WLAN-Fehler: Verbindungsstatus unbekannt

Grischuna · 08.01.2011, 22:13

Hallo zusammen,

als ich gestern meinen Computer neu gestartet habe, funktionierte mein WLAN nicht mehr resp. es werden keine Netzwerke mehr gefunden, es kommt lediglich folgende Meldung:
"Verbindungsstatus: unbekannt
Der Abhängigkeitsdienst oder die Abhängigkeitsgruppe konnte nicht gestartet werden."
Ansonsten läuft das System einwandfrei.

Mit Malwarebytes habe ich nichts gefunden (siehe unten). Vollständiger Scan ist gerade am laufen. Version ist durch die gekappt Netzwerkverbindung nicht aktualisiert. Könnte evtl. funktionieren wenn ich den Laptop direkt ans Modem anschliesse?

Habe folgende Problembehebungen ausprobiert, ohne Erfolg:
hxxp://support.microsoft.com/kb/827328/de
hxxp://technikblog.rachfahl.de/losungen/der-abhngigkeitsdienst-oder-die-abhngigkeitsgruppe-konnte-nicht-gestartet-werden/

Hab mir erst kürzlich Malware eingefangen, hab ich mir wieder eine Plagegeist geholt? Kann man was machen?
System neu aufsetzen wäre wohl auch ein Thema.

Danke schon mal im Voraus für jegliche Antworten

Gruss Roger

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 5164

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

08.01.2011 20:59:28
mbam-log-2011-01-08 (20-59-28).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 145088
Laufzeit: 11 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus · 09.01.2011, 17:06

Zitat:

Malwarebytes' Anti-Malware 1.46
Datenbank Version: 5164

Du hast Malwarebytes vorher nicht aktualisiert. Bitte updaten und einen Vollscan machen.

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle davon posten. Du findest diese im Reiter Logdateien in Malwarebytes.

Grischuna · 09.01.2011, 19:14

Zitat:

Version ist durch die gekappt Netzwerkverbindung nicht aktualisiert.

Hab mir nun die neuste Version von einem anderen Computer runtergeladen, vollscan läuft.
Mein letzter Scann ist vom 23. November ohne Infizierte Dateien, davor hatte ich mal die Malware Security Tool auf dem PC, die Scans davon sind alle noch hier zu finden:
http://www.trojaner-board.de/92934-s...geloescht.html
.

Grischuna · 10.01.2011, 14:47

Also hier der Log mit der neuste Version (d.h. download Version, aktualisieren geht nicht):

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5363

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

09.01.2011 20:48:45
mbam-log-2011-01-09 (20-48-44).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 310289
Laufzeit: 1 Stunde(n), 42 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

hier der letzte vor dem Problem vom 12. Dezember:

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 5164

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

12.12.2010 19:28:49
mbam-log-2010-12-12 (19-28-49).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 144920
Laufzeit: 13 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

die restlichen Logs sind im Link oben zu finden.

cosinus · 10.01.2011, 16:37

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Grischuna · 11.01.2011, 10:27

Ich habe gestern bemerkt, dass es mir den Broadcom WLAN Treiber installiert hat (am selben Tag, als das Problem auftrat), obwohl ich bis jetzt immer den Intel Treiber hatte.
Mein Mitbewohner hat sich das mal angeschaut und gemerkt, dass momentan alle Netzwerk Treiber Probleme melden. Haben darauf den Broadcom Treiber deinstalliert und Intel neuinstalliert. Lief danach immer noch nicht und haben dann auch noch den Realtek Netzwerkreiber neuinstalliert.
Mittlerweile findet er zumindest die drahtlosen Netzwerke wieder, Verbindung kann immer noch nicht hergestellt werden. Kann keine IP beziehen, es kommt die Fehlermeldung, der „Rpc-Server ist nicht verfügbar“. Und es kommt weiter die Fehlermeldung: „Verbindungsstatus: unbekannt / Der Abhängigkeitsdienst oder die Abhängigkeitsgruppe konnte nicht gestartet werden."

Ich hoffe das bringt die ganze Sache ein wenig voran und war nicht voreilig gehandelt.

Hier noch die OTL-Logs:

Code:

ATTFilter

OTL logfile created on: 10.01.2011 23:20:21 - Run 3
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\***\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 64.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141.60 Gb Total Space | 36.85 Gb Free Space | 26.03% Space Free | Partition Type: NTFS
Drive D: | 7.45 Gb Total Space | 2.52 Gb Free Space | 33.78% Space Free | Partition Type: NTFS
Drive F: | 7.45 Gb Total Space | 7.05 Gb Free Space | 94.68% Space Free | Partition Type: FAT32
 
Computer Name: ***-*** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Users\***\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\***\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (WPFFontCache_v0400) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\WINDOWS\System32\FntCache.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (CLSched) CyberLink Task Scheduler (CTS) -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe ()
SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe ()
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (dwghna) -- C:\Windows\System32\drivers\ensgn.sys File not found
DRV - (blbdrive) -- C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (avipbb) -- C:\WINDOWS\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\WINDOWS\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (NETw5v32) Intel(R) -- C:\WINDOWS\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (RTL8169) -- C:\WINDOWS\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) -- C:\WINDOWS\System32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (NETw4v32) Intel(R) -- C:\WINDOWS\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (rimmptsk) -- C:\WINDOWS\System32\drivers\rimmptsk.sys (REDC)
DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (rismxdp) -- C:\WINDOWS\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) -- C:\WINDOWS\System32\drivers\rimsptsk.sys (REDC)
DRV - (SynTP) -- C:\WINDOWS\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (btwavdt) -- C:\WINDOWS\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (eabfiltr) -- C:\WINDOWS\System32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (HSF_DPV) -- C:\WINDOWS\System32\drivers\VSTDPV3.SYS (Conexant Systems, Inc.)
DRV - (HSFHWAZL) -- C:\WINDOWS\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\System32\drivers\VSTCNXT3.SYS (Conexant Systems, Inc.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel(R) -- C:\WINDOWS\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (BCM43XV) -- C:\WINDOWS\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (ialm) -- C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (smserial) -- C:\WINDOWS\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (HBtnKey) -- C:\WINDOWS\System32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_CH&c=73&bd=Pavilion&pf=laptop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_CH&c=73&bd=Pavilion&pf=laptop
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_CH&c=73&bd=Pavilion&pf=laptop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/webhp?hl=de&tab=iw/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "google.ch"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.12 11:53:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.12 11:53:01 | 000,000,000 | ---D | M]
 
[2008.11.17 22:32:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2011.01.07 22:50:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\obcgsj7d.default\extensions
[2010.09.17 23:24:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\obcgsj7d.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.12.18 13:57:12 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\obcgsj7d.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.11.21 17:44:24 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.11.17 23:46:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}
[2010.07.29 16:51:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.21 17:42:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010.09.15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.13 23:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npwachk.dll
[2010.07.26 16:08:04 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.07.26 16:08:04 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.07.26 16:08:04 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.07.26 16:08:04 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.07.26 16:08:04 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.10.18 19:46:53 | 000,000,698 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\HPRadiance.jpg
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\HPRadiance.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.09.11 16:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.01.10 21:38:23 | 000,106,496 | ---- | C] (Realtek Corporation                                            ) -- C:\Windows\System32\drivers\Rtlh86.sys
[2011.01.10 21:37:36 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Realtek
[2011.01.10 21:16:30 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Intel
[2011.01.10 21:07:53 | 000,000,000 | ---D | C] -- C:\Windows\System32\no-NO
[2011.01.09 21:15:41 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\InstallShield
[2011.01.08 21:11:16 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Avira
[2010.12.31 13:15:32 | 000,000,000 | ---D | C] -- C:\HattrickOrganizer
[2010.12.20 23:05:04 | 000,483,840 | ---- | C] (Macromedia, Inc.) -- C:\Windows\System32\SWFLASH6.OCX
[2010.12.16 21:30:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\vlc
[2010.12.14 20:30:07 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.12.14 20:30:04 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2010.12.14 20:30:03 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2010.12.14 20:30:03 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2010.12.14 20:29:56 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.12.14 20:29:55 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2010.12.14 20:29:54 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.12.14 20:29:53 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2010.12.14 20:29:53 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.12.14 20:29:53 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2010.12.14 20:29:52 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010.12.14 20:29:52 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010.12.14 20:29:52 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.12.14 20:29:52 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.12.14 20:29:52 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2010.12.14 20:29:52 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2010.12.14 20:29:52 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2010.12.14 20:29:52 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2010.12.14 20:29:52 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010.12.14 20:29:52 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2010.12.14 20:29:52 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2010.12.14 20:29:50 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2010.12.14 20:29:49 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2010.12.14 20:29:49 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010.12.14 20:29:46 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2010.12.14 20:29:27 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.12.14 20:29:08 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2010.12.13 20:07:17 | 000,420,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2010.12.13 20:07:15 | 000,726,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2010.12.12 21:46:34 | 000,156,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2010.12.12 21:46:34 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2010.12.12 21:46:34 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2010.12.12 21:46:33 | 000,348,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2010.12.12 21:46:33 | 000,125,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2010.12.12 21:46:33 | 000,034,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2010.12.12 21:46:33 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\corpol.dll
[2010.12.12 21:46:32 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2010.12.12 21:46:31 | 000,229,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2010.12.12 21:46:31 | 000,094,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2010.12.12 21:46:30 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2010.12.12 21:46:29 | 000,208,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WinFXDocObj.exe
[2010.12.12 21:46:29 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2010.12.12 21:46:29 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2010.12.12 21:46:28 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2010.12.12 21:46:27 | 000,445,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2010.12.12 21:46:26 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2010.12.12 21:46:23 | 003,698,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2010.12.12 21:46:23 | 000,169,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2010.12.12 21:46:22 | 000,109,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PDMSetup.exe
[2010.12.12 21:46:22 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2010.12.12 21:46:22 | 000,107,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2010.12.12 21:46:22 | 000,103,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetDepNx.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.01.10 23:16:34 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.01.10 23:16:34 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.01.10 23:16:32 | 000,077,291 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011.01.10 23:16:31 | 000,077,291 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011.01.10 23:16:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.01.10 23:15:54 | 2143,784,960 | -HS- | M] () -- C:\hiberfil.sys
[2011.01.10 22:07:25 | 000,633,580 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.01.10 22:07:25 | 000,600,138 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.01.10 22:07:25 | 000,128,796 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.01.10 22:07:25 | 000,106,014 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.01.10 21:44:53 | 000,001,076 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.01.10 21:23:09 | 000,002,631 | ---- | M] () -- C:\Users\***\Desktop\Microsoft Office Word 2007.lnk
[2011.01.09 22:33:11 | 000,011,596 | ---- | M] () -- C:\Users\***\Desktop\HP-Windows.docx
[2011.01.09 21:22:53 | 000,141,312 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.01.09 19:02:36 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.01.09 12:30:19 | 000,002,633 | ---- | M] () -- C:\Users\***\Desktop\Microsoft Office Excel 2007.lnk
[2011.01.09 00:25:14 | 000,000,002 | -HS- | M] () -- C:\Users\***\AppData\Roaming\evf6
[2011.01.07 22:40:25 | 000,032,256 | ---- | M] () -- C:\Users\***\Desktop\filmliste(2).xls
[2011.01.07 21:29:33 | 000,014,810 | ---- | M] () -- C:\Users\***\Desktop\Filmlist.docx
[2011.01.07 20:46:18 | 000,011,025 | ---- | M] () -- C:\Users\***\Desktop\Schulden.docx
[2010.12.31 13:15:37 | 000,001,433 | ---- | M] () -- C:\Users\Public\Desktop\Hattrick Organizer.lnk
[2010.12.21 22:04:49 | 000,000,010 | -HS- | M] () -- C:\Users\***\AppData\Roaming\date
[2010.12.21 19:31:43 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2010.12.20 23:10:44 | 000,000,919 | ---- | M] () -- C:\Users\Public\Desktop\YouTube Downloader.lnk
[2010.12.20 23:05:04 | 000,483,840 | ---- | M] (Macromedia, Inc.) -- C:\Windows\System32\SWFLASH6.OCX
[2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.12.17 22:25:56 | 000,013,182 | ---- | M] () -- C:\Users\***\Desktop\München Todo.docx
[2010.12.16 21:23:48 | 000,000,859 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010.12.16 03:27:47 | 000,430,784 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.01.09 22:33:10 | 000,011,596 | ---- | C] () -- C:\Users\***\Desktop\HP-Windows.docx
[2011.01.09 19:02:36 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.01.08 21:30:38 | 2143,784,960 | -HS- | C] () -- C:\hiberfil.sys
[2010.12.31 13:15:37 | 000,001,433 | ---- | C] () -- C:\Users\Public\Desktop\Hattrick Organizer.lnk
[2010.12.20 23:06:01 | 000,000,010 | -HS- | C] () -- C:\Users\***\AppData\Roaming\date
[2010.12.20 23:06:00 | 000,000,002 | -HS- | C] () -- C:\Users\***\AppData\Roaming\evf6
[2010.12.16 21:23:48 | 000,000,859 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010.12.12 21:49:51 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2010.12.06 20:21:38 | 000,000,114 | ---- | C] () -- C:\Users\***\AppData\Roaming\wklnhst.dat
[2010.11.23 22:02:12 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.09.09 19:11:43 | 000,110,080 | ---- | C] () -- C:\Windows\System32\advd.dll
[2010.09.09 19:11:43 | 000,023,040 | ---- | C] () -- C:\Windows\System32\auth.dll
[2010.09.09 19:11:42 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2010.08.06 14:31:08 | 000,001,356 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2010.07.05 19:26:02 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.12.04 14:08:55 | 000,077,291 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.12.04 14:08:54 | 000,077,291 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.07.25 11:32:03 | 000,000,000 | ---- | C] () -- C:\Users\***\AppData\Local\FnF4.txt
[2009.04.07 22:44:12 | 000,217,088 | ---- | C] () -- C:\Windows\System32\libmySQL.dll
[2009.03.17 21:41:58 | 000,000,189 | ---- | C] () -- C:\Windows\wininit.ini
[2009.03.17 19:49:24 | 000,000,525 | ---- | C] () -- C:\Windows\QIII.INI
[2009.03.16 20:58:48 | 000,000,342 | ---- | C] () -- C:\Windows\SIERRA.INI
[2008.12.03 10:55:42 | 000,000,025 | ---- | C] () -- C:\Windows\CDE DX4400DEFGIPS.ini
[2008.11.22 18:16:01 | 000,000,117 | ---- | C] () -- C:\Windows\civ.ini
[2008.11.17 22:09:37 | 000,141,312 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.11.17 22:03:21 | 000,027,335 | ---- | C] () -- C:\Users\***\AppData\Roaming\nvModes.001
[2008.11.17 21:47:28 | 000,027,335 | ---- | C] () -- C:\Users\***\AppData\Roaming\nvModes.dat
[2008.11.17 21:30:08 | 000,000,000 | ---- | C] () -- C:\Users\***\AppData\Local\QSwitch.txt
[2008.11.17 21:30:08 | 000,000,000 | ---- | C] () -- C:\Users\***\AppData\Local\DSwitch.txt
[2008.11.17 21:30:08 | 000,000,000 | ---- | C] () -- C:\Users\***\AppData\Local\AtStart.txt
[2007.06.27 08:00:00 | 001,777,664 | ---- | C] () -- C:\Windows\System32\ZHP1600R.DLL
[2007.06.27 08:00:00 | 000,749,568 | ---- | C] () -- C:\Windows\System32\AGI1600.DLL
[2007.06.04 21:23:47 | 000,009,349 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2007.02.27 21:43:02 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006.12.14 07:01:36 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006.12.14 07:01:36 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.03.10 01:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2005.05.07 13:06:00 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2005.04.03 21:30:00 | 000,110,592 | R--- | C] () -- C:\Windows\System32\scardsyn.dll
[1998.05.07 02:10:00 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll
[1997.06.14 09:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll

< End of report >

Code:

ATTFilter

OTL Extras logfile created on: 10.01.2011 23:20:21 - Run 3
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\***\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 64.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141.60 Gb Total Space | 36.85 Gb Free Space | 26.03% Space Free | Partition Type: NTFS
Drive D: | 7.45 Gb Total Space | 2.52 Gb Free Space | 33.78% Space Free | Partition Type: NTFS
Drive F: | 7.45 Gb Total Space | 7.05 Gb Free Space | 94.68% Space Free | Partition Type: FAT32
 
Computer Name: ***-*** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:UPnP System
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:UPnP System
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:UPnP System
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:UPnP System
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{12D5C0F2-6753-4682-8514-62DB505B673F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{CC95AE52-2F99-4221-AAC4-EE790261D580}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{D61BAD66-50CF-4075-8EEC-3323BC7AB3CE}" = lport=2869 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DA7CC48-6C26-468D-9FF0-A1B736F8E77F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{121F0586-5630-4C3A-9BAB-9FC66C360546}" = dir=in | app=c:\program files\msn messenger\livecall.exe | 
"{15722F55-342A-4A7C-BECA-773945F850E0}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{19807948-9B7A-4F07-A586-1B3F0AD45D53}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{2DC03CBC-3C46-4EDD-AF52-5C1849C09321}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{34A35AFB-5503-48B8-9DF6-C07B06FCCEB7}" = protocol=6 | dir=in | app=c:\users\***\appdata\roaming\dropbox\bin\dropbox.exe | 
"{3AA4D45A-B579-47B9-B2DD-5914E7036A24}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{5348107D-2B4A-4C00-B569-5119DE5D3159}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe | 
"{65B38AAC-9BDF-4A50-BA47-F7E64F0630E1}" = protocol=17 | dir=in | app=c:\users\***\appdata\roaming\dropbox\bin\dropbox.exe | 
"{7A64FFCA-4AC5-4D08-8CF9-665778FE6C4A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{A58967E5-414F-4F43-A92B-803C74FFF4A5}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{A6AFC86A-4011-406E-A64B-B43C53794ECB}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{AA3AAEFA-CF08-40B3-B1B4-4C81BD11B2D5}" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AFB15CCE-1583-4A5A-BB96-7EEC985B33B8}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe | 
"{C6616E02-83C8-4952-B70F-E42972D3FB6C}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{CC319186-1E44-47C6-BB02-E1C598D51DCF}" = dir=in | app=c:\program files\hp\quickplay\qp.exe | 
"{E50837C5-E282-47FE-84C6-BD9E853C9401}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{EF5EE0F6-0142-4073-919A-65380513BE8C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{F26C0E0B-9F18-4494-9121-8D8EA0FB02DB}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"TCP Query User{0BD2E399-7B20-49E7-80FF-EC7103F313A4}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"TCP Query User{156BEBA6-2CC9-44B5-AFBE-B19D57B5120D}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{5030CB46-42A5-4089-9E66-68B6294A36C7}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{54D0847F-7373-4B20-B3F0-FFA0FB94C34B}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{72B891A0-C33E-4697-ACC8-31E167FA3B90}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{A07026A3-E758-4954-B648-6374B9088E51}C:\sierra\half-life\hl.exe" = protocol=6 | dir=in | app=c:\sierra\half-life\hl.exe | 
"TCP Query User{ACA0516B-FDA4-4F58-8F2F-C3C304C69242}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{DA7B8DA2-B9C6-45E9-8E7F-DF1F95281AD5}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"TCP Query User{F5798EB0-420A-49B9-AEF3-D17ADC15AC64}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"TCP Query User{F877741E-CD41-439B-8593-431703549BEF}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{11B815BD-AC1B-4D12-92C3-FA9A96641EDD}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{251F585E-1796-4D03-B750-7AC950154818}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"UDP Query User{32566C57-B5FC-43C3-867F-182B7A62A75C}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{4A13FA82-2211-4045-92CB-1A283B903D40}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"UDP Query User{562AA8CE-4703-40F1-9860-CCCB89B3A161}C:\sierra\half-life\hl.exe" = protocol=17 | dir=in | app=c:\sierra\half-life\hl.exe | 
"UDP Query User{5D7B4102-CED2-4785-859B-502E1F9832F9}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{87FAB96A-0263-4EE1-A7D5-D1A49A80EB58}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{A7488A5C-F3DB-43DB-8F9E-4A43A2CDA0B5}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{C7B36754-0DC7-47C6-9FE9-5FB236190B2D}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{CEAB97C0-C25A-43CF-BEED-D5405F37D8D5}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{0C34B801-6AEC-4667-B053-03A67E2D0415}" = Apple Application Support
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{194C14D5-3CB0-4977-8886-A79DFC00E820}" = MSCU for Microsoft Vista
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.6.5
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 22
"{290B83AA-093A-45BF-A917-D1C4A1E8D917}" = HP Active Support Library
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{33C65B6A-5D73-4E3E-A1F9-127C27BD3F72}" = Roxio MyDVD Basic v9
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.20 B1
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.2
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7968EB30-5580-4955-8925-4A17CD625118}" = ESU for Microsoft Vista
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista
"{8969CD6F-5B75-40B9-8701-86ECA4C1F263}_is1" = VSO Image Resizer 4.0.0.46
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9061CEF2-51F5-42C9-8A70-9ED351C6597A}" = HP Help and Support
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Matrix Storage Manager
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe  1.4.136.1
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1031-7B44-AA0000000001}" = Adobe Reader X - Deutsch
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B61B6668-A674-4A06-8405-51944D5CCDDD}" = AuthenTec Fingerprint Sensor Minimum Install
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D32067CD-7409-4792-BFA0-1469BCD8F0C8}" = HP Wireless Assistant
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{DDFD9BA2-8E26-4E49-92AE-882424DAB1BC}" = HP User Guides 0057
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{EC2A8F27-4FBF-4E41-B27B-FE822511B761}" = iTunes
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone-Konfigurationsprogramm
"{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}" = HP Active Support Library 32 bit components
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"AC3Filter_is1" = AC3Filter 1.62b
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.9 (Unicode)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"CDex" = CDex extraction audio
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Hattrick Organizer" = Hattrick Organizer (remove only)
"HijackThis" = HijackThis 1.99.1
"IrfanView" = IrfanView (remove only)
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"MonkeyJam_is1" = MonkeyJam 3_050529
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"NVIDIA Drivers" = NVIDIA Drivers
"PDFCreator Toolbar" = PDFCreator Toolbar
"SMSERIAL" = Motorola SM56 Data Fax Modem
"SopCast" = SopCast 3.0.3
"Streamripper" = Streamripper (Remove only)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"SystemRequirementsLab" = System Requirements Lab
"VLC media player" = VLC media player 1.1.5
"Winamp" = Winamp
"WinRAR archiver" = WinRAR Archivierer
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Winamp Detect" = Winamp Detector Plug-in
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 30.08.2010 13:07:07 | Computer Name = ***-*** | Source = Windows Search Service | ID = 3029
Description = Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.  Kontext:
 Windows Anwendung, SystemIndex Katalog  Details:  Die Inhaltsindex-Metadaten können
 nicht gelesen werden.   (0xc0041801) 
 
Error - 30.08.2010 13:07:07 | Computer Name = ***-*** | Source = Windows Search Service | ID = 3029
Description = Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext:
 Windows Anwendung, SystemIndex Katalog  Details:  Element nicht gefunden.   (0x80070490)

 
Error - 30.08.2010 13:07:07 | Computer Name = ***-*** | Source = Windows Search Service | ID = 3028
Description = Das Gatherer-Objekt kann nicht initialisiert werden.  Kontext: Windows
 Anwendung, SystemIndex Katalog  Details:  Die Inhaltsindex-Metadaten können nicht gelesen
 werden.   (0xc0041801) 
 
Error - 30.08.2010 13:07:07 | Computer Name = ***-*** | Source = Windows Search Service | ID = 3058
Description = Die Anwendung kann nicht initialisiert werden.  Kontext: Windows Anwendung

Details:
	Die
 Inhaltsindex-Metadaten können nicht gelesen werden.   (0xc0041801) 
 
Error - 30.08.2010 16:06:05 | Computer Name = ***-*** | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung AcroRd32.exe, Version 8.0.0.456, Zeitstempel
 0x453c8fee, fehlerhaftes Modul MSVCR80.dll, Version 8.0.50727.4053, Zeitstempel
 0x4a594c79, Ausnahmecode 0xc0000005, Fehleroffset 0x000173f7,  Prozess-ID 0x13f0,
 Anwendungsstartzeit 01cb487ec5b14b81.
 
Error - 31.08.2010 02:31:11 | Computer Name = ***-*** | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 12.0.6541.5000 arbeitet nicht mehr mit
 Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 1084  Anfangszeit: 01cb48d5d6d2cf46  Zeitpunkt
 der Beendigung: 19
 
Error - 31.08.2010 06:29:22 | Computer Name = ***-*** | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe_HPSLPSVC, Version 6.0.6000.16386,
 Zeitstempel 0x4549adc4, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel
 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x00680063,  Prozess-ID 0xb88, 
Anwendungsstartzeit 01cb48d300a0f4d6.
 
Error - 01.09.2010 11:20:57 | Computer Name = ***-*** | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe_HPSLPSVC, Version 6.0.6000.16386,
 Zeitstempel 0x4549adc4, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel
 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x00430064,  Prozess-ID 0xb54, 
Anwendungsstartzeit 01cb49a07c068002.
 
Error - 02.09.2010 05:43:44 | Computer Name = ***-*** | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung AcroRd32.exe, Version 8.0.0.456, Zeitstempel
 0x453c8fee, fehlerhaftes Modul MSVCR80.dll, Version 8.0.50727.4053, Zeitstempel
 0x4a594c79, Ausnahmecode 0xc0000005, Fehleroffset 0x0001508e,  Prozess-ID 0x12ac,
 Anwendungsstartzeit 01cb4a8354474bc6.
 
Error - 02.09.2010 05:56:37 | Computer Name = ***-*** | Source = Windows Search Service | ID = 3024
Description = Die Aktualisierung kann nicht gestartet werden, da kein Zugriff auf
 die Inhaltsquellen bestand. Beheben Sie die Fehler, und starten Sie die Aktualisierung
 erneut.  Kontext: Windows Anwendung, SystemIndex Katalog 
 
[ System Events ]
Error - 10.01.2011 18:19:19 | Computer Name = ***-*** | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 10.01.2011 18:19:19 | Computer Name = ***-*** | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 10.01.2011 18:19:19 | Computer Name = ***-*** | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 10.01.2011 18:19:28 | Computer Name = ***-*** | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 10.01.2011 18:19:29 | Computer Name = ***-*** | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 10.01.2011 18:19:29 | Computer Name = ***-*** | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 10.01.2011 18:19:29 | Computer Name = ***-*** | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 10.01.2011 18:19:31 | Computer Name = ***-*** | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 10.01.2011 18:19:31 | Computer Name = ***-*** | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 10.01.2011 18:19:32 | Computer Name = ***-*** | Source = Service Control Manager | ID = 7024
Description = 
 
[ TuneUp Events ]
Error - 13.10.2009 14:44:20 | Computer Name = ***-*** | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 13.10.2009 17:23:59 | Computer Name = ***-*** | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 14.10.2009 11:31:37 | Computer Name = ***-*** | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 14.10.2009 16:59:34 | Computer Name = ***-*** | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 15.10.2009 04:45:38 | Computer Name = ***-*** | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 15.10.2009 06:35:20 | Computer Name = ***-*** | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 15.10.2009 11:47:51 | Computer Name = ***-*** | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 16.10.2009 09:06:07 | Computer Name = ***-*** | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 17.10.2009 09:12:25 | Computer Name = ***-*** | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 18.10.2009 10:11:44 | Computer Name = ***-*** | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
 
< End of report >

cosinus · 11.01.2011, 18:35

Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
[2010.12.20 23:06:01 | 000,000,010 | -HS- | C] () -- C:\Users\***\AppData\Roaming\date
[2010.12.20 23:06:00 | 000,000,002 | -HS- | C] () -- C:\Users\***\AppData\Roaming\evf6
[2011.01.10 21:07:53 | 000,000,000 | ---D | C] -- C:\Windows\System32\no-NO
[2011.01.09 00:25:14 | 000,000,002 | -HS- | M] () -- C:\Users\***\AppData\Roaming\evf6
[2010.12.21 22:04:49 | 000,000,010 | -HS- | M] () -- C:\Users\***\AppData\Roaming\date
DRV - (dwghna) -- C:\Windows\System32\drivers\ensgn.sys File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.09.11 16:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
:Commands
[purity]
[resethosts]
[emptytemp]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Grischuna · 11.01.2011, 21:23

Code:

ATTFilter

All processes killed
========== OTL ==========
File C:\Users\***\AppData\Roaming\date not found.
File C:\Users\***\AppData\Roaming\evf6 not found.
C:\Windows\System32\no-NO folder moved successfully.
File C:\Users\***\AppData\Roaming\evf6 not found.
File C:\Users\***\AppData\Roaming\date not found.
Service dwghna stopped successfully!
Service dwghna deleted successfully!
File  C:\Windows\System32\drivers\ensgn.sys File not found not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
D:\AUTOMODE moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: ***
->Temp folder emptied: 997640 bytes
->Temporary Internet Files folder emptied: 75118 bytes
->Java cache emptied: 3991288 bytes
->FireFox cache emptied: 55422450 bytes
->Flash cache emptied: 8250 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1090386 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 684219719 bytes
 
Total Files Cleaned = 711.00 mb
 
 
OTL by OldTimer - Version 3.2.17.3 log created on 01112011_211121

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus · 11.01.2011, 22:05

Zitat:

C:\Users\***\

hast du vor dem scripten die Sternchen wieder in deinen Namen zurückverwandelt??
Wenn nicht gleich nochmal machen aber die Sternchen durch den Benutzernamen ersetzen!

Grischuna · 11.01.2011, 23:02

Ja, hab ich übersehen, neuer Versuch:

Code:

ATTFilter

All processes killed
========== OTL ==========
C:\Users\***\AppData\Roaming\date moved successfully.
C:\Users\***\AppData\Roaming\evf6 moved successfully.
Folder C:\Windows\System32\no-NO\ not found.
File C:\Users\***\AppData\Roaming\evf6 not found.
File C:\Users\***\AppData\Roaming\date not found.
Error: No service named dwghna was found to stop!
Service\Driver key dwghna not found.
File  C:\Windows\System32\drivers\ensgn.sys File not found not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File D:\AUTOMODE not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: ***
->Temp folder emptied: 1536 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 0.00 mb
 
 
OTL by OldTimer - Version 3.2.17.3 log created on 01112011_225609

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus · 11.01.2011, 23:58

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Grischuna · 12.01.2011, 20:23

Code:

ATTFilter

ComboFix 11-01-11.03 - *** 12.01.2011  20:05:01.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.41.1031.18.2046.1345 [GMT 1:00]
ausgeführt von:: c:\users\***\Desktop\cofi.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Install.exe

.
(((((((((((((((((((((((   Dateien erstellt von 2010-12-12 bis 2011-01-12  ))))))))))))))))))))))))))))))
.

2011-01-11 20:11 . 2011-01-11 20:11	--------	d-----w-	C:\_OTL
2011-01-10 20:38 . 2008-01-24 23:46	106496	----a-w-	c:\windows\system32\drivers\Rtlh86.sys
2011-01-09 20:15 . 2011-01-09 20:15	--------	d-----w-	c:\users\***\AppData\Roaming\InstallShield
2011-01-08 20:11 . 2011-01-08 20:11	--------	d-----w-	c:\users\***\AppData\Roaming\Avira
2010-12-31 12:15 . 2010-12-31 12:25	--------	d-----w-	C:\HattrickOrganizer
2010-12-20 22:05 . 2010-12-20 22:05	483840	----a-w-	c:\windows\system32\SWFLASH6.OCX
2010-12-16 20:30 . 2011-01-10 22:14	--------	d-----w-	c:\users\***\AppData\Roaming\vlc
2010-12-14 19:30 . 2010-10-12 13:41	66048	----a-w-	c:\program files\Windows Mail\wabmig.exe
2010-12-14 19:30 . 2010-10-12 13:41	515584	----a-w-	c:\program files\Windows Mail\wab.exe
2010-12-14 19:30 . 2010-10-12 15:53	33280	----a-w-	c:\program files\Windows Mail\wabfind.dll
2010-12-14 19:30 . 2010-10-18 13:31	2038272	----a-w-	c:\windows\system32\win32k.sys
2010-12-14 19:30 . 2010-11-04 18:55	352768	----a-w-	c:\windows\system32\taskschd.dll
2010-12-14 19:30 . 2010-11-04 18:55	601600	----a-w-	c:\windows\system32\schedsvc.dll
2010-12-14 19:30 . 2010-11-04 18:56	345600	----a-w-	c:\windows\system32\wmicmiplugin.dll
2010-12-14 19:30 . 2010-11-04 18:55	270336	----a-w-	c:\windows\system32\taskcomp.dll
2010-12-14 19:30 . 2010-11-04 16:34	171520	----a-w-	c:\windows\system32\taskeng.exe

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 18:31 . 2010-12-05 21:11	135096	----a-w-	c:\windows\system32\drivers\avipbb.sys
2010-12-20 17:09 . 2010-10-18 17:38	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2010-10-18 17:38	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-12-11 17:36 . 2010-12-05 21:11	61960	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2010-11-22 21:28 . 2006-11-02 10:32	101888	----a-w-	c:\windows\system32\ifxcardm.dll
2010-11-22 21:28 . 2006-11-02 10:32	82432	----a-w-	c:\windows\system32\axaltocm.dll
2010-11-10 04:33 . 2010-12-03 06:56	6273872	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{377497AF-0BD1-4F80-B866-FC5AC265F74B}\mpengine.dll
2010-10-19 09:41 . 2009-10-03 12:20	222080	------w-	c:\windows\system32\MpSigStub.exe
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19	94208	----a-w-	c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19	94208	----a-w-	c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19	94208	----a-w-	c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-09 4390912]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PDFCreator.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PDFCreator.lnk
backup=c:\windows\pss\PDFCreator.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2009-12-15 09:40	207504	----a-w-	c:\program files\pdf24\pdf24.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WindowsWelcomeCenter"=rundll32.exe oobefldr.dll,ShowWelcomeCenter

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Health Check Scheduler"=c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
"HP Software Update"=c:\program files\Hp\HP Software Update\HPWuSchd2.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe"
"QPService"="c:\program files\HP\QuickPlay\QPService.exe"
"SMSERIAL"=c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
"WinampAgent"="c:\program files\Winamp\winampa.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-08-02 135336]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-08-28 3664384]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/webhp?hl=de&tab=iw/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_CH&c=73&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = <local>
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\obcgsj7d.default\
FF - prefs.js: browser.startup.homepage - google.ch
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM-Run-WAWifiMessage - %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
HKLM-Run-hpWirelessAssistant - %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
HKLM-Run-QlbCtrl - %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
AddRemove-HijackThis - c:\users\***\Downloads\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-01-12 20:15
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-01-12  20:18:27
ComboFix-quarantined-files.txt  2011-01-12 19:18

Vor Suchlauf: 15 Verzeichnis(se), 44'961'742'848 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 44'686'098'432 Bytes frei

- - End Of File - - 230B9D3B928BC3085FFFDADF271D65A2

cosinus · 12.01.2011, 20:48

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur einige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Grischuna · 13.01.2011, 00:04

Hier der Log von GMER:

Code:

ATTFilter

GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-01-12 23:40:06
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD16 rev.04.0
Running: nx19drci.exe; Driver: C:\Users\Roger\AppData\Local\Temp\kgroyuoc.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0  Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \FileSystem\fastfat \Fat                 fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\fastfat \Fat                 fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

OSAM

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 23:59:18 on 12.01.2011

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.13

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\Roger\AppData\Local\Temp\catchme.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"kgroyuoc" (kgroyuoc) - ? - C:\Users\Roger\AppData\Local\Temp\kgroyuoc.sys  (Hidden registry entry, rootkit activity | File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL
{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\Windows\System32\ShellvRTF.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
<binary data> "PDFCreator Toolbar" - ? - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} "Java Plug-in 1.6.0" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} "PDFCreator Toolbar" - ? - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{C451C08A-EC37-45DF-AAAD-18B51AB5E837} "PDFCreator Toolbar Helper" - ? - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Roger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"IAAnotif" - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"HP CLJ1600 LM" - "Zenographics, Inc." - C:\Windows\system32\ZLHP1600.DLL
"PCL hpz3l4v2" - "Hewlett-Packard Company" - C:\Windows\system32\hpz3l4v2.dll
"PDFCreator" - "internet-support foehr.com" - C:\Windows\system32\pdfcmnnt.dll
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
"iPod Service" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll
"RoxMediaDB9" (RoxMediaDB9) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
"stllssvr" (stllssvr) - "MicroVision Development, Inc." - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

MBR:

Code:

ATTFilter

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Vista Home Premium Edition
Windows Information:		Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:	Quanta
BIOS Manufacturer:		Hewlett-Packard
System Manufacturer:		Hewlett-Packard
System Product Name:		HP Pavilion dv6500 Notebook PC
Logical Drives Mask:		0x0000003c

Kernel Drivers (total 155):
  0x82434000 \SystemRoot\system32\ntkrnlpa.exe
  0x82401000 \SystemRoot\system32\hal.dll
  0x80609000 \SystemRoot\system32\kdcom.dll
  0x80610000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x80680000 \SystemRoot\system32\PSHED.dll
  0x80691000 \SystemRoot\system32\BOOTVID.dll
  0x80699000 \SystemRoot\system32\CLFS.SYS
  0x806DA000 \SystemRoot\system32\CI.dll
  0x82A03000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x82A7F000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x82A8C000 \SystemRoot\system32\drivers\acpi.sys
  0x82AD2000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x82ADB000 \SystemRoot\system32\drivers\msisadrv.sys
  0x82AE3000 \SystemRoot\system32\drivers\pci.sys
  0x82B0A000 \SystemRoot\System32\drivers\partmgr.sys
  0x82B19000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x82B1C000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x82B26000 \SystemRoot\system32\drivers\volmgr.sys
  0x82B35000 \SystemRoot\System32\drivers\volmgrx.sys
  0x82B7F000 \SystemRoot\system32\DRIVERS\pciide.sys
  0x82B86000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
  0x82B94000 \SystemRoot\System32\drivers\mountmgr.sys
  0x88009000 \SystemRoot\system32\DRIVERS\iaStor.sys
  0x880C7000 \SystemRoot\system32\drivers\atapi.sys
  0x880CF000 \SystemRoot\system32\drivers\ataport.SYS
  0x880ED000 \SystemRoot\system32\drivers\fltmgr.sys
  0x8811F000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8812F000 \SystemRoot\System32\Drivers\PxHelp20.sys
  0x88138000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8820C000 \SystemRoot\system32\drivers\ndis.sys
  0x88317000 \SystemRoot\system32\drivers\msrpc.sys
  0x88342000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8840B000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8851B000 \SystemRoot\system32\drivers\volsnap.sys
  0x88554000 \SystemRoot\System32\Drivers\spldr.sys
  0x8855C000 \SystemRoot\System32\Drivers\mup.sys
  0x8856B000 \SystemRoot\System32\drivers\ecache.sys
  0x88592000 \SystemRoot\system32\drivers\disk.sys
  0x885A3000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x885C4000 \SystemRoot\system32\drivers\crcdisk.sys
  0x8BECD000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x8BED8000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x8BEDC000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0x8BEE5000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x8C20C000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
  0x8CB7D000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
  0x8BEF4000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8CB7F000 \SystemRoot\System32\drivers\watchdog.sys
  0x8CB8B000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0x8CB96000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8CBD4000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8CE03000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8D00E000 \SystemRoot\system32\DRIVERS\NETw5v32.sys
  0x8D396000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
  0x8D3B4000 \SystemRoot\system32\DRIVERS\ohci1394.sys
  0x8D3C4000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
  0x8D3D2000 \SystemRoot\system32\DRIVERS\sdbus.sys
  0x8D3EC000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
  0x8CE90000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
  0x8CEA4000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
  0x8D3FB000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
  0x8CEF5000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8D000000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8CF05000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8CF18000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8CF23000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x8D007000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8CF4E000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8CF59000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8CF71000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0x8CF77000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8CFA6000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8CFE7000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8CFF2000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8CBE3000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8BF95000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8D009000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8BFA5000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8C200000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8BFCF000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x8837D000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x8BFDC000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0x8F003000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8F1AD000 \SystemRoot\system32\drivers\portcls.sys
  0x8F1DA000 \SystemRoot\system32\drivers\drmk.sys
  0x8F208000 \SystemRoot\system32\DRIVERS\smserial.sys
  0x8F2F8000 \SystemRoot\system32\drivers\modem.sys
  0x8F305000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8F30E000 \SystemRoot\System32\Drivers\Null.SYS
  0x8F315000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8F31C000 \SystemRoot\System32\drivers\vga.sys
  0x8F328000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8F349000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8F351000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8F359000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8F364000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8F372000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8F80D000 \SystemRoot\System32\drivers\tcpip.sys
  0x8F8F7000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8F912000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8F928000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8F93C000 \SystemRoot\system32\drivers\afd.sys
  0x8F984000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8F9B6000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8F9CC000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8F9DA000 \SystemRoot\system32\DRIVERS\eabfiltr.sys
  0x8F9DC000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8F9EF000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x8F37B000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8F9F5000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8F3B7000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8F3CE000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x8F800000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8BE00000 \SystemRoot\System32\Drivers\dump_iaStor.sys
  0x8BFE5000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x885DA000 \SystemRoot\System32\Drivers\usbvideo.sys
  0x883B2000 \SystemRoot\system32\DRIVERS\ATSwpDrv.sys
  0x984F0000 \SystemRoot\System32\win32k.sys
  0x8F3F4000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8BEBE000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x98710000 \SystemRoot\System32\TSDDD.dll
  0x98730000 \SystemRoot\System32\cdd.dll
  0x883D3000 \SystemRoot\system32\drivers\luafv.sys
  0x881A9000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x883EE000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x881BE000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x88400000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x881E8000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x9D601000 \SystemRoot\system32\drivers\spsys.sys
  0x9D6B1000 \SystemRoot\system32\drivers\HTTP.sys
  0x9D71E000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9D73B000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9D754000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9D769000 \SystemRoot\system32\drivers\mrxdav.sys
  0x9D78A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x9D7A9000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9D7E2000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x82BA4000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9E60F000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9E675000 \SystemRoot\system32\drivers\peauth.sys
  0x9E753000 \SystemRoot\System32\Drivers\secdrv.SYS
  0x9E75D000 \SystemRoot\System32\drivers\tcpipreg.sys
  0x9E769000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x9E794000 \SystemRoot\System32\Drivers\fastfat.SYS
  0x9E7E3000 \??\C:\Users\Roger\AppData\Local\Temp\kgroyuoc.sys
  0x9E600000 \SystemRoot\System32\Drivers\BTHUSB.sys
  0xCCE09000 \SystemRoot\System32\Drivers\bthport.sys
  0xCCE89000 \SystemRoot\system32\DRIVERS\rfcomm.sys
  0xCCEB2000 \SystemRoot\system32\DRIVERS\BthEnum.sys
  0xCCED6000 \SystemRoot\system32\DRIVERS\bthmodem.sys
  0xCCEE5000 \SystemRoot\system32\DRIVERS\btwavdt.sys
  0xCCF88000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xCCF9D000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
  0xCCFB2000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
  0x775C0000 \WINDOWS\System32\ntdll.dll

Processes (total 50):
       0 System Idle Process
       4 System
     440 C:\WINDOWS\System32\smss.exe
     576 csrss.exe
     632 C:\WINDOWS\System32\wininit.exe
     644 csrss.exe
     676 C:\WINDOWS\System32\services.exe
     688 C:\WINDOWS\System32\lsass.exe
     696 C:\WINDOWS\System32\lsm.exe
     808 C:\WINDOWS\System32\winlogon.exe
     888 C:\WINDOWS\System32\svchost.exe
     952 C:\WINDOWS\System32\nvvsvc.exe
     984 C:\WINDOWS\System32\svchost.exe
    1124 C:\WINDOWS\System32\svchost.exe
    1156 C:\WINDOWS\System32\svchost.exe
    1172 C:\WINDOWS\System32\svchost.exe
    1280 C:\WINDOWS\System32\audiodg.exe
    1304 C:\WINDOWS\System32\svchost.exe
    1320 C:\WINDOWS\System32\SLsvc.exe
    1356 C:\WINDOWS\System32\svchost.exe
    1444 C:\WINDOWS\System32\nvvsvc.exe
    1484 C:\WINDOWS\System32\svchost.exe
    1688 C:\WINDOWS\System32\spoolsv.exe
    1712 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1992 C:\WINDOWS\System32\alg.exe
    2040 C:\WINDOWS\System32\dwm.exe
     292 C:\WINDOWS\explorer.exe
     380 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
     588 C:\WINDOWS\System32\svchost.exe
     896 C:\WINDOWS\System32\taskeng.exe
    1084 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    1412 C:\WINDOWS\System32\svchost.exe
    1760 C:\WINDOWS\System32\svchost.exe
    1588 C:\WINDOWS\System32\svchost.exe
     872 C:\WINDOWS\System32\svchost.exe
    2072 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    2080 C:\WINDOWS\System32\SearchIndexer.exe
    2516 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    2552 C:\WINDOWS\RtHDVCpl.exe
    2712 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    2724 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    2736 C:\Program Files\Windows Sidebar\sidebar.exe
    3008 C:\Program Files\Windows Sidebar\sidebar.exe
    1812 WUDFHost.exe
    3472 C:\WINDOWS\winsxs\x86_microsoft-windows-consoleime_31bf3856ad364e35_6.0.6002.18005_none_b826026c54dd064c\conime.exe
    3852 C:\WINDOWS\System32\SearchProtocolHost.exe
    2336 C:\WINDOWS\System32\SearchFilterHost.exe
    3908 dllhost.exe
    2052 dllhost.exe
    3436 C:\Users\Roger\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000023`668bea00  (NTFS)

PhysicalDrive0 Model Number: WDCWD1600BEVS-60RST0, Rev: 04.01G04

      Size  Device Name          MBR Status
  --------------------------------------------
    149 GB  \\.\PhysicalDrive0   Unknown MBR code
            SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit: 

Done!

cosinus · 13.01.2011, 10:44

Zitat:

149 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC
Found non-standard or infected MBR.

Hast Du noch andere Betriebssysteme außer Vista installiert?

Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten).

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen.