| |
| |||||||
Log-Analyse und Auswertung: TR/Crypt.XPACK.Gen3 - Trojaner - DSL viel zu langsamWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
12.06.2013, 19:01
| #1 |
 |  TR/Crypt.XPACK.Gen3 - Trojaner - DSL viel zu langsam Hallo an alle Helfer. Ich bin am Ende und weis nicht mehr weiter.Gestern Mittag ging es los. Die Seitenaufrufe im Internet wurden immer langsamer. Spiele bzw. Videos wurden endlos lange geladen und nicht mehr abgespielt. Aufrufe der 2.Registerkarten öffneten sich nicht mehr. Ich habe erst einmal alle Kabel getrennt und nachdem das nichts brachte die Hotline der Telekom angerufen. Die Leitung DSL16000 steht aber wunderbar, ohne Probleme. Dann habe ich Antivir geöffner und dann ging das Klingeln los. 21 Warnungen und 4 TRojaner alle im Ordner AppData/Load Now/Sun/Java/Deployed/Cache/6.0/41... Es wurden gefunden JAVA/Jogek.caw + TR/DofoilCU.A.1 + TR/Tobfy.F22 + JAVA/Dldr.Treams.00 . Alle wurden in die Quarantäne geschickt. Das Internet lief aber immer noch nicht. Nach stundenlangem Suchen habe ich es aufgegeben und gedacht: es hilft nur noch ein Systemneustart über die Recovery Disc Windows Vista. Alle beiden Festplatten neu formantiert und gewartet. Jetzt das System Jahr zurück wieder hochgefahren, die ersten Programme Antivir, Flashplayer, CC Cleaner und Acrobat Reader installiert und dann ging es wieder los. Dieses mal TR/Crypt.XPACK.Gen3 unter Windows SoftwareDistibution/Download, c443737a4fe mit dem Objekt BITCO5E.tmp. Das habe ich im abgesicherten Modus löschen können. Kam aber immer unter einer Adresse im Ordner wieder. So, jetzt bin ich weiter, habe mittlerweile 3x die Recovery CD starten müssen und endlich keinen ersehbaren Virus finden können. Leider habe ich Eure Seite erst jetzt gefunden. Die Quantäre dateien im Antivir sind natürlich mit gelöscht worden. Das anfängliche Problem besteht aber immer noch. Ich kann nur mit bis zu 20kB/sek. laden, d.h. alle Windows Update Dateien, die Antivir Update Daten usw. kann ich gar nicht laden, da es Tage dauern würde. Der PC hat einen Stand von 2007, der Desktop kann nicht an den Bildschirm angepasst werden und immer nach ein paar Minuten schliesst der INternet Explorer (immerhin schon 8) automatisch. Ich versuche jetzt seit über 1 Stunde, den Text und die geforderten Dateien zu versenden. Sollte es funktionieren, jetzt schon vielen Dank für die Hilfe P.S. Mein PC Wissen ist eher bescheiden. OTL.TxtOTL Logfile: Code:
ATTFilter OTL logfile created on: 12.06.2013 18:12:22 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Dieter\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,25 Gb Total Physical Memory | 2,34 Gb Available Physical Memory | 72,19% Memory free 6,68 Gb Paging File | 5,73 Gb Available in Paging File | 85,70% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 911,51 Gb Total Space | 894,22 Gb Free Space | 98,10% Space Free | Partition Type: NTFS Drive D: | 20,00 Gb Total Space | 19,92 Gb Free Space | 99,56% Space Free | Partition Type: NTFS Computer Name: ZU-HAUSE | User Name: Dieter | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.12 18:12:15 | 000,116,648 | ---- | M] (Google Inc.) -- C:\Programme\GUM781C.tmp\GoogleUpdate.exe PRC - [2013.06.12 18:11:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Dieter\Desktop\OTL.exe PRC - [2013.06.12 18:06:32 | 000,530,464 | ---- | M] (Google Inc.) -- C:\ProgramData\Google\Google Toolbar\Update\gtbDE81.tmp.exe PRC - [2013.06.12 18:04:42 | 000,304,240 | ---- | M] (Google Inc.) -- C:\Programme\Google\Google Toolbar\GoogleToolbarUser_32.exe PRC - [2013.06.12 16:46:16 | 000,247,968 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil11e_ActiveX.exe PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.04.17 23:29:00 | 000,781,592 | ---- | M] (Google Inc.) -- C:\Programme\Google\Update\Download\{62209F62-45AF-49CA-8750-3F68039288A1}\GoogleUpdateSetup.exe PRC - [2013.03.19 08:12:28 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.03.06 15:13:38 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2013.02.25 15:47:33 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2013.02.25 15:47:19 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2009.03.08 23:09:24 | 000,638,816 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe PRC - [2008.01.21 04:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.01.21 04:24:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2008.01.21 04:23:29 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe ========== Modules (No Company Name) ========== ========== Services (SafeList) ========== SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013.02.25 15:47:33 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.02.25 15:47:19 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2009.08.24 22:16:36 | 000,406,016 | ---- | M] (mst software GmbH, Germany) [On_Demand | Stopped] -- C:\Programme\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe -- (DfSdkS) SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - [2013.03.06 15:13:37 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013.02.27 12:22:36 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2013.02.27 12:22:36 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.08.27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.01.21 04:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2084775729-4178959056-1721939784-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/ IE - HKU\S-1-5-21-2084775729-4178959056-1721939784-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-2084775729-4178959056-1721939784-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-2084775729-4178959056-1721939784-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 32 AE 14 11 7D 67 CE 01 [binary data] IE - HKU\S-1-5-21-2084775729-4178959056-1721939784-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKU\S-1-5-21-2084775729-4178959056-1721939784-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKU\S-1-5-21-2084775729-4178959056-1721939784-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GZAZ_deDE540 IE - HKU\S-1-5-21-2084775729-4178959056-1721939784-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-2084775729-4178959056-1721939784-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll (Google Inc.) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{927A0A55-5EF8-41B7-B9AA-57471CCECD63}: DhcpNameServer = 192.168.178.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.06.12 18:11:52 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Dieter\Desktop\OTL.exe [2013.06.12 18:06:06 | 000,000,000 | ---D | C] -- C:\Users\Dieter\AppData\Roaming\Google [2013.06.12 18:05:57 | 000,000,000 | ---D | C] -- C:\Users\Dieter\AppData\Local\Google [2013.06.12 18:04:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Google [2013.06.12 18:04:42 | 000,000,000 | ---D | C] -- C:\Program Files\Google [2013.06.12 17:39:03 | 000,000,000 | ---D | C] -- C:\Users\Dieter\AppData\Roaming\Avira [2013.06.12 17:32:16 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2013.06.12 17:27:45 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2013.06.12 17:27:31 | 000,000,000 | -HSD | C] -- C:\Boot [2013.06.12 17:06:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2013.06.12 17:06:19 | 000,135,136 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys [2013.06.12 17:06:19 | 000,084,744 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys [2013.06.12 17:06:19 | 000,037,352 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys [2013.06.12 17:06:19 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2013.06.12 17:06:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2013.06.12 17:06:18 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2013.06.12 17:03:31 | 000,000,000 | ---D | C] -- C:\Users\Dieter\AppData\Local\Adobe [2013.06.12 16:56:52 | 000,000,000 | ---D | C] -- C:\Users\Dieter\AppData\Roaming\Macromedia [2013.06.12 16:56:52 | 000,000,000 | ---D | C] -- C:\Users\Dieter\AppData\Roaming\Adobe [2013.06.12 16:48:38 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe [2013.06.12 16:48:38 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe [2013.06.12 16:48:20 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2013.06.12 16:48:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2013.06.12 16:47:45 | 000,028,160 | ---- | C] (mst software GmbH, Germany) -- C:\Windows\System32\DfSdkBt.exe [2013.06.12 16:47:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo [2013.06.12 16:47:41 | 000,000,000 | ---D | C] -- C:\Program Files\Ashampoo [2013.06.12 16:46:54 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2013.06.12 16:45:36 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed [2013.06.12 16:44:00 | 000,000,000 | ---D | C] -- C:\Program Files\__MACOSX [2013.06.12 16:38:09 | 000,000,000 | R--D | C] -- C:\Users\Dieter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2013.06.12 16:38:09 | 000,000,000 | R--D | C] -- C:\Users\Dieter\Searches [2013.06.12 16:38:09 | 000,000,000 | R--D | C] -- C:\Users\Dieter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2013.06.12 16:38:01 | 000,000,000 | ---D | C] -- C:\Users\Dieter\AppData\Roaming\Identities [2013.06.12 16:38:00 | 000,000,000 | R--D | C] -- C:\Users\Dieter\Contacts [2013.06.12 16:37:59 | 000,000,000 | ---D | C] -- C:\Users\Dieter\AppData\Local\VirtualStore [2013.06.12 16:37:57 | 000,000,000 | --SD | C] -- C:\Users\Dieter\AppData\Roaming\Microsoft [2013.06.12 16:37:57 | 000,000,000 | R--D | C] -- C:\Users\Dieter\Videos [2013.06.12 16:37:57 | 000,000,000 | R--D | C] -- C:\Users\Dieter\Saved Games [2013.06.12 16:37:57 | 000,000,000 | R--D | C] -- C:\Users\Dieter\Pictures [2013.06.12 16:37:57 | 000,000,000 | R--D | C] -- C:\Users\Dieter\Music [2013.06.12 16:37:57 | 000,000,000 | R--D | C] -- C:\Users\Dieter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2013.06.12 16:37:57 | 000,000,000 | R--D | C] -- C:\Users\Dieter\Links [2013.06.12 16:37:57 | 000,000,000 | R--D | C] -- C:\Users\Dieter\Favorites [2013.06.12 16:37:57 | 000,000,000 | R--D | C] -- C:\Users\Dieter\Downloads [2013.06.12 16:37:57 | 000,000,000 | R--D | C] -- C:\Users\Dieter\Documents [2013.06.12 16:37:57 | 000,000,000 | R--D | C] -- C:\Users\Dieter\Desktop [2013.06.12 16:37:57 | 000,000,000 | R--D | C] -- C:\Users\Dieter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Vorlagen [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\AppData\Local\Verlauf [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\AppData\Local\Temporary Internet Files [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Startmenü [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\SendTo [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Recent [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Netzwerkumgebung [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Lokale Einstellungen [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Documents\Eigene Videos [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Documents\Eigene Musik [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Eigene Dateien [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Documents\Eigene Bilder [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Druckumgebung [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Cookies [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\AppData\Local\Anwendungsdaten [2013.06.12 16:37:57 | 000,000,000 | -HSD | C] -- C:\Users\Dieter\Anwendungsdaten [2013.06.12 16:37:57 | 000,000,000 | -H-D | C] -- C:\Users\Dieter\AppData [2013.06.12 16:37:57 | 000,000,000 | ---D | C] -- C:\Users\Dieter\AppData\Local\Temp [2013.06.12 16:37:57 | 000,000,000 | ---D | C] -- C:\Users\Dieter\AppData\Local\Microsoft [2013.06.12 16:37:57 | 000,000,000 | ---D | C] -- C:\Users\Dieter\AppData\Roaming\Media Center Programs [2013.06.12 16:36:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2013.06.12 16:36:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2013.06.12 16:36:24 | 000,000,000 | -HSD | C] -- C:\Programme [2013.06.12 16:36:24 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2013.06.12 16:36:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2013.06.12 16:36:24 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2013.06.12 16:36:24 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2013.06.12 16:36:24 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2013.06.12 16:36:24 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2013.06.12 16:36:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2013.06.12 16:36:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2013.06.12 16:35:59 | 000,000,000 | ---D | C] -- C:\Windows\Debug [2013.06.12 16:31:33 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2013.06.12 16:28:30 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2013.06.12 16:28:20 | 000,000,000 | -HSD | C] -- C:\System Volume Information ========== Files - Modified Within 30 Days ========== [2013.06.12 18:12:26 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.06.12 18:12:25 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.06.12 18:11:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Dieter\Desktop\OTL.exe [2013.06.12 18:09:57 | 000,000,000 | ---- | M] () -- C:\Users\Dieter\defogger_reenable [2013.06.12 18:09:04 | 000,050,477 | ---- | M] () -- C:\Users\Dieter\Desktop\Defogger.exe [2013.06.12 18:04:52 | 000,617,444 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.06.12 18:04:52 | 000,586,568 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.06.12 18:04:52 | 000,122,258 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.06.12 18:04:52 | 000,100,640 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.06.12 17:52:10 | 000,000,680 | ---- | M] () -- C:\Users\Dieter\AppData\Local\d3d9caps.dat [2013.06.12 17:51:28 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.12 17:51:27 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.12 17:51:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.06.12 17:51:19 | 3487,748,096 | -HS- | M] () -- C:\hiberfil.sys [2013.06.12 17:27:32 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK [2013.06.12 17:06:26 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2013.06.12 16:48:47 | 000,001,892 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2013.06.12 16:47:45 | 000,000,905 | ---- | M] () -- C:\Users\Public\Desktop\Ashampoo WinOptimizer 6.lnk [2013.06.12 16:46:54 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2013.06.12 16:39:12 | 000,004,608 | ---- | M] () -- C:\Users\Dieter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.06.12 16:34:47 | 000,228,840 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013.06.12 16:33:35 | 000,060,826 | ---- | M] () -- C:\Windows\System32\license.rtf [2013.06.12 16:32:53 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf ========== Files Created - No Company Name ========== [2013.06.12 18:09:57 | 000,000,000 | ---- | C] () -- C:\Users\Dieter\defogger_reenable [2013.06.12 18:08:58 | 000,050,477 | ---- | C] () -- C:\Users\Dieter\Desktop\Defogger.exe [2013.06.12 18:06:03 | 000,001,098 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.06.12 18:06:03 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.06.12 17:27:32 | 000,008,192 | R-S- | C] () -- C:\BOOTSECT.BAK [2013.06.12 17:27:31 | 000,333,203 | RHS- | C] () -- C:\bootmgr [2013.06.12 17:06:26 | 000,001,847 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2013.06.12 16:52:07 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2013.06.12 16:48:47 | 000,002,425 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2013.06.12 16:48:47 | 000,001,892 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2013.06.12 16:47:45 | 000,000,905 | ---- | C] () -- C:\Users\Public\Desktop\Ashampoo WinOptimizer 6.lnk [2013.06.12 16:46:54 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2013.06.12 16:39:12 | 000,004,608 | ---- | C] () -- C:\Users\Dieter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.06.12 16:38:10 | 000,000,949 | ---- | C] () -- C:\Users\Dieter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2013.06.12 16:38:09 | 000,000,944 | ---- | C] () -- C:\Users\Dieter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk [2013.06.12 16:38:00 | 000,000,915 | ---- | C] () -- C:\Users\Dieter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk [2013.06.12 16:37:58 | 000,000,680 | ---- | C] () -- C:\Users\Dieter\AppData\Local\d3d9caps.dat [2013.06.12 16:34:29 | 3487,748,096 | -HS- | C] () -- C:\hiberfil.sys [2013.06.12 16:33:19 | 000,000,604 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live.lnk [2013.06.12 16:32:53 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf ========== ZeroAccess Check ========== [2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2008.01.21 04:23:46 | 011,580,416 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2008.01.21 04:24:24 | 000,614,400 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2008.01.21 04:24:03 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== ========== Purity Check ========== < End of report > OTL.Extra.TxtOTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 12.06.2013 18:12:22 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Dieter\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,25 Gb Total Physical Memory | 2,34 Gb Available Physical Memory | 72,19% Memory free
6,68 Gb Paging File | 5,73 Gb Available in Paging File | 85,70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 911,51 Gb Total Space | 894,22 Gb Free Space | 98,10% Space Free | Partition Type: NTFS
Drive D: | 20,00 Gb Total Space | 19,92 Gb Free Space | 99,56% Space Free | Partition Type: NTFS
Computer Name: ZU-HAUSE | User Name: Dieter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0319D262-FEA5-48CD-A14C-A29E5C7F19D6}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0E564629-AA0E-42E5-8D0F-9E9EEB91736A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{28B7DA7F-89F6-4CB6-8605-FEFA48B0EC36}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4C630CF9-0DB8-43B4-80C6-F923C25E4DD0}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6EFE4733-9187-40F8-A451-E9B870787087}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8950EBCC-328F-476D-AA8D-4AEF8A56647F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B7873C1F-0840-47E4-9FC6-AA5ED1CBAB21}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C4D373EA-2793-4A0A-B3A1-F58D8E11B285}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F4C52817-A207-4ED1-A3D9-76AC76F76CFD}" = rport=10243 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{099BEC28-0577-4D17-BE2E-C88AB9E7C7E9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0AA2BB50-29A4-4D0C-967B-A60DB1B4B515}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2F323DB1-EBAC-4E14-934D-95B7453E3A04}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{30DF7A13-7636-498A-B907-245187FACFC9}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{36105C09-15C4-4087-9127-247FA9695701}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{3863EA6B-AB34-4586-A2A7-965564B5A057}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{5C55FF9C-A844-4A74-B381-9F84041E6116}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{7A29C8B4-5FE0-4043-BD99-BBC515A5E090}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8222E338-558D-4910-9E0A-AD341A9C91F8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8532063E-001D-40CD-B3DA-E8D246E51448}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8AACA667-8A59-46CE-8CA9-9611A9DDE194}" = protocol=6 | dir=out | app=system |
"{FF81D4D2-AEC9-42F9-B9EA-4FE5ED28DBE4}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.7) - Deutsch
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Ashampoo WinOptimizer 6_is1" = Ashampoo WinOptimizer 6.60
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 12.06.2013 10:50:43 | Computer Name = zu-Hause | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\$Recycle.Bin\S-1-5-21-2084775729-4178959056-1721939784-1000\$RLO6XCV.exe".
Die
abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 12.06.2013 10:50:43 | Computer Name = zu-Hause | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\$Recycle.Bin\S-1-5-21-2084775729-4178959056-1721939784-1000\$R0VOXO0.exe".
Die
abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 12.06.2013 10:57:02 | Computer Name = zu-Hause | Source = WinMgmt | ID = 10
Description =
Error - 12.06.2013 11:12:59 | Computer Name = zu-Hause | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 8.0.6001.18702, Zeitstempel
0x49b3ad2e, fehlerhaftes Modul USP10.dll, Version 1.626.6001.18000, Zeitstempel
0x4791a776, Ausnahmecode 0xc0000005, Fehleroffset 0x0000ab30, Prozess-ID 0x4a0,
Anwendungsstartzeit 01ce677f4cc44602.
Error - 12.06.2013 11:13:16 | Computer Name = zu-Hause | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 8.0.6001.18702, Zeitstempel
0x49b3ad2e, fehlerhaftes Modul USP10.dll, Version 1.626.6001.18000, Zeitstempel
0x4791a776, Ausnahmecode 0xc0000005, Fehleroffset 0x0000ab30, Prozess-ID 0xb58,
Anwendungsstartzeit 01ce677f583a33f2.
Error - 12.06.2013 11:13:38 | Computer Name = zu-Hause | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 8.0.6001.18702, Zeitstempel
0x49b3ad2e, fehlerhaftes Modul USP10.dll, Version 1.626.6001.18000, Zeitstempel
0x4791a776, Ausnahmecode 0xc0000005, Fehleroffset 0x0000ab30, Prozess-ID 0x490,
Anwendungsstartzeit 01ce677f652489d2.
Error - 12.06.2013 11:13:59 | Computer Name = zu-Hause | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 8.0.6001.18702, Zeitstempel
0x49b3ad2e, fehlerhaftes Modul USP10.dll, Version 1.626.6001.18000, Zeitstempel
0x4791a776, Ausnahmecode 0xc0000005, Fehleroffset 0x0000ab30, Prozess-ID 0x47c,
Anwendungsstartzeit 01ce677f6de477b2.
Error - 12.06.2013 11:14:51 | Computer Name = zu-Hause | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 8.0.6001.18702, Zeitstempel
0x49b3ad2e, fehlerhaftes Modul USP10.dll, Version 1.626.6001.18000, Zeitstempel
0x4791a776, Ausnahmecode 0xc0000005, Fehleroffset 0x0000ab30, Prozess-ID 0xfe8,
Anwendungsstartzeit 01ce677f81641b12.
Error - 12.06.2013 11:35:14 | Computer Name = zu-Hause | Source = WinMgmt | ID = 10
Description =
Error - 12.06.2013 11:52:59 | Computer Name = zu-Hause | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 12.06.2013 10:29:47 | Computer Name = 26L2233B1-13 | Source = HTTP | ID = 15016
Description =
Error - 12.06.2013 10:36:01 | Computer Name = zu-Hause | Source = HTTP | ID = 15016
Description =
Error - 12.06.2013 10:55:33 | Computer Name = zu-Hause | Source = HTTP | ID = 15016
Description =
Error - 12.06.2013 11:33:43 | Computer Name = zu-Hause | Source = HTTP | ID = 15016
Description =
Error - 12.06.2013 11:51:26 | Computer Name = zu-Hause | Source = HTTP | ID = 15016
Description =
Error - 12.06.2013 12:06:05 | Computer Name = zu-Hause | Source = Service Control Manager | ID = 7030
Description =
Error - 12.06.2013 12:06:07 | Computer Name = zu-Hause | Source = DCOM | ID = 10016
Description =
Error - 12.06.2013 12:06:07 | Computer Name = zu-Hause | Source = DCOM | ID = 10016
Description =
Error - 12.06.2013 12:06:28 | Computer Name = zu-Hause | Source = DCOM | ID = 10016
Description =
Error - 12.06.2013 12:06:28 | Computer Name = zu-Hause | Source = DCOM | ID = 10016
Description =
< End of report >
Gmer.txt GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-12 18:57:32
Windows 6.0.6001 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD10EACS-00D6B0 rev.01.01A01 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Dieter\AppData\Local\Temp\uftyypow.sys
---- System - GMER 2.1 ----
SSDT 8BB01C2E ZwCreateSection
SSDT 8BB01C38 ZwRequestWaitReplyPort
SSDT 8BB01C33 ZwSetContextThread
SSDT 8BB01C3D ZwSetSecurityObject
SSDT 8BB01C42 ZwSystemDebugControl
SSDT 8BB01BCF ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetTimerEx + 448 81AEDA9C 4 Bytes [2E, 1C, B0, 8B]
.text ntkrnlpa.exe!KeSetTimerEx + 76C 81AEDDC0 4 Bytes [38, 1C, B0, 8B]
.text ntkrnlpa.exe!KeSetTimerEx + 7A0 81AEDDF4 4 Bytes [33, 1C, B0, 8B]
.text ntkrnlpa.exe!KeSetTimerEx + 804 81AEDE58 4 Bytes [3D, 1C, B0, 8B]
.text ntkrnlpa.exe!KeSetTimerEx + 84C 81AEDEA0 4 Bytes [42, 1C, B0, 8B]
.text ...
---- Devices - GMER 2.1 ----
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Processes - GMER 2.1 ----
Process (*** hidden *** ) [4] 83F40020
---- EOF - GMER 2.1 ----
So es ist geschafft. Geändert von Da GuRu (12.06.2013 um 19:29 Uhr) |
| Themen zu TR/Crypt.XPACK.Gen3 - Trojaner - DSL viel zu langsam |
| aufgegeben, bildschirm, cc cleaner, desktop, festplatte, flash player, google, install.exe, java/dldr.treams.00, java/jogek.caw, langsam, scan, starten, svchost.exe, tr/crypt.xpack.ge, tr/crypt.xpack.gen, tr/crypt.xpack.gen3, tr/dofoilcu.a.1, tr/tobfy.f22, trojaner, usp10.dll, windows |
Baum-Darstellung