|
Plagegeister aller Art und deren Bekämpfung: Komische Probleme IIWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
04.06.2013, 06:43 | #1 |
| Komische Probleme II Hallo, ich hatte mein Problem schon einmal am 28.05.13 ( http://www.trojaner-board.de/135710-...-probleme.html ) vorgestellt und hatte auch den Eindruck, dass alles wieder ok ist. Aber ... ich hatte seit dem nun doch wieder zwei - drei mal das Problem, dass sich der PC "aufhängt" und ich nichts mehr machen kann, das ein Bluescreen kommt ohne ersichtlichen Grund und als ich den Computer heute frisch angemacht habe, kam gleich ein Bluescreen, ohne das ich irgendwas gemacht habe. Das war dann auch der Zeitpunkt an dem ich mir dachte, frag doch nochmal nach ... Kann es sich dabei auch um ein Hardwareproblem handeln? MfG Thomas Geändert von Thomas030 (04.06.2013 um 06:44 Uhr) Grund: Link eingefügt. |
04.06.2013, 09:22 | #2 |
/// the machine /// TB-Ausbilder | Komische Probleme II Hi,
__________________klar kann es das. Genau Meldung im Bluescreen?
__________________ |
04.06.2013, 13:50 | #3 |
| Komische Probleme II Hmmm schwer zu sagen ... seit gerade geht er nicht mehr an.
__________________Er beginnt hoch zu fahren aber nach wenigen sekunden geht er wieder aus (alsob der Strom weg ist) und fängt von vorne an ... dann wiederholt sich das alles. Hatte mir leider nicht notiert, was aufem Bluescreen stand. Kann man mir hir noch helfen oder kann ich "ihn" zu Grabe tragen? |
04.06.2013, 14:34 | #4 |
/// the machine /// TB-Ausbilder | Komische Probleme II Nee, nit weg werfen, wir schauen erstmal. Was für ein Betriebsystem?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
04.06.2013, 14:40 | #5 |
| Komische Probleme II Es ist Windows 7 drauf |
04.06.2013, 14:41 | #6 |
/// the machine /// TB-Ausbilder | Komische Probleme II [indent] Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8) Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
__________________ --> Komische Probleme II |
04.06.2013, 14:55 | #7 |
| Komische Probleme II Komische Geschichte ... Habe den USB Stick wie beschrieben angeschloss und beim Hochfahren F8 gedrückt ... aber anstelle irgendeines Boot Managers hat er ganz normal hochgefahren. Was jetzt? Ich würde ja ganz blauäugig vermuten, dass es kein Hardwareproblem ist. |
04.06.2013, 17:07 | #8 | |
/// the machine /// TB-Ausbilder | Komische Probleme II Ich tipp genau anders rum Du musst schnell genu gpaar mal f8 drücken, mindestens die Auswahl Angesicherter Modus muss kommen. Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
04.06.2013, 17:26 | #9 |
| Komische Probleme II Genau das ist ja das komische ... nachdem ich den usb stick dran gemacht hatte, den power knopf gedrückt habe und schnell hintereinander F8 gedrückt habe, hat er wieder ganz normal hochgefahren ... ohne fehlermeldung oder bluescreen |
04.06.2013, 17:28 | #10 |
/// the machine /// TB-Ausbilder | Komische Probleme II Also du bist jetzt wieder normal in Windows? Gibt es nen Ordner C:\Windows\Minidumps? Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden ).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
04.06.2013, 18:04 | #11 |
| Komische Probleme II Ich dreh noh durch hier Einen Ordner Minidump gibt es aber halt ohne "s". Als OTL durchgelaufen ist und ich das Programm geschlossen habe um dann die Logs zu posen kam dann doch mal wieder der Bluescreen mit folgendem Text: "A problem has been detected and windows has been shut down to prevent damage to your computer. The system encountered an uncorrectable hardware error. If this is the first time you´ve seen this Stop error screen, restart your computer. If this screen appears again, follow these steps: Check to make sure any new hardware or software is properly instaled. If this is a new installation, ask your hardware or software manufacturer fpr any windows updates you might need. If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use safe Mode to remove or disable components, restart yout computer, pres F8 to select Advanced Startup Options, and then select Safe Mode. Technical information: *** STOP: 0x00000124 (0x0000000000000000, 0xFFFFFA8007F21038, 0x00000000B4002000, 0x0000000072000135) Collecting data for crash dump ... Initializing disk for crash dump ... Beginning dump of physical memory. Dumping physical memory to disk: 15" Der Bluescreen ist noch an ... schreibe wieder über den Laptop. so ich habe den pc nach dem bluescreen nochmal neugestartet und über denn boot manager die geschichte mit dem usb stick gemacht. hier das log: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-06-2013 02 Ran by SYSTEM on 04-06-2013 19:59:50 Running from E:\ Windows 7 Home Premium (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log. ==================== Registry (Whitelisted) ================== HKLM-x32\...\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-04-15] (DivX, LLC) HKLM-x32\...\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1263952 2013-02-13] () HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation) HKLM-x32\...\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software) HKU\Ismir Uebel\...\Run: [FileHippo.com] "C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe" /background [307712 2012-11-23] (FileHippo.com) HKU\Ismir Uebel\...\Policies\system: [LogonHoursAction] 2 HKU\Ismir Uebel\...\Policies\system: [DontDisplayLogonHoursWarnings] 1 HKU\täglicher Gebrauch\...\Policies\system: [LogonHoursAction] 2 HKU\täglicher Gebrauch\...\Policies\system: [DontDisplayLogonHoursWarnings] 1 Startup: C:\ProgramData\Start Menu\Programs\Startup\Secunia PSI Tray.lnk ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia) ==================== Services (Whitelisted) ================= S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software) S2 MotoHelper; C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [226624 2011-01-27] () S2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1328736 2012-09-24] (Secunia) S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [656480 2012-09-24] (Secunia) ==================== Drivers (Whitelisted) ==================== S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software) S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software) S1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software) S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] () S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1025808 2013-05-09] (AVAST Software) S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378432 2013-05-09] (AVAST Software) S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software) S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-05-09] () S3 trustms; C:\Windows\System32\drivers\trustms.sys [12416 2010-11-15] () ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-06-04 17:37 - 2013-06-04 17:37 - 00059886 ____A C:\Users\Ismir Uebel\Desktop\OTL.Txt 2013-06-04 17:37 - 2013-06-04 17:37 - 00055634 ____A C:\Users\Ismir Uebel\Desktop\Extras.Txt 2013-06-04 17:30 - 2013-06-04 17:30 - 00602112 ____A (OldTimer Tools) C:\Users\Ismir Uebel\Desktop\OTL.exe 2013-06-02 20:42 - 2013-06-02 20:42 - 00007105 ____A C:\Users\Ismir Uebel\AppData\Local\recently-used.xbel 2013-06-02 17:04 - 2013-06-02 17:04 - 00000000 ____A C:\END 2013-06-01 10:45 - 2013-06-01 10:47 - 74337200 ____A (DivX, LLC) C:\Users\Ismir Uebel\Downloads\DivXInstaller(1).exe 2013-05-29 20:07 - 2013-05-29 20:07 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client 2013-05-29 20:02 - 2013-05-29 20:02 - 04808816 ____A (FileZilla Project) C:\Users\Ismir Uebel\Downloads\FileZilla_3.7.0.2_win32-setup.exe 2013-05-29 11:16 - 2013-05-29 11:16 - 00001147 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-05-29 11:16 - 2013-05-29 11:16 - 00000000 ____D C:\Users\Ismir Uebel\AppData\Roaming\Mozilla 2013-05-29 11:16 - 2013-05-29 11:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-05-29 08:35 - 2013-05-29 08:35 - 00000000 ____D C:\Windows\ERUNT 2013-05-29 08:34 - 2013-05-29 08:34 - 00000000 ____D C:\JRT 2013-05-29 08:32 - 2013-05-29 08:32 - 00000956 ____A C:\AdwCleaner[S1].txt 2013-05-28 22:54 - 2013-05-28 22:54 - 00020013 ____A C:\ComboFix.txt 2013-05-28 22:45 - 2013-05-28 22:54 - 00000000 ____D C:\Qoobox 2013-05-28 22:45 - 2013-05-28 22:52 - 00000000 ____D C:\Windows\erdnt 2013-05-28 22:45 - 2011-06-26 07:45 - 00256000 ____A C:\Windows\PEV.exe 2013-05-28 22:45 - 2010-11-07 18:20 - 00208896 ____A C:\Windows\MBR.exe 2013-05-28 22:45 - 2009-04-20 05:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2013-05-28 22:45 - 2000-08-31 01:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2013-05-28 22:45 - 2000-08-31 01:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2013-05-28 22:45 - 2000-08-31 01:00 - 00098816 ____A C:\Windows\sed.exe 2013-05-28 22:45 - 2000-08-31 01:00 - 00080412 ____A C:\Windows\grep.exe 2013-05-28 22:45 - 2000-08-31 01:00 - 00068096 ____A C:\Windows\zip.exe 2013-05-28 21:35 - 2013-05-28 21:35 - 00000000 ____D C:\FRST 2013-05-28 18:24 - 2013-05-28 19:34 - 00231759 ____A C:\Users\Ismir Uebel\Desktop\Neuer Trainingsplan 3er Split.odt 2013-05-24 09:03 - 2013-05-24 09:03 - 02369213 ____A C:\Users\Ismir Uebel\Downloads\voegel.odt 2013-05-21 21:12 - 2013-05-21 21:12 - 12179221 ____A C:\Users\Ismir Uebel\Downloads\Wisdom_In_Chains-Pocono_Ghosts-EP-Vinyl-2011-GRAVEWISH.rar 2013-05-21 19:46 - 2013-05-21 19:57 - 94546586 ____A C:\Users\Ismir Uebel\Downloads\Wisdom_In_Chains-Everything_You_Know-2009-GRAVEWISH_nled.rar 2013-05-21 19:46 - 2013-05-21 19:50 - 106912383 ____A C:\Users\Ismir Uebel\Downloads\06 - The Missing Links (2012).zip 2013-05-21 19:43 - 2013-05-21 19:47 - 80052140 ____A C:\Users\Ismir Uebel\Downloads\WiC - CWar.rar 2013-05-21 19:42 - 2013-05-21 19:46 - 87619507 ____A C:\Users\Ismir Uebel\Downloads\02 - Die Young (2005).zip 2013-05-21 19:42 - 2013-05-21 19:43 - 20513069 ____A C:\Users\Ismir Uebel\Downloads\03 - Vigilante Saint EP (2006).zip 2013-05-21 19:41 - 2013-05-21 19:42 - 48373281 ____A C:\Users\Ismir Uebel\Downloads\01 - Self-Titled (2002).zip 2013-05-21 18:09 - 2013-05-21 18:11 - 61325745 ____A C:\Users\Ismir Uebel\Downloads\Brumm Brumm.rar 2013-05-21 11:11 - 2013-05-21 11:11 - 21289608 ____A (Mozilla) C:\Users\Ismir Uebel\Downloads\Firefox Setup 21.0(1).exe 2013-05-17 07:30 - 2013-05-17 07:31 - 50107976 ____A (Adobe Systems Incorporated) C:\Users\Ismir Uebel\Downloads\AdbeRdr11003_en_US(1).exe 2013-05-17 07:30 - 2013-05-17 07:30 - 21289608 ____A (Mozilla) C:\Users\Ismir Uebel\Downloads\Firefox Setup 21.0.exe 2013-05-16 18:56 - 2013-05-16 18:57 - 53431448 ____A C:\Users\Ismir Uebel\Downloads\Hatebreed - The Divinity Of Purpose (2013).rar 2013-05-16 08:45 - 2013-05-16 08:45 - 50107976 ____A (Adobe Systems Incorporated) C:\Users\Ismir Uebel\Downloads\AdbeRdr11003_en_US.exe 2013-05-15 22:48 - 2013-04-05 07:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-05-15 22:48 - 2013-04-05 07:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-05-15 22:48 - 2013-04-05 07:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2013-05-15 22:48 - 2013-04-05 07:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-05-15 22:48 - 2013-04-05 07:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-05-15 22:48 - 2013-04-05 07:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-05-15 22:48 - 2013-04-05 07:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-05-15 22:48 - 2013-04-05 07:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-05-15 22:48 - 2013-04-05 07:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-05-15 22:48 - 2013-04-05 07:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-05-15 22:48 - 2013-04-05 07:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll 2013-05-15 22:48 - 2013-04-05 07:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2013-05-15 22:48 - 2013-04-05 07:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-05-15 22:48 - 2013-04-05 07:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2013-05-15 22:48 - 2013-04-05 06:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-05-15 22:48 - 2013-04-05 06:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-05-15 22:48 - 2013-04-05 06:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-05-15 22:48 - 2013-04-05 06:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-05-15 22:48 - 2013-04-05 06:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-05-15 22:48 - 2013-04-05 06:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-05-15 22:48 - 2013-04-05 06:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-05-15 22:48 - 2013-04-05 06:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-05-15 22:48 - 2013-04-05 06:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-05-15 22:48 - 2013-04-05 06:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-05-15 22:48 - 2013-04-05 06:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-05-15 22:48 - 2013-04-05 06:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-05-15 22:48 - 2013-04-05 06:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-05-15 22:48 - 2013-04-05 05:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-05-15 22:48 - 2013-04-05 05:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-05-15 22:48 - 2013-04-05 04:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe 2013-05-15 22:48 - 2013-04-05 04:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-05-15 19:35 - 2013-04-10 07:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys 2013-05-15 19:35 - 2013-04-10 07:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys 2013-05-15 19:35 - 2013-04-10 04:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-05-15 19:35 - 2013-03-19 06:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll 2013-05-15 19:35 - 2013-03-19 06:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll 2013-05-15 19:35 - 2013-02-27 07:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe 2013-05-15 19:35 - 2013-02-27 06:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2013-05-15 19:35 - 2013-02-27 06:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll 2013-05-15 19:35 - 2013-02-27 06:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll 2013-05-15 19:35 - 2013-02-27 06:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll 2013-05-15 19:35 - 2013-02-27 05:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2013-05-15 19:35 - 2013-02-27 05:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll 2013-05-15 19:35 - 2013-02-27 05:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2013-05-15 19:35 - 2011-02-03 12:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll 2013-05-13 19:40 - 2013-05-15 19:27 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-05-13 19:40 - 2013-05-15 19:27 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-05-13 19:36 - 2013-05-13 19:36 - 00262144 ____N C:\Windows\Minidump\051313-16645-01.dmp 2013-05-13 16:48 - 2013-05-13 16:48 - 04811793 ____A (FileZilla Project) C:\Users\Ismir Uebel\Downloads\FileZilla_3.7.0.1_win32-setup.exe 2013-05-12 12:53 - 2013-05-12 12:53 - 00262576 ____A C:\Windows\msxml4-KB2758694-enu.LOG 2013-05-10 17:14 - 2013-05-10 17:14 - 02434048 ____A C:\Users\Ismir Uebel\Downloads\msxml.msi 2013-05-10 16:36 - 2013-05-10 16:37 - 23382004 ____A C:\Users\Ismir Uebel\Downloads\avast_free_antivirus_setup(2).exe.part 2013-05-10 16:34 - 2013-05-10 16:35 - 04817686 ____A (FileZilla Project) C:\Users\Ismir Uebel\Downloads\FileZilla_3.7.0_win32-setup.exe 2013-05-10 16:33 - 2013-05-10 16:33 - 00262144 ____N C:\Windows\Minidump\051013-16255-01.dmp 2013-05-09 14:13 - 2013-05-09 14:13 - 00262144 ____N C:\Windows\Minidump\050913-17940-01.dmp 2013-05-08 06:49 - 2013-05-10 17:15 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0 2013-05-08 06:49 - 2013-05-08 06:49 - 00292504 ____A C:\Windows\msxml4-KB954430-enu.LOG 2013-05-08 06:49 - 2013-05-08 06:49 - 00287550 ____A C:\Windows\msxml4-KB973688-enu.LOG 2013-05-07 18:25 - 2013-05-07 18:25 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf 2013-05-07 18:25 - 2013-05-07 18:25 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motmodem_01007.Wdf 2013-05-07 18:25 - 2013-05-07 18:25 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motfilt_01007.Wdf 2013-05-07 18:25 - 2013-05-07 18:25 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf 2013-05-07 18:25 - 2013-05-07 18:25 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motccgp_01007.Wdf 2013-05-07 18:24 - 2013-05-07 18:24 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf 2013-05-07 18:24 - 2013-05-07 18:24 - 00000000 ____D C:\Program Files\Motorola Inc 2013-05-07 18:24 - 2013-05-07 18:24 - 00000000 ____D C:\Program Files\Common Files\Motorola Shared 2013-05-07 18:24 - 2013-05-07 18:24 - 00000000 ____D C:\Program Files (x86)\Motorola 2013-05-07 06:41 - 2013-05-07 06:41 - 00000629 ____A C:\Users\Ismir Uebel\Desktop\Filme - extern.lnk ==================== One Month Modified Files and Folders ======= 2013-06-04 17:41 - 2013-02-27 21:25 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-06-04 17:37 - 2013-06-04 17:37 - 00059886 ____A C:\Users\Ismir Uebel\Desktop\OTL.Txt 2013-06-04 17:37 - 2013-06-04 17:37 - 00055634 ____A C:\Users\Ismir Uebel\Desktop\Extras.Txt 2013-06-04 17:30 - 2013-06-04 17:30 - 00602112 ____A (OldTimer Tools) C:\Users\Ismir Uebel\Desktop\OTL.exe 2013-06-04 14:59 - 2009-07-14 05:45 - 00014928 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-06-04 14:59 - 2009-07-14 05:45 - 00014928 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-06-04 14:54 - 2013-02-15 22:14 - 01743583 ____A C:\Windows\WindowsUpdate.log 2013-06-04 14:51 - 2013-02-15 22:54 - 00000000 ____D C:\ProgramData\NVIDIA 2013-06-04 14:51 - 2009-07-14 06:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-06-04 14:51 - 2009-07-14 05:51 - 00039857 ____A C:\Windows\setupact.log 2013-06-04 07:26 - 2013-02-16 17:11 - 00000000 ____D C:\Program Files\DivX 2013-06-04 07:26 - 2013-02-16 17:09 - 00000000 ____D C:\Program Files (x86)\DivX 2013-06-04 07:26 - 2013-02-16 17:07 - 00000000 ____D C:\ProgramData\DivX 2013-06-04 07:26 - 2013-02-16 14:37 - 00000000 ____D C:\users\täglicher Gebrauch 2013-06-04 07:26 - 2013-02-16 01:02 - 00000000 ____D C:\Users\Ismir Uebel\AppData\Roaming\Macromedia 2013-06-04 07:26 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration 2013-06-04 07:26 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat 2013-06-04 06:37 - 2013-04-18 05:32 - 00001922 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2013-06-04 06:37 - 2013-02-16 00:30 - 00000000 ____A C:\Windows\SysWOW64\config.nt 2013-06-04 06:36 - 2013-02-15 22:14 - 00000000 ____D C:\users\Ismir Uebel 2013-06-02 20:43 - 2013-04-01 11:55 - 00000000 ____D C:\Users\Ismir Uebel\.gimp-2.8 2013-06-02 20:42 - 2013-06-02 20:42 - 00007105 ____A C:\Users\Ismir Uebel\AppData\Local\recently-used.xbel 2013-06-02 17:04 - 2013-06-02 17:04 - 00000000 ____A C:\END 2013-06-01 10:47 - 2013-06-01 10:45 - 74337200 ____A (DivX, LLC) C:\Users\Ismir Uebel\Downloads\DivXInstaller(1).exe 2013-05-30 05:19 - 2013-02-16 01:26 - 00009778 ____A C:\Windows\PFRO.log 2013-05-29 20:25 - 2013-02-16 17:27 - 00000000 ____D C:\Users\Ismir Uebel\dwhelper 2013-05-29 20:25 - 2013-02-16 17:17 - 00000000 ____D C:\Users\Ismir Uebel\Desktop\Filme - intern 2013-05-29 20:07 - 2013-05-29 20:07 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client 2013-05-29 20:02 - 2013-05-29 20:02 - 04808816 ____A (FileZilla Project) C:\Users\Ismir Uebel\Downloads\FileZilla_3.7.0.2_win32-setup.exe 2013-05-29 11:22 - 2013-02-16 02:58 - 00000000 ____D C:\Users\Ismir Uebel\Desktop\Ismir 2013-05-29 11:16 - 2013-05-29 11:16 - 00001147 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-05-29 11:16 - 2013-05-29 11:16 - 00000000 ____D C:\Users\Ismir Uebel\AppData\Roaming\Mozilla 2013-05-29 11:16 - 2013-05-29 11:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-05-29 11:16 - 2013-03-08 12:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-05-29 08:47 - 2009-07-14 18:58 - 00653928 ____A C:\Windows\System32\perfh007.dat 2013-05-29 08:47 - 2009-07-14 18:58 - 00129800 ____A C:\Windows\System32\perfc007.dat 2013-05-29 08:47 - 2009-07-14 06:13 - 01498506 ____A C:\Windows\System32\PerfStringBackup.INI 2013-05-29 08:35 - 2013-05-29 08:35 - 00000000 ____D C:\Windows\ERUNT 2013-05-29 08:34 - 2013-05-29 08:34 - 00000000 ____D C:\JRT 2013-05-29 08:32 - 2013-05-29 08:32 - 00000956 ____A C:\AdwCleaner[S1].txt 2013-05-28 22:54 - 2013-05-28 22:54 - 00020013 ____A C:\ComboFix.txt 2013-05-28 22:54 - 2013-05-28 22:45 - 00000000 ____D C:\Qoobox 2013-05-28 22:52 - 2013-05-28 22:45 - 00000000 ____D C:\Windows\erdnt 2013-05-28 22:52 - 2009-07-14 03:34 - 00000215 ____A C:\Windows\system.ini 2013-05-28 21:35 - 2013-05-28 21:35 - 00000000 ____D C:\FRST 2013-05-28 19:34 - 2013-05-28 18:24 - 00231759 ____A C:\Users\Ismir Uebel\Desktop\Neuer Trainingsplan 3er Split.odt 2013-05-24 09:03 - 2013-05-24 09:03 - 02369213 ____A C:\Users\Ismir Uebel\Downloads\voegel.odt 2013-05-21 21:12 - 2013-05-21 21:12 - 12179221 ____A C:\Users\Ismir Uebel\Downloads\Wisdom_In_Chains-Pocono_Ghosts-EP-Vinyl-2011-GRAVEWISH.rar 2013-05-21 19:57 - 2013-05-21 19:46 - 94546586 ____A C:\Users\Ismir Uebel\Downloads\Wisdom_In_Chains-Everything_You_Know-2009-GRAVEWISH_nled.rar 2013-05-21 19:50 - 2013-05-21 19:46 - 106912383 ____A C:\Users\Ismir Uebel\Downloads\06 - The Missing Links (2012).zip 2013-05-21 19:47 - 2013-05-21 19:43 - 80052140 ____A C:\Users\Ismir Uebel\Downloads\WiC - CWar.rar 2013-05-21 19:46 - 2013-05-21 19:42 - 87619507 ____A C:\Users\Ismir Uebel\Downloads\02 - Die Young (2005).zip 2013-05-21 19:43 - 2013-05-21 19:42 - 20513069 ____A C:\Users\Ismir Uebel\Downloads\03 - Vigilante Saint EP (2006).zip 2013-05-21 19:42 - 2013-05-21 19:41 - 48373281 ____A C:\Users\Ismir Uebel\Downloads\01 - Self-Titled (2002).zip 2013-05-21 18:11 - 2013-05-21 18:09 - 61325745 ____A C:\Users\Ismir Uebel\Downloads\Brumm Brumm.rar 2013-05-21 11:11 - 2013-05-21 11:11 - 21289608 ____A (Mozilla) C:\Users\Ismir Uebel\Downloads\Firefox Setup 21.0(1).exe 2013-05-17 07:31 - 2013-05-17 07:30 - 50107976 ____A (Adobe Systems Incorporated) C:\Users\Ismir Uebel\Downloads\AdbeRdr11003_en_US(1).exe 2013-05-17 07:30 - 2013-05-17 07:30 - 21289608 ____A (Mozilla) C:\Users\Ismir Uebel\Downloads\Firefox Setup 21.0.exe 2013-05-16 19:38 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2013-05-16 18:57 - 2013-05-16 18:56 - 53431448 ____A C:\Users\Ismir Uebel\Downloads\Hatebreed - The Divinity Of Purpose (2013).rar 2013-05-16 08:45 - 2013-05-16 08:45 - 50107976 ____A (Adobe Systems Incorporated) C:\Users\Ismir Uebel\Downloads\AdbeRdr11003_en_US.exe 2013-05-16 08:42 - 2009-07-14 05:45 - 00315184 ____A C:\Windows\System32\FNTCACHE.DAT 2013-05-15 22:51 - 2013-02-15 23:24 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-05-15 20:41 - 2013-02-16 01:01 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-05-15 20:41 - 2013-02-16 01:01 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-05-15 19:27 - 2013-05-13 19:40 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-05-15 19:27 - 2013-05-13 19:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-05-13 19:37 - 2013-04-08 22:44 - 00000000 ____D C:\Windows\Minidump 2013-05-13 19:36 - 2013-05-13 19:36 - 00262144 ____N C:\Windows\Minidump\051313-16645-01.dmp 2013-05-13 16:48 - 2013-05-13 16:48 - 04811793 ____A (FileZilla Project) C:\Users\Ismir Uebel\Downloads\FileZilla_3.7.0.1_win32-setup.exe 2013-05-12 12:53 - 2013-05-12 12:53 - 00262576 ____A C:\Windows\msxml4-KB2758694-enu.LOG 2013-05-10 17:15 - 2013-05-08 06:49 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0 2013-05-10 17:14 - 2013-05-10 17:14 - 02434048 ____A C:\Users\Ismir Uebel\Downloads\msxml.msi 2013-05-10 16:37 - 2013-05-10 16:36 - 23382004 ____A C:\Users\Ismir Uebel\Downloads\avast_free_antivirus_setup(2).exe.part 2013-05-10 16:35 - 2013-05-10 16:34 - 04817686 ____A (FileZilla Project) C:\Users\Ismir Uebel\Downloads\FileZilla_3.7.0_win32-setup.exe 2013-05-10 16:33 - 2013-05-10 16:33 - 00262144 ____N C:\Windows\Minidump\051013-16255-01.dmp 2013-05-09 15:35 - 2013-03-10 11:12 - 00011776 __ASH C:\Users\Ismir Uebel\Thumbs.db 2013-05-09 14:13 - 2013-05-09 14:13 - 00262144 ____N C:\Windows\Minidump\050913-17940-01.dmp 2013-05-09 09:59 - 2013-04-18 05:32 - 01025808 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys 2013-05-09 09:59 - 2013-04-18 05:32 - 00378432 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys 2013-05-09 09:59 - 2013-04-18 05:32 - 00080816 ____A (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys 2013-05-09 09:59 - 2013-04-18 05:32 - 00072016 ____A (AVAST Software) C:\Windows\System32\Drivers\aswRdr2.sys 2013-05-09 09:59 - 2013-04-18 05:32 - 00064288 ____A (AVAST Software) C:\Windows\System32\Drivers\aswTdi.sys 2013-05-09 09:59 - 2013-04-18 05:32 - 00033400 ____A (AVAST Software) C:\Windows\System32\Drivers\aswFsBlk.sys 2013-05-09 09:59 - 2013-03-01 06:25 - 00189936 ____A C:\Windows\System32\Drivers\aswVmm.sys 2013-05-09 09:59 - 2013-03-01 06:25 - 00065336 ____A C:\Windows\System32\Drivers\aswRvrt.sys 2013-05-09 09:58 - 2013-04-18 05:32 - 00041664 ____A (AVAST Software) C:\Windows\avastSS.scr 2013-05-09 09:58 - 2013-02-16 00:30 - 00287840 ____A (AVAST Software) C:\Windows\System32\aswBoot.exe 2013-05-08 06:49 - 2013-05-08 06:49 - 00292504 ____A C:\Windows\msxml4-KB954430-enu.LOG 2013-05-08 06:49 - 2013-05-08 06:49 - 00287550 ____A C:\Windows\msxml4-KB973688-enu.LOG 2013-05-07 18:25 - 2013-05-07 18:25 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf 2013-05-07 18:25 - 2013-05-07 18:25 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motmodem_01007.Wdf 2013-05-07 18:25 - 2013-05-07 18:25 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motfilt_01007.Wdf 2013-05-07 18:25 - 2013-05-07 18:25 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf 2013-05-07 18:25 - 2013-05-07 18:25 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motccgp_01007.Wdf 2013-05-07 18:24 - 2013-05-07 18:24 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf 2013-05-07 18:24 - 2013-05-07 18:24 - 00000000 ____D C:\Program Files\Motorola Inc 2013-05-07 18:24 - 2013-05-07 18:24 - 00000000 ____D C:\Program Files\Common Files\Motorola Shared 2013-05-07 18:24 - 2013-05-07 18:24 - 00000000 ____D C:\Program Files (x86)\Motorola 2013-05-07 18:24 - 2013-02-15 22:14 - 00000000 ____D C:\Users\Ismir Uebel\AppData\Local\VirtualStore 2013-05-07 06:41 - 2013-05-07 06:41 - 00000629 ____A C:\Users\Ismir Uebel\Desktop\Filme - extern.lnk 2013-05-05 16:17 - 2013-05-04 10:08 - 00000000 ____D C:\Users\Ismir Uebel\Desktop\down ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-05-15 22:47:57 Restore point made on: 2013-05-21 11:13:41 Restore point made on: 2013-05-28 21:01:05 Restore point made on: 2013-06-01 10:38:00 Restore point made on: 2013-06-04 06:40:43 ==================== Memory info =========================== Percentage of memory in use: 8% Total physical RAM: 8191.24 MB Available physical RAM: 7458.22 MB Total Pagefile: 8189.39 MB Available Pagefile: 7440.47 MB Total Virtual: 8192 MB Available Virtual: 8191.85 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:465.76 GB) (Free:370.89 GB) NTFS (Disk=0 Partition=1) ==>[Drive with boot components (obtained from BCD)] Drive e: () (Removable) (Total:7.45 GB) (Free:7.45 GB) FAT32 (Disk=1 Partition=1) Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 0DFADDDB) Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 7 GB) (Disk ID: 6E652072) Partition 1: (Not Active) - (Size=811 GB) - (Type=6E) Partition 2: (Not Active) - (Size=468 GB) - (Type=FF) Partition 3: (Not Active) - (Size=80 GB) - (Type=74) Partition 4: (Not Active) - (Size=26 MB) - (Type=00) Last Boot: 2013-06-03 12:49 ==================== End Of Log ============================ die logs waren auch noch auf dem desktop Code:
ATTFilter OTL logfile created on: 04.06.2013 18:32:37 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Ismir Uebel\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16576) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 8,00 Gb Total Physical Memory | 6,50 Gb Available Physical Memory | 81,21% Memory free 16,00 Gb Paging File | 14,37 Gb Available in Paging File | 89,81% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,76 Gb Total Space | 370,88 Gb Free Space | 79,63% Space Free | Partition Type: NTFS Drive E: | 7,45 Gb Total Space | 7,45 Gb Free Space | 99,96% Space Free | Partition Type: FAT32 Computer Name: ISMIRUEBEL-PC | User Name: Ismir Uebel | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Ismir Uebel\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Programme\AVAST Software\Avast\AvastUI.exe (AVAST Software) PRC - C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software) PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Secunia\PSI\PSIA.exe (Secunia) PRC - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia) PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe () PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe () PRC - C:\Windows\SysWOW64\schtasks.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe (Panda Security) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () MOD - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe () ========== Services (SafeList) ========== SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (avast! Antivirus) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (Secunia PSI Agent) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe (Secunia) SRV - (Secunia Update Agent) -- C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia) SRV - (MotoHelper) -- C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe () SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software) DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software) DRV:64bit: - (aswVmm) -- C:\Windows\SysNative\drivers\aswVmm.sys () DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software) DRV:64bit: - (aswRvrt) -- C:\Windows\SysNative\drivers\aswRvrt.sys () DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software) DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software) DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (PSI) -- C:\Windows\SysNative\drivers\psi_mf.sys (Secunia) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (motccgp) -- C:\Windows\SysNative\drivers\motccgp.sys (Motorola) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (trustms) -- C:\Windows\SysNative\drivers\trustms.sys () DRV:64bit: - (motmodem) -- C:\Windows\SysNative\drivers\motmodem.sys (Motorola) DRV:64bit: - (NVNET) -- C:\Windows\SysNative\drivers\nvmf6264.sys (NVIDIA Corporation) DRV:64bit: - (Motousbnet) -- C:\Windows\SysNative\drivers\Motousbnet.sys (Motorola) DRV:64bit: - (motusbdevice) -- C:\Windows\SysNative\drivers\motusbdevice.sys (Motorola Inc) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (motccgpfl) -- C:\Windows\SysNative\drivers\motccgpfl.sys (Motorola) DRV:64bit: - (BTCFilterService) -- C:\Windows\SysNative\drivers\motfilt.sys (Motorola Inc) DRV:64bit: - (MotoSwitchService) -- C:\Windows\SysNative\drivers\motswch.sys (Motorola) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 0A 30 D0 C1 0B CE 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:8.0.1489 FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.15 FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515 FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.6.2 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Plus Web Player Plug-In,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013.05.10 17:38:08 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013.06.04 08:26:41 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.28 22:55:10 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.17 08:30:32 | 000,000,000 | ---D | M] [2013.05.29 12:16:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ismir Uebel\AppData\Roaming\mozilla\Extensions [2013.05.29 12:20:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ismir Uebel\AppData\Roaming\mozilla\Firefox\Profiles\n5e0hy97.default\extensions [2013.05.29 12:20:01 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Ismir Uebel\AppData\Roaming\mozilla\Firefox\Profiles\n5e0hy97.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013.05.29 12:20:01 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Ismir Uebel\AppData\Roaming\mozilla\Firefox\Profiles\n5e0hy97.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013.05.29 12:20:01 | 000,534,261 | ---- | M] () (No name found) -- C:\Users\Ismir Uebel\AppData\Roaming\mozilla\firefox\profiles\n5e0hy97.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013.05.29 12:19:31 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Ismir Uebel\AppData\Roaming\mozilla\firefox\profiles\n5e0hy97.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.05.29 12:16:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013.05.29 12:16:10 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2013.05.10 17:38:08 | 000,000,000 | ---D | M] (avast! Online Security) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF [2013.04.10 08:58:33 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe (DivX, LLC) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKCU..\Run: [FileHippo.com] C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe (FileHippo.com) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 193.189.244.202 193.189.244.194 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8C34D035-7080-4BF2-B2BA-15045AAF047F}: DhcpNameServer = 192.168.1.1 193.189.244.202 193.189.244.194 O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2013.02.17 15:44:24 | 000,000,016 | -H-- | M] () - E:\AUTORUN.INF -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.06.04 18:30:54 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Ismir Uebel\Desktop\OTL.exe [2013.05.29 21:07:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FileZilla FTP Client [2013.05.29 12:16:17 | 000,000,000 | ---D | C] -- C:\Users\Ismir Uebel\AppData\Roaming\Mozilla [2013.05.29 12:16:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2013.05.29 09:35:00 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT [2013.05.29 09:34:43 | 000,000,000 | ---D | C] -- C:\JRT [2013.05.29 09:12:34 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013.05.28 23:54:14 | 000,000,000 | ---D | C] -- C:\Windows\temp [2013.05.28 23:45:51 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2013.05.28 23:45:51 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2013.05.28 23:45:51 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2013.05.28 23:45:45 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.05.28 23:45:33 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2013.05.28 22:35:55 | 000,000,000 | ---D | C] -- C:\FRST [2013.05.15 23:48:37 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.05.15 23:48:37 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.05.15 23:48:37 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2013.05.15 23:48:35 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013.05.15 23:48:35 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.05.15 23:48:35 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe [2013.05.15 23:48:35 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013.05.15 23:48:35 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2013.05.15 23:48:35 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.05.15 23:48:35 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2013.05.15 23:48:35 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.05.15 23:48:34 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.05.15 23:48:32 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.05.15 23:48:32 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.05.15 23:48:31 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.05.15 20:35:37 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll [2013.05.15 20:35:37 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll [2013.05.15 20:35:36 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll [2013.05.15 20:35:36 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe [2013.05.15 20:35:21 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys [2013.05.15 20:35:21 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll [2013.05.15 20:35:20 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll [2013.05.13 20:41:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2013.05.13 20:40:11 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2013.05.13 20:40:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2013.05.10 17:36:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client [2013.05.08 07:49:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0 [2013.05.07 19:24:05 | 000,000,000 | ---D | C] -- C:\Program Files\Motorola Inc [2013.05.07 19:24:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola [2013.05.07 19:24:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motorola Shared [2013.05.07 19:24:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Motorola ========== Files - Modified Within 30 Days ========== [2013.06.04 18:30:56 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ismir Uebel\Desktop\OTL.exe [2013.06.04 17:41:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.06.04 15:59:08 | 000,014,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.04 15:59:08 | 000,014,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.04 15:51:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.06.04 15:51:37 | 2146,885,631 | -HS- | M] () -- C:\hiberfil.sys [2013.06.04 07:37:08 | 000,001,922 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk [2013.06.04 07:37:07 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt [2013.06.02 21:42:51 | 000,007,105 | ---- | M] () -- C:\Users\Ismir Uebel\AppData\Local\recently-used.xbel [2013.06.02 18:04:11 | 000,000,000 | ---- | M] () -- C:\END [2013.05.29 12:16:12 | 000,001,147 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.05.29 09:47:03 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.05.29 09:47:03 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.05.29 09:47:03 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.05.29 09:47:03 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.05.29 09:47:03 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.05.28 20:34:18 | 000,231,759 | ---- | M] () -- C:\Users\Ismir Uebel\Desktop\Neuer Trainingsplan 3er Split.odt [2013.05.16 09:42:08 | 000,315,184 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.05.15 21:41:19 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013.05.15 21:41:19 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013.05.09 10:59:07 | 001,025,808 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys [2013.05.09 10:59:07 | 000,378,432 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys [2013.05.09 10:59:07 | 000,189,936 | ---- | M] () -- C:\Windows\SysNative\drivers\aswVmm.sys [2013.05.09 10:59:07 | 000,072,016 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys [2013.05.09 10:59:07 | 000,065,336 | ---- | M] () -- C:\Windows\SysNative\drivers\aswRvrt.sys [2013.05.09 10:59:07 | 000,064,288 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys [2013.05.09 10:59:06 | 000,080,816 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys [2013.05.09 10:59:06 | 000,033,400 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys [2013.05.09 10:58:37 | 000,041,664 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr [2013.05.09 10:58:11 | 000,287,840 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe [2013.05.07 19:25:27 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motmodem_01007.Wdf [2013.05.07 19:25:25 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motfilt_01007.Wdf [2013.05.07 19:25:24 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_Motousbnet_01007.Wdf [2013.05.07 19:25:06 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motccgpfl_01007.Wdf [2013.05.07 19:25:06 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motccgp_01007.Wdf [2013.05.07 19:24:57 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motusbdevice_01007.Wdf [2013.05.07 07:41:52 | 000,000,629 | ---- | M] () -- C:\Users\Ismir Uebel\Desktop\Filme - extern.lnk ========== Files Created - No Company Name ========== [2013.06.02 21:42:51 | 000,007,105 | ---- | C] () -- C:\Users\Ismir Uebel\AppData\Local\recently-used.xbel [2013.06.02 18:04:11 | 000,000,000 | ---- | C] () -- C:\END [2013.05.29 12:16:12 | 000,001,159 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2013.05.29 12:16:12 | 000,001,147 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.05.28 23:45:51 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013.05.28 23:45:51 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013.05.28 23:45:51 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013.05.28 23:45:51 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013.05.28 23:45:51 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2013.05.28 19:24:25 | 000,231,759 | ---- | C] () -- C:\Users\Ismir Uebel\Desktop\Neuer Trainingsplan 3er Split.odt [2013.05.07 19:25:27 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motmodem_01007.Wdf [2013.05.07 19:25:25 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motfilt_01007.Wdf [2013.05.07 19:25:24 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_Motousbnet_01007.Wdf [2013.05.07 19:25:06 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motccgpfl_01007.Wdf [2013.05.07 19:25:06 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motccgp_01007.Wdf [2013.05.07 19:24:57 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motusbdevice_01007.Wdf [2013.05.07 07:41:52 | 000,000,629 | ---- | C] () -- C:\Users\Ismir Uebel\Desktop\Filme - extern.lnk [2013.03.03 23:30:44 | 000,089,304 | ---- | C] () -- C:\Users\Ismir Uebel\tumblr-mi3wf0zkjw1qhttpto3-500.jpg [2013.02.16 04:21:26 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI [2013.02.16 01:40:16 | 000,000,680 | RHS- | C] () -- C:\Users\Ismir Uebel\ntuser.pol ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] < End of report > Code:
ATTFilter OTL Extras logfile created on: 04.06.2013 18:32:37 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Ismir Uebel\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16576) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 8,00 Gb Total Physical Memory | 6,50 Gb Available Physical Memory | 81,21% Memory free 16,00 Gb Paging File | 14,37 Gb Available in Paging File | 89,81% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,76 Gb Total Space | 370,88 Gb Free Space | 79,63% Space Free | Partition Type: NTFS Drive E: | 7,45 Gb Total Space | 7,45 Gb Free Space | 99,96% Space Free | Partition Type: FAT32 Computer Name: ISMIRUEBEL-PC | User Name: Ismir Uebel | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error. ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 "FirewallDisableNotify" = 0 "AntiVirusDisableNotify" = 0 "UpdatesDisableNotify" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 ========== Firewall Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0A5AB9D9-B510-4E26-8050-E30B275CF4DA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{103808D4-B420-4E2A-8E97-C50E20B645C0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{1346E77B-45A9-4382-B848-AD0AC82A9A6E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{1AAAEDE3-FCC2-4C2A-8654-E2E1A6D5BF04}" = rport=138 | protocol=17 | dir=out | app=system | "{1CC0486B-B426-43D1-A00D-233D00269C37}" = lport=10243 | protocol=6 | dir=in | app=system | "{2C9E1912-899F-4FB4-AFD0-D9BA3712CACB}" = lport=138 | protocol=17 | dir=in | app=system | "{3F225128-3351-46A8-A17D-CC6706066DAB}" = lport=139 | protocol=6 | dir=in | app=system | "{438AC83F-6A8C-4934-B041-9423AE4C289B}" = lport=137 | protocol=17 | dir=in | app=system | "{44CAA675-13E2-490F-BB42-339F226E127A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{4B5ABBCA-FDBB-4227-AB6D-98B46981628A}" = rport=137 | protocol=17 | dir=out | app=system | "{56D201B1-6B43-4216-B1D0-354F25B9243D}" = rport=10243 | protocol=6 | dir=out | app=system | "{5890076D-072B-4B6A-8A48-C0F29283BC3A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{71B7D558-02BB-4B29-9869-795A33BA8A90}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{7C8D2B87-A982-49F1-8DEF-926D9B2A2C8D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{AE403A11-F7DF-4EEB-849B-221890226EAC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{C7B22194-8A6E-48FD-B4D3-6D04BDE7C23B}" = rport=445 | protocol=6 | dir=out | app=system | "{E5CC528A-B1FA-401F-BAB9-1B0C30C15BD4}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{E9CEFC50-F809-4575-86FE-FC4FAC18CE2F}" = rport=139 | protocol=6 | dir=out | app=system | "{EB2D936F-1BEF-4065-BC58-B2994A36861E}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{EBBE1907-23C5-41BA-8268-528570FE5C47}" = lport=445 | protocol=6 | dir=in | app=system | "{F6C96F07-E666-4557-B057-AE94ED48B985}" = lport=2869 | protocol=6 | dir=in | app=system | "{F7478AD4-4713-494E-8AC3-73698B8C6188}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{FB9B77B3-3AA6-4C6D-9FAD-939215633E87}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{01CADD67-10E9-41BD-991C-1B731FCB5C37}" = protocol=17 | dir=in | app=c:\world of warcraft\launcher.exe | "{0F1408E5-A262-434B-AE72-42E346C3504E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{158230EA-7B72-41D0-A1BF-ECDE5A3ABBFB}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1675\agent.exe | "{1F1BE56C-6ED0-4094-9BAA-37B2767ADEF4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{2402916A-68F2-4E65-8C49-3F550935EDCA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{26732A75-2BB8-49A9-AF2A-D0CCBDB6E04C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{2D65CB7E-D172-4B80-AD10-A75B00B41AB5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{36B00B3A-5C48-4930-B1CD-B387C29BEB99}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{4AB29C56-3761-4290-BC69-33B3C9A42959}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{60714FC5-D33A-4AC5-B328-8A96264E9BD9}" = protocol=17 | dir=in | app=c:\world of warcraft\launcher.patch.exe | "{7031B343-DD40-42CA-A006-6581AEFDFD2F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{719F50F8-C83F-4878-A26A-CD3D5E972150}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{72ED1EB3-9FF9-411F-BB58-49ECA26F583E}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1675\agent.exe | "{796905DD-330F-48D6-8317-024B2273005E}" = protocol=6 | dir=in | app=c:\world of warcraft\launcher.patch.exe | "{7F1EC181-D36F-4C7D-BF90-11B45001D54C}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe | "{84F34E34-E597-41A1-82C0-4C965A58D951}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{99A86B8E-5C9C-41F0-976C-8B11D8155313}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{A3CE6759-2AFC-4BBA-87E9-846A22A22E56}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{A7E80328-0328-43FC-B8CB-C327A33F6C96}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe | "{AF28BC83-F36B-4D0D-8421-A643F88620B9}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe | "{C0499AC8-3384-4AAD-BFA7-127ABFF23B1C}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{C6521C03-1957-4202-8653-9D7F39C8C7F9}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | "{C91B74D3-3AB6-46C1-9595-5E8D9F156D46}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{CCC08193-35A2-4F54-96BD-4FEC42E3239C}" = protocol=6 | dir=out | app=system | "{D12E8C02-5B12-46D4-A992-68157330EBC1}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe | "{DD70BDDD-49C7-4155-B761-255819830A2B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{E5593D78-380A-4AC7-9AAC-EAB20B1C94C0}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe | "{E63373ED-B45A-4D12-9AD4-0D856C08E949}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{E7E32FA7-F015-4429-950E-F9878546DD6B}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe | "{F1E36487-274E-453F-A76D-E73BD19FCCFA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{F7E7130F-5760-4953-8547-B2D612BC7142}" = protocol=6 | dir=in | app=c:\world of warcraft\launcher.exe | "{FBD723D3-7043-4422-822C-69406426ACF7}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{FF5BF527-607A-4480-B954-0653E3B6E254}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | "TCP Query User{FF6A8277-F257-4E05-8976-558EC8E450B1}C:\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe" = protocol=6 | dir=in | app=c:\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe | "UDP Query User{5DCFBAD2-DE9D-47FD-8A0D-E09051331FC0}C:\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe" = protocol=17 | dir=in | app=c:\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{26A24AE4-039D-4CA4-87B4-2F86417021FF}" = Java 7 Update 21 (64-bit) "{2D2820A1-F214-4B7A-912E-A87E5608CF10}" = Motorola Mobile Drivers Installation 5.0.0 "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 314.07 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 314.07 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 314.07 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 314.07 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.1031 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.12.12 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.23.1 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "GIMP-2_is1" = GIMP 2.8.4 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "NVIDIA Drivers" = NVIDIA Drivers "TeamSpeak 3 Client" = TeamSpeak 3 Client [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor "{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1 "{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 21 "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.4 "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP "{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX "{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195 "{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch "{D8D0CAD2-C5FD-444A-81A0-A285AF1D5ADC}" = jAlbum "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "avast" = avast! Free Antivirus "DivX Setup" = DivX-Setup "FileHippo.com" = FileHippo.com Update Checker "FileZilla Client" = FileZilla Client 3.7.0.2 "FLV Player" = FLV Player 2.0 (build 25) "FormatFactory" = FormatFactory 3.0.1 "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300 "MotoHelper" = MotoHelper 2.0.45 Driver 5.0.0 "Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de) "MozillaMaintenanceService" = Mozilla Maintenance Service "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver "Secunia PSI" = Secunia PSI (3.0.0.4001) "WinRAR archiver" = WinRAR 4.20 (32-Bit) "World of Warcraft" = World of Warcraft ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 29.05.2013 05:23:29 | Computer Name = IsmirUebel-PC | Source = SideBySide | ID = 16842832 Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error - 02.06.2013 13:09:31 | Computer Name = IsmirUebel-PC | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXMFSource.dll". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 02.06.2013 13:09:31 | Computer Name = IsmirUebel-PC | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\DivX\DivX Plus Media Foundation Components\ACMWrapperDMO.dll". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 02.06.2013 13:09:31 | Computer Name = IsmirUebel-PC | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 02.06.2013 13:09:31 | Computer Name = IsmirUebel-PC | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 02.06.2013 13:09:32 | Computer Name = IsmirUebel-PC | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\DivX\DivX Plus Media Foundation Components\ACMWrapperDMO.dll". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 02.06.2013 13:09:32 | Computer Name = IsmirUebel-PC | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 02.06.2013 13:09:32 | Computer Name = IsmirUebel-PC | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 02.06.2013 15:13:03 | Computer Name = IsmirUebel-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000020a4a ID des fehlerhaften Prozesses: 0x25c Startzeit der fehlerhaften Anwendung: 0x01ce5fc46a699480 Pfad der fehlerhaften Anwendung: C:\Windows\system32\lsass.exe Pfad des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 71f5fe40-cbb8-11e2-82c1-002511c81c08 Error - 02.06.2013 15:13:04 | Computer Name = IsmirUebel-PC | Source = Wininit | ID = 1015 Description = Ein kritischer Systemprozess C:\Windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode 255. Der Computer muss neu gestartet werden. [ System Events ] Error - 03.06.2013 06:02:29 | Computer Name = IsmirUebel-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error - 03.06.2013 15:40:02 | Computer Name = IsmirUebel-PC | Source = Service Control Manager | ID = 7038 Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error - 03.06.2013 15:40:02 | Computer Name = IsmirUebel-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error - 04.06.2013 01:38:47 | Computer Name = IsmirUebel-PC | Source = Service Control Manager | ID = 7038 Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error - 04.06.2013 01:38:47 | Computer Name = IsmirUebel-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error - 04.06.2013 01:40:48 | Computer Name = IsmirUebel-PC | Source = Disk | ID = 262155 Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 04.06.2013 01:40:49 | Computer Name = IsmirUebel-PC | Source = Disk | ID = 262155 Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 04.06.2013 01:40:50 | Computer Name = IsmirUebel-PC | Source = Disk | ID = 262155 Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 04.06.2013 09:54:05 | Computer Name = IsmirUebel-PC | Source = Service Control Manager | ID = 7038 Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error - 04.06.2013 09:54:05 | Computer Name = IsmirUebel-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 < End of report > |
04.06.2013, 19:54 | #12 |
/// the machine /// TB-Ausbilder | Komische Probleme II Häng mir mal bitte die aktuelle dmp-Datei aus dem Minidump Ordner an.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
04.06.2013, 20:33 | #13 |
| Komische Probleme II So das ist die aktuellste ... |
04.06.2013, 20:52 | #14 | |
/// the machine /// TB-Ausbilder | Komische Probleme II Ungläubiger Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
04.06.2013, 21:03 | #15 |
| Komische Probleme II Was wie wo? Ich verstehe gerade nix! |
Themen zu Komische Probleme II |
aufhängt, bluescree, bluescreen, compu, computer, druck, eintrag, ersichtlichen, frisch, grund, hardwareproblem, heute, komische, nichts, problem, probleme, punkt, thomas, vorgestellt |