012.06.20 15:52:48 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat [2012.06.20 15:52:48 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat [2012.06.20 15:52:48 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat [2012.06.20 15:52:48 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat [2012.06.20 15:52:48 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini [2012.03.10 17:06:08 | 000,000,000 | ---- | C] () -- C:\Windows\homeDVD-Fotos.INI [2012.03.10 16:58:59 | 000,010,240 | ---- | C] () -- C:\Windows\SysWow64\vidx16.dll [2012.03.10 16:54:05 | 000,006,537 | ---- | C] () -- C:\Windows\mgxoschk.ini [2012.01.22 16:24:53 | 001,532,588 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.10.07 13:09:48 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.10.06 10:22:48 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.07.28 17:49:12 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.02.23 17:00:29 | 000,000,000 | ---D | M] -- C:\Users\Klaus\AppData\Roaming\CD-LabelPrint [2013.01.18 18:56:11 | 000,000,000 | ---D | M] -- C:\Users\Klaus\AppData\Roaming\MAGIX [2012.06.20 15:58:57 | 000,000,000 | ---D | M] -- C:\Users\Klaus\AppData\Roaming\Panasonic [2012.10.17 12:17:56 | 000,000,000 | ---D | M] -- C:\Users\Klaus\AppData\Roaming\simplitec [2013.05.12 12:26:20 | 000,000,000 | ---D | M] -- C:\Users\Klaus\AppData\Roaming\SoftGrid Client [2012.01.22 16:25:25 | 000,000,000 | ---D | M] -- C:\Users\Klaus\AppData\Roaming\TP [2013.04.30 17:22:34 | 000,000,000 | ---D | M] -- C:\Users\Klaus\AppData\Roaming\TP-LINK ========== Purity Check ========== < End of report > OTL Extras OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 23.05.2013 15:29:44 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = J:\
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,99 Gb Total Physical Memory | 2,58 Gb Available Physical Memory | 64,55% Memory free
7,98 Gb Paging File | 6,60 Gb Available in Paging File | 82,70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 407,62 Gb Total Space | 332,96 Gb Free Space | 81,69% Space Free | Partition Type: NTFS
Drive D: | 523,89 Gb Total Space | 523,79 Gb Free Space | 99,98% Space Free | Partition Type: NTFS
Drive J: | 3,73 Gb Total Space | 3,73 Gb Free Space | 99,98% Space Free | Partition Type: FAT32
Computer Name: KLAUS-PC | User Name: Klaus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{007CE266-543E-41FD-9D3C-CFBC276BC8D7}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{01DC8805-C34C-4807-9A72-74ACAC851F34}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{024E06DA-1655-46FA-A7D2-97380D63706E}" = rport=137 | protocol=17 | dir=out | app=system |
"{1287155F-BEDC-4F26-B4E4-130CD337830A}" = rport=10243 | protocol=6 | dir=out | app=system |
"{2369ECA9-5CFE-4DCD-A625-061F7D96980F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{263329F6-4D00-4922-B7B5-26560B9E7335}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{341F9481-AC2F-4E6D-8028-CAD11C63369D}" = rport=445 | protocol=6 | dir=out | app=system |
"{40C26596-53F9-4894-8668-024212146C54}" = lport=138 | protocol=17 | dir=in | app=system |
"{512A663C-7516-4B45-A0A7-4682B91A87FF}" = lport=139 | protocol=6 | dir=in | app=system |
"{5C86AC4F-7E81-4CB1-9180-F050E3FC38D9}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6342D9DF-79B5-4CA2-B378-B7AF2157DDDE}" = rport=139 | protocol=6 | dir=out | app=system |
"{68DC2D83-4B35-4A3D-8269-73D9B4BD4332}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{73084310-A94E-4E31-A6F4-C99D9CDAE50B}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8EA50F48-4D4F-4546-859D-915CAB82C097}" = lport=2869 | protocol=6 | dir=in | app=system |
"{9D3ED150-C5AD-472B-865E-0E5A90C3A838}" = rport=138 | protocol=17 | dir=out | app=system |
"{A6041BAB-A826-4BA7-8222-F12096D8B6CA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{AA53931E-862B-4F67-95A4-778B268EE8EA}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B6390C51-BF02-4150-9251-9E6419D40F37}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C00EEFC9-4DA1-465C-ADBA-FC719AE801B5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CB35A32B-260E-4E19-A834-646A3C2289B5}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{CD78ACE3-67AA-4048-854D-ECACF131D14B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{DA33A895-E5BA-4AAD-B2FC-14DA56EA8A2C}" = lport=445 | protocol=6 | dir=in | app=system |
"{E59155E2-44EA-4A6E-B057-96379D45E168}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EE9D6887-AD83-450E-AC76-8CCACAADAD51}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F1084E83-98DA-4D3D-9BDE-ACE468F72CA0}" = lport=137 | protocol=17 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D1B0AE0-8717-4889-8212-287198FAE9AC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{11E1E627-154C-41E9-B772-34C0B3BAEAFB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1DECA909-1AB3-4A8F-A5ED-214AD023E5AD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{21EAA13C-BA60-4458-9902-39E517D7D465}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{2CD3EB67-DD28-4093-8B1F-3EFD61253E31}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{3257A776-B619-45AC-AC2C-3F187020F379}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3B398ED5-363D-4190-BC12-7A7951D4BACD}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{51E730A1-4D2B-499E-9268-143183A2C16D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6F101C44-396A-42C4-BB3A-F9FE6136D1A5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{7281E951-D52F-4780-B268-B144CFB89CAF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{7AB9296F-D73E-4DC2-B7E4-60CE8EDD6198}" = protocol=6 | dir=out | app=system |
"{87DDF34B-2E4C-4CC5-AC1D-4C50DF38A22B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{9231B55A-5E6F-4F30-8789-53D7F114CDAD}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{942BADF5-20FC-481D-AA24-403CAEABE620}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{98005A38-BD7F-4016-B1D2-F66889A944D6}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9ABFEB32-2DE9-4A40-9163-7D821A37B1A2}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{C8B0A54A-CEDD-4111-B023-CD782E496920}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D389651A-1A4B-469E-A15F-5CCAE66B97BF}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{DC936C0E-EC9B-4062-87B3-BC612D3364E4}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe |
"{E9EB1D42-6AEE-491E-BE3D-044D8E0897A6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FAB83277-676E-4016-9D87-82B803B84628}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{FB51AD38-3E71-4EB7-8108-DD688E8CF897}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{0EB82BB5-F16A-4906-A001-CE8AFC65BBE5}" = MAGIX Fotos auf DVD 2013 Deluxe
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4800_series" = Canon iP4800 series Printer Driver
"{17B77355-3934-4D0E-8FAC-C420482C8E7D}" = Windows Live Family Safety
"{26A24AE4-039D-4CA4-87B4-2F86416030FF}" = Java(TM) 6 Update 30 (64-bit)
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5A2C499A-B689-4CF4-8441-DD659164B939}" = MAGIX Speed burnR (MSI)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.11.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.24.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{D074F2DC-C5A4-0AE9-2859-32AFB40A2149}" = AMD Catalyst Install Manager
"{D954C6C2-544B-4091-A47F-11E77162883E}" = Microsoft Security Client
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F83779DF-E1F5-43A2-A7BE-732F856FADB7}" = Microsoft SQL Server Compact 3.5 SP1 x64 English
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}" = Nero MediaHub 10
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{228CBD40-FE56-4183-AB86-05A7C0D741FB}" = simplitec simplicheck
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{26B52E5B-1620-4676-9B46-B6C56B8105CE}" = TP-LINK TL-WN821N Driver
"{2CDCCE7E-55D5-40CC-AEA0-ABA54713501F}" = LUMIX Simple Viewer
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{319D91C6-3D44-436C-9F79-36C0D22372DC}" = TP-LINK Wireless Configuration Utility
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{43FBAB46-5969-4200-9958-1FF81FEE506F}" = Nero 10 Movie ThemePack 1
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C5F8503-55D2-4398-858C-362B7A7AF51C}" = Firebird SQL Server - MAGIX Edition
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{959282E3-55A9-49D8-B885-D27CF8A2FD82}" = PHOTOfunSTUDIO 5.1 HD Edition
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9DBEBC-C800-4776-A970-D76D6AA405B1}" = PHOTOfunSTUDIO -viewer-
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A231505D-0C93-A79B-15A0-095E0742C8C2}" = Catalyst Control Center InstallProxy
"{A68575CE-050E-4E1F-A053-58BE8D9DE7AB}" = ArcSoft MediaImpression 2
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.6) - Deutsch
"{ADEF1F0B-635E-4041-B50F-A510C1B4D2C5}" = Nero Multimedia Suite 10 Essentials
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}" = Asmedia ASM104x USB 3.0 Host Controller Driver
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Canon iP4800 series Benutzerregistrierung" = Canon iP4800 series Benutzerregistrierung
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"MAGIX_{0EB82BB5-F16A-4906-A001-CE8AFC65BBE5}" = MAGIX Fotos auf DVD 2013 Deluxe
"MAGIX_{5A2C499A-B689-4CF4-8441-DD659164B939}" = MAGIX Speed burnR (MSI)
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"WinLiveSuite_Wave3" = Windows Live Essentials
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 30.03.2013 12:46:50 | Computer Name = Klaus-PC | Source = WinMgmt | ID = 10
Description =
Error - 01.04.2013 05:52:01 | Computer Name = Klaus-PC | Source = WinMgmt | ID = 10
Description =
Error - 03.04.2013 03:45:54 | Computer Name = Klaus-PC | Source = WinMgmt | ID = 10
Description =
Error - 03.04.2013 05:16:16 | Computer Name = Klaus-PC | Source = WinMgmt | ID = 10
Description =
Error - 03.04.2013 13:48:33 | Computer Name = Klaus-PC | Source = WinMgmt | ID = 10
Description =
Error - 04.04.2013 09:51:40 | Computer Name = Klaus-PC | Source = WinMgmt | ID = 10
Description =
Error - 04.04.2013 10:43:26 | Computer Name = Klaus-PC | Source = WinMgmt | ID = 10
Description =
Error - 05.04.2013 05:39:53 | Computer Name = Klaus-PC | Source = WinMgmt | ID = 10
Description =
Error - 05.04.2013 06:08:01 | Computer Name = Klaus-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 06.04.2013 09:05:57 | Computer Name = Klaus-PC | Source = WinMgmt | ID = 10
Description =
[ Media Center Events ]
Error - 03.03.2013 10:58:46 | Computer Name = Klaus-PC | Source = MCUpdate | ID = 0
Description = 15:58:42 - Fehler beim Herstellen der Internetverbindung. 15:58:42
- Serververbindung konnte nicht hergestellt werden..
Error - 03.03.2013 12:00:53 | Computer Name = Klaus-PC | Source = MCUpdate | ID = 0
Description = 17:00:53 - Fehler beim Herstellen der Internetverbindung. 17:00:53
- Serververbindung konnte nicht hergestellt werden..
Error - 03.03.2013 12:00:59 | Computer Name = Klaus-PC | Source = MCUpdate | ID = 0
Description = 17:00:58 - Fehler beim Herstellen der Internetverbindung. 17:00:58
- Serververbindung konnte nicht hergestellt werden..
Error - 10.03.2013 10:01:21 | Computer Name = Klaus-PC | Source = MCUpdate | ID = 0
Description = 15:01:21 - Fehler beim Herstellen der Internetverbindung. 15:01:21
- Serververbindung konnte nicht hergestellt werden..
Error - 10.03.2013 10:01:31 | Computer Name = Klaus-PC | Source = MCUpdate | ID = 0
Description = 15:01:26 - Fehler beim Herstellen der Internetverbindung. 15:01:26
- Serververbindung konnte nicht hergestellt werden..
Error - 11.03.2013 04:37:02 | Computer Name = Klaus-PC | Source = MCUpdate | ID = 0
Description = 09:37:02 - Fehler beim Herstellen der Internetverbindung. 09:37:02
- Serververbindung konnte nicht hergestellt werden..
Error - 11.03.2013 04:37:11 | Computer Name = Klaus-PC | Source = MCUpdate | ID = 0
Description = 09:37:07 - Fehler beim Herstellen der Internetverbindung. 09:37:07
- Serververbindung konnte nicht hergestellt werden..
Error - 12.04.2013 06:22:24 | Computer Name = Klaus-PC | Source = MCUpdate | ID = 0
Description = 12:22:24 - Fehler beim Herstellen der Internetverbindung. 12:22:24
- Serververbindung konnte nicht hergestellt werden..
Error - 12.04.2013 06:22:34 | Computer Name = Klaus-PC | Source = MCUpdate | ID = 0
Description = 12:22:29 - Fehler beim Herstellen der Internetverbindung. 12:22:29
- Serververbindung konnte nicht hergestellt werden..
Error - 28.04.2013 08:10:04 | Computer Name = Klaus-PC | Source = MCUpdate | ID = 0
Description = 14:09:42 - Fehler beim Herstellen der Internetverbindung. 14:09:42
- Serververbindung konnte nicht hergestellt werden..
[ System Events ]
Error - 30.04.2013 11:30:43 | Computer Name = Klaus-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.
Neue
Signaturversion: Vorherige Signaturversion: 1.147.1631.0 Aktualisierungsquelle:
%%859 Aktualisierungsphase: %%853 Quellpfad: hxxp://www.microsoft.com Signaturtyp:
%%800 Aktualisierungstyp: %%803 Benutzer: NT-AUTORITÄT\SYSTEM Aktuelle Modulversion:
Vorherige Modulversion: 1.1.9302.0 Fehlercode: 0x8024001e Fehlerbeschreibung: Unerwartetes
Problem bei der Überprüfung auf Updates. Informationen zum Installieren von Updates
oder zur Problembehandlung finden Sie unter "Hilfe und Support".
Error - 30.04.2013 11:31:44 | Computer Name = Klaus-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad:
C:\Windows\system32\Rtlihvs.dll Fehlercode: 126
Error - 30.04.2013 13:58:01 | Computer Name = Klaus-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad:
C:\Windows\system32\Rtlihvs.dll Fehlercode: 126
Error - 04.05.2013 04:04:01 | Computer Name = Klaus-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad:
C:\Windows\system32\Rtlihvs.dll Fehlercode: 126
Error - 04.05.2013 05:18:57 | Computer Name = Klaus-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.
Error - 04.05.2013 05:22:11 | Computer Name = Klaus-PC | Source = bowser | ID = 8003
Description =
Error - 09.05.2013 07:16:09 | Computer Name = Klaus-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad:
C:\Windows\system32\Rtlihvs.dll Fehlercode: 126
Error - 09.05.2013 10:56:28 | Computer Name = Klaus-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad:
C:\Windows\system32\Rtlihvs.dll Fehlercode: 126
Error - 09.05.2013 12:32:48 | Computer Name = Klaus-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad:
C:\Windows\system32\Rtlihvs.dll Fehlercode: 126
Error - 11.05.2013 04:58:10 | Computer Name = Klaus-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad:
C:\Windows\system32\Rtlihvs.dll Fehlercode: 126
< End of report >
Gmer Log [code] GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-24 07:47:32
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST31000524AS rev.JC4B 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Klaus\AppData\Local\Temp\kwtoqpog.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e71465 2 bytes [E7, 75]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e714bb 2 bytes [E7, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe[3372] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075e71465 2 bytes [E7, 75]
.text C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe[3372] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000075e714bb 2 bytes [E7, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e71465 2 bytes [E7, 75]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e714bb 2 bytes [E7, 75]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3944] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e71465 2 bytes [E7, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3944] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e714bb 2 bytes [E7, 75]
.text ... * 2
---- EOF - GMER 2.1 ----
Geändert von BadDay (24.05.2013 um 07:08 Uhr) |
| Themen zu Bundestrojaner (weißer Bildschirm) |
| bho, bildschirm, bingbar, browser, error, fehler, firefox, flash player, helper, heur, hilfreich, home, homepage, iexplore.exe, install.exe, kaspersky, logfile, microsoft office starter 2010, minidump, plug-in, problem, realtek, registry, richtlinie, scan, security, software, svchost.exe, trojaner, unerwartetem, usb, windows |
Baum-Darstellung