| |
| |||||||
Log-Analyse und Auswertung: "keine Rückmeldung" automatisch bootenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
18.01.2011, 20:56
| #1 |
 |  "keine Rückmeldung" automatisch booten Guten Abend, Mein laptop hängt sich oft auf und bootet dann automatisch. Fast alles hat "keine Rückmeldung". Könnt sich jemand meinen logfile angucken bitte. Ich habe gestern wo anders einen Thread eröffnet und bekam leider keine antworten. Deswegen dachte ich, dass ich an die falsche stelle gepostet habe. Es tut mir auch leid wegen crossposting . Aber verzweifelte menschen machen fast immer unsinn  Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 20:52:53, on 18.01.2011 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18999) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\System32\rundll32.exe C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe C:\Program Files\Apoint2K\Apoint.exe C:\Windows\System32\TpShocks.exe C:\Program Files\Lenovo\Drag-to-Disc\DrgToDsc.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Sophos\AutoUpdate\ALMon.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\ich\Desktop\HiJackThis204.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo.live.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo.live.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [TpShocks] TpShocks.exe O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Lenovo\Drag-to-Disc\DrgToDsc.exe" O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start O4 - HKLM\..\Run: [Sophos AutoUpdate Monitor] C:\Program Files\Sophos\AutoUpdate\almon.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm O16 - DPF: {34635AA6-B593-4F06-9EDD-5FF60FC13310} (Speaky Chat) - hxxp://download.speakyweb.com/speakyldr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe O23 - Service: Sophos Anti-Virus Statusreporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe O23 - Service: Sophos Agent - Sophos Plc - C:\Program Files\Sophos\SCC\Remote Management System\ManagementAgentNT.exe O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe O23 - Service: Sophos Certification Manager - Sophos Plc - C:\Program Files\Sophos\SCC\CertificationManagerServiceNT.exe O23 - Service: Sophos Management Service - Sophos Plc - C:\Program Files\Sophos\SCC\MgntSvc.exe O23 - Service: Sophos Message Router - Sophos Plc - C:\Program Files\Sophos\SCC\Remote Management System\RouterNT.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Sophos Update Manager (SUM) - Sophos Group - C:\Program Files\Sophos\SCC\SUM\SUMService.exe O23 - Service: Sophos Web Intelligence Service (swi_service) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\Windows\System32\TPHDEXLG.exe O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 7866 bytes Geändert von eleganto (18.01.2011 um 21:03 Uhr) |
|
19.01.2011, 11:00
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | "keine Rückmeldung" automatisch booten Hallo und
__________________ Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! Danach OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ |
|
19.01.2011, 17:41
| #3 |
| | "keine Rückmeldung" automatisch booten Hallo danke dass du Zeit hast für mich.
__________________hier sind die logfiles malwarebytes Code:
ATTFilter Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 5553
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999
19.01.2011 17:23:59
mbam-log-2011-01-19 (17-23-59).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|Q:\|)
Durchsuchte Objekte: 283209
Laufzeit: 47 Minute(n), 44 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Code:
ATTFilter OTL logfile created on: 19.01.2011 17:36:06 - Run 1 OTL by OldTimer - Version 3.2.20.2 Folder = C:\Users\ich\Desktop Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18999) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 49,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 69,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 142,72 Gb Total Space | 96,43 Gb Free Space | 67,56% Space Free | Partition Type: NTFS Computer Name: ICH-LAPTOP | User Name: ich | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\ich\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe (Sophos Plc) PRC - C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe (Sophos Plc) PRC - C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe (Sophos Plc) PRC - C:\Programme\Sophos\SCC\Remote Management System\RouterNT.exe (Sophos Plc) PRC - C:\Programme\Sophos\SCC\Remote Management System\ManagementAgentNT.exe (Sophos Plc) PRC - C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc) PRC - C:\Programme\Sophos\AutoUpdate\ALsvc.exe (Sophos Plc) PRC - C:\Programme\Common Files\microsoft shared\Virtualization Handler\CVH.EXE (Microsoft Corporation) PRC - C:\Programme\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation) PRC - C:\Programme\Common Files\microsoft shared\Virtualization Handler\OFFICEVIRT.EXE () PRC - C:\Programme\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Programme\Sophos\SCC\SUM\SUMService.exe (Sophos Group) PRC - C:\Programme\Sophos\SCC\SUM\SophosUpdateMgr.exe (Sophos Group) PRC - C:\Programme\Sophos\SCC\MgntSvc.exe (Sophos Plc) PRC - C:\Programme\Sophos\SCC\CertificationManagerServiceNT.exe (Sophos Plc) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Windows\System32\TpShocks.exe (Lenovo.) PRC - C:\Windows\System32\TPHDEXLG.exe (Lenovo.) PRC - C:\Programme\Common Files\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited) PRC - C:\Programme\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe (Lenovo) PRC - C:\Programme\ThinkPad\ConnectUtilities\ACWLIcon.exe (Lenovo) PRC - C:\Programme\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo) PRC - C:\Programme\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo) PRC - C:\Programme\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo) PRC - C:\Programme\ThinkVantage Fingerprint Software\upeksvr.exe (UPEK Inc.) PRC - C:\Programme\Lenovo\Drag-to-Disc\DrgToDsc.exe (Roxio) PRC - C:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited) PRC - C:\Programme\Lenovo\HOTKEY\TPONSCR.exe (Lenovo Group Limited) PRC - C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited) PRC - C:\Programme\Common Files\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited) PRC - C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe () PRC - C:\Programme\Lenovo\Rescue and Recovery\rrservice.exe (Lenovo Group Limited) PRC - C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo) PRC - C:\Programme\Diskeeper Corporation\Diskeeper\DkIcon.exe (Diskeeper Corporation) PRC - C:\Programme\Diskeeper Corporation\Diskeeper\DkService.exe (Diskeeper Corporation) PRC - C:\Programme\Diskeeper Corporation\Diskeeper\DfrgNTFS.exe (Diskeeper Corporation) PRC - C:\Programme\Digital Line Detect\DLG.exe (Avanquest Software ) PRC - C:\Programme\Lenovo\ZOOM\TpScrex.exe (Lenovo Group Limited) ========== Modules (SafeList) ========== MOD - C:\Users\ich\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (swi_service) -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe (Sophos Plc) SRV - (SAVService) -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe (Sophos Plc) SRV - (SAVAdminService) -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe (Sophos Plc) SRV - (Sophos Message Router) -- C:\Program Files\Sophos\SCC\Remote Management System\RouterNT.exe (Sophos Plc) SRV - (Sophos Agent) -- C:\Program Files\Sophos\SCC\Remote Management System\ManagementAgentNT.exe (Sophos Plc) SRV - (Sophos AutoUpdate Service) -- C:\Program Files\Sophos\AutoUpdate\ALsvc.exe (Sophos Plc) SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (sftvsa) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (SUM) -- C:\Program Files\Sophos\SCC\SUM\SUMService.exe (Sophos Group) SRV - (Sophos Management Service) -- C:\Program Files\Sophos\SCC\MgntSvc.exe (Sophos Plc) SRV - (Sophos Certification Manager) -- C:\Program Files\Sophos\SCC\CertificationManagerServiceNT.exe (Sophos Plc) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (TPHDEXLGSVC) -- C:\Windows\System32\TPHDEXLG.exe (Lenovo.) SRV - (ThinkVantage Registry Monitor Service) -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited) SRV - (AcSvc) -- C:\Programme\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo) SRV - (AcPrfMgrSvc) -- C:\Programme\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo) SRV - (IBMPMSVC) -- C:\Windows\System32\ibmpmsvc.exe (Lenovo) SRV - (btwdins) -- C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.) SRV - (TPHKSVC) -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe () SRV - (TVT Scheduler) -- C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited) SRV - (TVT Backup Protection Service) -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe () SRV - (TVT Backup Service) -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe (Lenovo Group Limited) SRV - (IviRegMgr) -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo) SRV - (Diskeeper) -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe (Diskeeper Corporation) SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation) ========== Driver Services (SafeList) ========== DRV - (SAVOnAccess) -- C:\Windows\System32\drivers\savonaccess.sys (Sophos Plc) DRV - (sdcfilter) -- C:\Windows\System32\drivers\sdcfilter.sys (Sophos Plc) DRV - (SophosBootDriver) -- C:\Windows\System32\drivers\SophosBootDriver.sys (Sophos Plc) DRV - (psadd) -- C:\Windows\System32\drivers\psadd.sys (Lenovo (United States) Inc.) DRV - (tvtfilter) -- C:\Windows\System32\drivers\tvtfilter.sys (Lenovo) DRV - (Sftvol) -- C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation) DRV - (Sftredir) -- C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation) DRV - (Sftplay) -- C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation) DRV - (Sftfs) -- C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation) DRV - (CnxtHdAudService) -- C:\Windows\System32\drivers\CHDRTN32.sys (Conexant Systems Inc.) DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation) DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation) DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation) DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation) DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation) DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation) DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation) DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation) DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (e1express) Intel(R) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel Corporation) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (TPPWRIF) -- C:\Windows\System32\drivers\TPPWR32V.SYS () DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (Shockprf) -- C:\Windows\System32\DRIVERS\Apsx86.sys (Lenovo.) DRV - (TPDIGIMN) -- C:\Windows\System32\DRIVERS\ApsHM86.sys (Lenovo.) DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC) DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC) DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC) DRV - (IBMPMDRV) -- C:\Windows\System32\drivers\ibmpmdrv.sys (Lenovo.) DRV - (TVTI2C) -- C:\Windows\System32\drivers\tvti2c.sys (Lenovo (United States) Inc.) DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation) DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation) DRV - (HdAudAddService) -- C:\Windows\System32\drivers\CHDARTN.sys (Conexant Systems Inc.) DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.) DRV - (btwaudio) -- C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.) DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.) DRV - (winachsf) -- C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.) DRV - (HSXHWAZL) -- C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.) DRV - (smihlp) SMI Helper Driver (smihlp) -- C:\Programme\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys (UPEK Inc.) DRV - (TcUsb) -- C:\Windows\System32\drivers\tcusb.sys (UPEK Inc.) DRV - (DLADResM) -- C:\Windows\System32\DLA\DLADResM.SYS (Roxio) DRV - (DLABMFSM) -- C:\Windows\System32\DLA\DLABMFSM.SYS (Roxio) DRV - (DLAUDF_M) -- C:\Windows\System32\DLA\DLAUDF_M.SYS (Roxio) DRV - (DLAUDFAM) -- C:\Windows\System32\DLA\DLAUDFAM.SYS (Roxio) DRV - (DLAOPIOM) -- C:\Windows\System32\DLA\DLAOPIOM.SYS (Roxio) DRV - (DLABOIOM) -- C:\Windows\System32\DLA\DLABOIOM.SYS (Roxio) DRV - (DLAPoolM) -- C:\Windows\System32\DLA\DLAPoolM.SYS (Roxio) DRV - (DLAIFS_M) -- C:\Windows\System32\DLA\DLAIFS_M.SYS (Roxio) DRV - (DRVMCDB) -- C:\Windows\System32\Drivers\DRVMCDB.SYS (Sonic Solutions) DRV - (btwavdt) -- C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.) DRV - (btwrchid) -- C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.) DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (DRVNDDM) -- C:\Windows\System32\drivers\DRVNDDM.SYS (Roxio) DRV - (DLARTL_M) -- C:\Windows\System32\drivers\DLARTL_M.SYS (Roxio) DRV - (DLACDBHM) -- C:\Windows\System32\drivers\DLACDBHM.SYS (Roxio) DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (lenovo.smi) -- C:\Windows\System32\drivers\smiif32.sys (Lenovo Group Limited) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo.live.com IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3384489848-266114249-364278530-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo.live.com IE - HKU\S-1-5-21-3384489848-266114249-364278530-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad [binary data] IE - HKU\S-1-5-21-3384489848-266114249-364278530-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-3384489848-266114249-364278530-1002\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-3384489848-266114249-364278530-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:21.1.10084.997 FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.13 20:42:22 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.28 22:22:52 | 000,000,000 | ---D | M] [2010.11.29 20:10:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ich\AppData\Roaming\mozilla\Extensions [2011.01.18 22:07:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ich\AppData\Roaming\mozilla\Firefox\Profiles\4h7fgq0l.default\extensions [2010.12.18 16:46:31 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\ich\AppData\Roaming\mozilla\Firefox\Profiles\4h7fgq0l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.12.28 21:55:43 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\ich\AppData\Roaming\mozilla\Firefox\Profiles\4h7fgq0l.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2011.01.17 22:00:25 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.12.15 19:10:50 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Programme\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE} [2010.12.15 19:10:50 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{9AA46F4F-4DC7-4C06-97AF-5035170633FE} [2010.10.27 06:44:13 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.10.27 06:44:13 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.10.27 06:44:13 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.10.27 06:44:13 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.10.27 06:44:13 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ACTray] C:\Programme\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo) O4 - HKLM..\Run: [ACWLIcon] C:\Programme\ThinkPad\ConnectUtilities\ACWLIcon.exe (Lenovo) O4 - HKLM..\Run: [DiskeeperSystray] C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe (Diskeeper Corporation) O4 - HKLM..\Run: [PWMTRV] C:\Programme\ThinkPad\Utilities\PWMTR32V.DLL (Lenovo Group Limited) O4 - HKLM..\Run: [RoxioDragToDisc] C:\Program Files\Lenovo\Drag-to-Disc\DrgToDsc.exe (Roxio) O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc) O4 - HKLM..\Run: [TPHOTKEY] C:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited) O4 - HKLM..\Run: [TpShocks] C:\Windows\System32\TpShocks.exe (Lenovo.) O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Programme\Common Files\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1 O7 - HKU\S-1-5-21-3384489848-266114249-364278530-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O13 - gopher Prefix: missing O16 - DPF: {34635AA6-B593-4F06-9EDD-5FF60FC13310} hxxp://download.speakyweb.com/speakyldr.cab (Speaky Chat) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation) O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img21.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img21.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.01.19 17:32:02 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\ich\Desktop\OTL.exe [2011.01.19 16:32:54 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\Malwarebytes [2011.01.19 16:32:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.01.19 16:32:48 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.01.19 16:32:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.01.19 16:32:45 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.01.19 16:32:45 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.01.19 16:30:05 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\ich\Desktop\mbam-setup-1.50.1.1100.exe [2011.01.18 21:06:07 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2011.01.17 20:22:53 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\Canneverbe Limited [2011.01.17 20:22:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited [2011.01.17 20:22:13 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\Uniblue [2011.01.17 20:21:42 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Local\OpenCandy [2011.01.17 20:21:40 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\OpenCandy [2011.01.17 20:21:39 | 000,000,000 | ---D | C] -- C:\Programme\CDBurnerXP [2011.01.17 20:12:53 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\DeepBurner [2011.01.17 20:11:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DeepBurner [2011.01.17 20:11:56 | 000,000,000 | ---D | C] -- C:\Programme\Astonsoft [2011.01.17 19:58:08 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Local\CrashDumps [2011.01.17 03:47:38 | 000,000,000 | ---D | C] -- C:\Programme\trend micro [2011.01.17 03:47:38 | 000,000,000 | ---D | C] -- C:\rsit [2011.01.17 02:46:41 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\ich\Desktop\HiJackThis204.exe [2011.01.16 23:33:58 | 000,000,000 | ---D | C] -- C:\symbols [2011.01.16 23:26:59 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Windows Performance Toolkit [2011.01.16 23:26:58 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Windows Performance Toolkit [2011.01.16 23:26:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugging Tools for Windows (x86) [2011.01.16 23:26:30 | 000,000,000 | ---D | C] -- C:\Programme\Debugging Tools for Windows (x86) [2011.01.16 23:26:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Application Verifier [2011.01.16 23:26:07 | 000,000,000 | ---D | C] -- C:\Programme\Application Verifier [2011.01.16 23:19:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1 [2011.01.16 23:19:00 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft SDKs [2011.01.16 22:22:49 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Local\Sophos [2011.01.16 22:18:41 | 000,131,824 | ---- | C] (Sophos Plc) -- C:\Windows\System32\sdccoinstaller.dll [2011.01.16 22:18:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Sophos Web Intelligence [2011.01.16 22:17:31 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Cisco Systems [2011.01.16 22:17:27 | 000,028,912 | ---- | C] (Sophos Plc) -- C:\Windows\System32\SophosBootTasks.exe [2011.01.16 22:16:01 | 000,122,360 | ---- | C] (Sophos Plc) -- C:\Windows\System32\drivers\savonaccess.sys [2011.01.16 22:15:29 | 000,023,928 | ---- | C] (Sophos Plc) -- C:\Windows\System32\drivers\sdcfilter.sys [2011.01.16 22:15:09 | 000,022,536 | ---- | C] (Sophos Plc) -- C:\Windows\System32\drivers\SophosBootDriver.sys [2011.01.16 21:25:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos [2011.01.16 21:25:02 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Sophos [2011.01.16 21:24:43 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Business Objects [2011.01.16 21:24:42 | 000,000,000 | ---D | C] -- C:\Programme\Sophos [2011.01.16 21:24:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Sophos [2011.01.16 21:24:42 | 000,000,000 | ---D | C] -- C:\Programme\Business Objects [2011.01.16 21:22:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft SQL Server 2005 [2011.01.16 21:19:17 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft SQL Server [2011.01.16 21:16:33 | 000,000,000 | ---D | C] -- C:\scc_40 [2011.01.16 14:24:47 | 000,000,000 | -HSD | C] -- C:\found.000 [2011.01.15 22:26:24 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\skypePM [2011.01.14 22:22:42 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Skype [2011.01.14 22:22:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2011.01.14 22:22:41 | 000,000,000 | R--D | C] -- C:\Programme\Skype [2011.01.14 22:22:40 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\Skype [2011.01.14 22:22:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2011.01.12 17:02:16 | 000,413,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll [2011.01.12 17:02:14 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe [2010.12.28 05:35:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Roxio [2010.12.28 05:35:02 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\Roxio [2010.12.28 02:30:46 | 023,801,112 | ---- | C] (DivX, Inc.) -- C:\Users\ich\Desktop\DivXInstaller0310.exe [2010.12.23 16:04:26 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch [2010.12.23 03:14:05 | 000,000,000 | ---D | C] -- C:\Programme\Dr. Hardware 2011 [2010.12.23 03:02:54 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2010.12.21 19:55:38 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Local\Sony Ericsson [2010.12.21 19:55:38 | 000,000,000 | ---D | C] -- C:\ProgramData\BVRP Software [2010.12.21 19:52:00 | 000,120,744 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016mdm.sys [2010.12.21 19:52:00 | 000,115,752 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016unic.sys [2010.12.21 19:52:00 | 000,114,216 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016mgmt.sys [2010.12.21 19:52:00 | 000,110,632 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016obex.sys [2010.12.21 19:52:00 | 000,089,256 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016bus.sys [2010.12.21 19:52:00 | 000,025,512 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016nd5.sys [2010.12.21 19:52:00 | 000,015,016 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016mdfl.sys [2010.12.21 19:52:00 | 000,012,200 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016whnt.sys [2010.12.21 19:52:00 | 000,012,200 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016wh.sys [2010.12.21 19:52:00 | 000,012,200 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016cmnt.sys [2010.12.21 19:52:00 | 000,012,200 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016cm.sys [2010.12.21 19:52:00 | 000,010,792 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\s0016cr.sys [2010.12.21 19:51:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony Ericsson [2010.11.14 00:05:32 | 000,167,936 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll [2010.11.14 00:05:32 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll ========== Files - Modified Within 30 Days ========== [2011.01.19 17:32:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ich\Desktop\OTL.exe [2011.01.19 16:32:49 | 000,000,916 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.01.19 16:30:19 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\ich\Desktop\mbam-setup-1.50.1.1100.exe [2011.01.19 16:28:44 | 000,007,446 | ---- | M] () -- C:\Users\ich\Documents\cc_20110119_162841.reg [2011.01.19 16:08:50 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.01.19 16:08:50 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.01.19 16:08:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.01.19 05:35:41 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2011.01.18 21:29:43 | 000,721,734 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.01.18 21:29:43 | 000,681,552 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.01.18 21:29:43 | 000,163,822 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.01.18 21:29:43 | 000,137,552 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.01.18 21:08:34 | 000,024,676 | ---- | M] () -- C:\Users\ich\Documents\cc_20110118_210829.reg [2011.01.18 21:06:08 | 000,000,814 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.01.18 02:26:11 | 315,994,112 | R--- | M] () -- C:\Users\ich\Desktop\ubcd503.iso [2011.01.17 22:17:25 | 000,002,032 | ---- | M] () -- C:\Users\ich\AppData\Local\d3d9caps.dat [2011.01.17 22:17:13 | 000,000,901 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk [2011.01.17 21:03:55 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2011.01.17 21:03:55 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2011.01.17 20:37:46 | 000,039,778 | ---- | M] () -- C:\Users\Public\Documents\AcSvc.dmp [2011.01.17 20:21:44 | 000,001,744 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk [2011.01.17 20:12:42 | 000,000,920 | ---- | M] () -- C:\Users\ich\Desktop\DeepBurner.lnk [2011.01.17 03:53:16 | 000,296,448 | ---- | M] () -- C:\Users\ich\Desktop\jvwuq2og.exe [2011.01.17 03:14:58 | 000,339,991 | ---- | M] () -- C:\Users\ich\Desktop\RSIT.exe [2011.01.17 02:46:52 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\ich\Desktop\HiJackThis204.exe [2011.01.16 22:16:01 | 000,122,360 | ---- | M] (Sophos Plc) -- C:\Windows\System32\drivers\savonaccess.sys [2011.01.16 22:15:58 | 000,131,824 | ---- | M] (Sophos Plc) -- C:\Windows\System32\sdccoinstaller.dll [2011.01.16 22:15:29 | 000,023,928 | ---- | M] (Sophos Plc) -- C:\Windows\System32\drivers\sdcfilter.sys [2011.01.16 22:15:25 | 000,028,912 | ---- | M] (Sophos Plc) -- C:\Windows\System32\SophosBootTasks.exe [2011.01.16 22:15:09 | 000,022,536 | ---- | M] (Sophos Plc) -- C:\Windows\System32\drivers\SophosBootDriver.sys [2011.01.14 22:24:17 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat [2011.01.14 22:22:42 | 000,001,880 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2010.12.28 16:55:03 | 000,413,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll [2010.12.28 02:31:33 | 023,801,112 | ---- | M] (DivX, Inc.) -- C:\Users\ich\Desktop\DivXInstaller0310.exe [2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys ========== Files Created - No Company Name ========== [2011.01.19 16:32:49 | 000,000,916 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.01.19 16:28:42 | 000,007,446 | ---- | C] () -- C:\Users\ich\Documents\cc_20110119_162841.reg [2011.01.18 21:08:32 | 000,024,676 | ---- | C] () -- C:\Users\ich\Documents\cc_20110118_210829.reg [2011.01.18 21:06:08 | 000,000,814 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.01.18 02:26:11 | 315,994,112 | R--- | C] () -- C:\Users\ich\Desktop\ubcd503.iso [2011.01.17 21:03:55 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS [2011.01.17 21:03:55 | 000,000,000 | RHS- | C] () -- C:\IO.SYS [2011.01.17 20:21:44 | 000,001,744 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk [2011.01.17 20:11:57 | 000,000,920 | ---- | C] () -- C:\Users\ich\Desktop\DeepBurner.lnk [2011.01.17 19:42:35 | 000,000,003 | ---- | C] () -- C:\ProgramData\DragToDiscUserNameD.txt [2011.01.17 03:53:13 | 000,296,448 | ---- | C] () -- C:\Users\ich\Desktop\jvwuq2og.exe [2011.01.17 03:14:51 | 000,339,991 | ---- | C] () -- C:\Users\ich\Desktop\RSIT.exe [2011.01.14 22:24:17 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.01.14 22:22:42 | 000,001,880 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2010.11.15 22:06:26 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2010.11.14 21:29:17 | 000,000,091 | ---- | C] () -- C:\Users\ich\AppData\Local\fusioncache.dat [2010.11.14 04:00:02 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll [2010.11.14 04:00:02 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2010.11.14 04:00:00 | 000,790,528 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2010.11.14 04:00:00 | 000,134,144 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2010.11.14 04:00:00 | 000,108,032 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2010.11.14 00:57:25 | 000,002,032 | ---- | C] () -- C:\Users\ich\AppData\Local\d3d9caps.dat [2010.11.14 00:26:30 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll [2010.11.14 00:26:29 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll [2010.11.14 00:26:29 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll [2010.11.14 00:26:29 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll [2010.11.14 00:26:29 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll [2010.11.14 00:26:29 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll [2010.11.14 00:24:15 | 000,056,056 | ---- | C] () -- C:\Windows\System32\DLAAPI_W.DLL [2010.11.14 00:24:15 | 000,000,120 | ---- | C] () -- C:\Windows\wininit.ini [2010.11.14 00:12:47 | 001,238,832 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll [2010.11.14 00:12:47 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1329.dll [2010.11.14 00:12:47 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll [2010.11.14 00:05:34 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini [2010.11.14 00:05:33 | 009,598,080 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys [2010.11.14 00:00:28 | 000,012,080 | ---- | C] () -- C:\Windows\System32\drivers\TPPWR32V.SYS [2010.02.08 07:33:04 | 000,359,320 | ---- | C] () -- C:\Windows\System32\vfprintpthelper.dll [2008.11.06 17:37:32 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll [2008.11.06 17:33:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll [2008.10.07 16:13:44 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1576.dll [2007.08.03 14:14:30 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini [2007.03.29 12:42:38 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll [2006.12.13 23:01:36 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll [2006.12.13 23:01:36 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.09.05 14:20:36 | 000,079,400 | ---- | C] () -- C:\Windows\System32\DEVMAN.DLL [2002.02.27 09:41:28 | 000,024,576 | ---- | C] () -- C:\Windows\System32\nsldappr32v50.dll [2002.02.27 09:41:26 | 000,139,264 | ---- | C] () -- C:\Windows\System32\nsldap32v50.dll [2002.02.27 09:41:26 | 000,040,960 | ---- | C] () -- C:\Windows\System32\nsldapssl32v50.dll [2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll < End of report > Code:
ATTFilter OTL Extras logfile created on: 19.01.2011 17:36:06 - Run 1
OTL by OldTimer - Version 3.2.20.2 Folder = C:\Users\ich\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 49,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 69,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142,72 Gb Total Space | 96,43 Gb Free Space | 67,56% Space Free | Partition Type: NTFS
Computer Name: ICH-LAPTOP | User Name: ich | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-3384489848-266114249-364278530-1002\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
"" =
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3384489848-266114249-364278530-1003]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{039963B9-027A-4EAF-8F98-AE6F2BCB7130}" = rport=445 | protocol=6 | dir=out | app=system |
"{25B33875-852B-433B-9F96-D4578C2F046D}" = lport=139 | protocol=6 | dir=in | app=system |
"{2A4EE3AD-8FDC-4ABB-B9E6-4502F7039031}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{84F4BC56-CE0D-4514-97A5-2C4D2BBAB968}" = rport=138 | protocol=17 | dir=out | app=system |
"{BC8D92DB-1641-455B-B717-A5B18E98CBA5}" = lport=137 | protocol=17 | dir=in | app=system |
"{BCF58153-D785-4ACC-8CD3-F2EE62BDC6B5}" = lport=138 | protocol=17 | dir=in | app=system |
"{E3A07138-DB48-4D91-9D7F-8FF423F61175}" = lport=445 | protocol=6 | dir=in | app=system |
"{EE6BC2BF-0169-4D95-B8E2-558AAFABB9CB}" = rport=139 | protocol=6 | dir=out | app=system |
"{FA97022B-8A54-4B88-A532-00C31B35AD27}" = rport=137 | protocol=17 | dir=out | app=system |
"{FAB11560-6C9A-4E09-AB0A-E5767DFE65B3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{157B06FD-026B-42E9-9C00-9A177BBAD8B5}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{16A105F7-4A95-48C4-9473-A2B0E94C6F36}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{22708CE3-A077-431B-BD2B-F43224D9E997}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{3DA1FF56-E4E3-42B8-86B9-33D857BCCC9D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E1C1731E-BD42-4D42-8398-7E6C139CC261}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{4496AA13-8A84-4E51-AFA1-1A288017BD73}C:\program files\world of warcraft\blizzard downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\blizzard downloader.exe |
"TCP Query User{F296D4AB-6D22-4578-8BAE-6DE9A5772A61}C:\program files\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\launcher.exe |
"UDP Query User{4DD83B6B-1C83-417B-B41D-8773AF77F4F2}C:\program files\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\launcher.exe |
"UDP Query User{620238B3-17F6-4732-A260-47E61BAF2581}C:\program files\world of warcraft\blizzard downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\blizzard downloader.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = ThinkPad Bluetooth with Enhanced Data Rate Software 6.0.1.4900
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{15C418EB-7675-42be-B2B3-281952DA014D}" = Sophos AutoUpdate
"{17CBC505-D1AE-459D-B445-3D2000A85842}" = Dienstprogramm "ThinkPad UltraNav"
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (SOPHOS)
"{2C7A82DB-69BC-4198-AC26-BB862F1BE4D0}" = Sophos Update Manager
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Drag-to-Disc
"{39556553-8C77-4C5E-8F30-4083274948A2}" = Application Verifier
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Integrated Camera
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{41894269-0DD1-4C85-B3DD-1EB41B07621D}" = ThinkVantage Fingerprint Software 5.6
"{46A84694-59EC-48F0-964C-7E76E9F8A2ED}" = ThinkVantage System für aktiven Festplattenschutz
"{4AB5764A-3894-49A2-BAA8-C4665F74CD4C}" = Registry patch to improve USB device detection on resume from sleep for Windows Vista
"{4F30BC2B-5441-3149-91D7-FAA2332E2F5F}" = Microsoft Windows SDK for Windows 7 Headers and Libraries (30514)
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.52.02
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{69333A04-5134-40A5-A055-9166A7AA1EC8}" =
"{699C970F-1E17-3CD8-A2EA-87AB9EDEDFF4}" = Microsoft Windows SDK for Windows 7 Samples (30514)
"{796E076A-82F7-4D49-98C8-DEC0C3BC733A}" = Diskeeper Home
"{7AFFE35D-047A-3D27-B204-1CD849933C02}" = Microsoft Windows SDK for Windows 7 Common Utilities (30514)
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7E4C16B8-8F76-4940-8505-98E93C00BF19}" = Rescue and Recovery
"{7EB114D8-207F-45AE-BABD-1669715F2630}" = ThinkVantage Access Connections
"{85C977FB-2A5B-3223-8AC5-828558EAF7D9}" = Microsoft Windows SDK for Windows 7 Utilities for Win32 Development (30514)
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90140000-006D-0407-0000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{90140011-0062-0407-0000-0000000FF1CE}" = Microsoft Office Home and Business 2010 - Deutsch
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{928D2FB1-291A-362B-89A4-7075A9D904A4}" = Microsoft Windows SDK for Windows 7 (7.1)
"{938B1CD7-7C60-491E-AA90-1F1888168240}" = Multimedia Center For Think Offerings
"{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}" = Sophos Anti-Virus
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ThinkPad UltraNav Driver
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-AA0000000001}" = Adobe Reader X - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B334D9AE-1393-423E-97C0-3BDC3360E692}" = Sonic Icons for Lenovo
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF5737AF-8550-4546-A69B-0EA9EF5A9B55}" = ThinkVantage Productivity Center
"{D09605BE-5587-4B0C-86C8-69B5092CB80F}" = Debugging Tools for Windows (x86)
"{D728E945-256D-4477-B377-6BBA693714AC}" = Ergänzung zu Productivity Center für ThinkPad
"{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}" = ThinkPad Energie-Manager
"{DB71210F-8314-4AE3-B7A7-EBAF85BD30E9}" = Wallpapers
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E7F9E526-2324-437B-A609-E8C5309465CB}" = Microsoft Windows Performance Toolkit
"{E9F44C98-B8B6-480F-AF7B-E42A0A46F4E3}" = Microsoft SQL Server VSS Writer
"{F18DB86D-BC16-4E01-BCCE-63F62B931D82}" = InterVideo Register Manager
"{F705E3E1-A471-426B-9A09-73429F3418EE}" = System Migration Assistant
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F9B3DD02-B0B3-42E9-8650-030DFF0D133D}" = Microsoft SQL Server Native Client
"{FE2C8DFE-8886-4181-B3BA-36978ABD5E36}" = Sophos Control Center
"{FED1005D-CBC8-45D5-A288-FFC7BB304121}" = Sophos Remote Management System
"1A96FF9D9E5F19776E6749D8F6557FCC437EB294" = Windows Driver Package - Ricoh Company MS Host Controller (07/30/2007 6.00.01.11)
"2B6D818F3939804B01D509A4234EFE979CAAADCA" = Windows Driver Package - Intel hdc (11/15/2006 8.2.0.1011)
"33B90F7893A16FA92E149B05C5B46C501B4202CD" = Windows Driver Package - Lenovo (IBMPMDRV) System (05/31/2007 1.43)
"38884E3EBEF76FE8FCF8DF8349FE73E84B85632C" = Windows Driver Package - Ricoh Company MMC Host Controller (08/08/2007 6.00.03.02)
"38C8E8384B1D0355BE6B7A0EE5ACD9EA7122E268" = Windows Driver Package - Intel hdc (11/15/2006 8.2.0.1011)
"4CF15B23EAB3D8AAA1E32F8ED986D8811D81835D" = Windows Driver Package - Intel System (09/15/2006 8.0.0.1008)
"510EA369DBF270C677B57C6DBD41B0EB6B269FDB" = Windows Driver Package - Broadcom (b57nd60x) Net (05/09/2007 10.39.0.0)
"530B366ABB8F4E0087E6FB2DE3609611DF9D8D27" = Windows Driver Package - Intel USB (09/15/2006 8.0.0.1008)
"5B35493BBF3623E997EADC90AFF8AA66DF7A114F" = Windows Driver Package - Intel System (09/15/2006 8.2.0.1000)
"67CCAA793684CADDDCD55BAD807632E611CA05D2" = Windows Driver Package - Intel (iaStor) hdc (02/12/2007 7.0.0.1020)
"778DAA8FB0D52FC214BC306BBDC33E26ACAB6F44" = Windows Driver Package - Ricoh Company xD Host Controller (07/30/2007 6.00.01.13)
"787E3A824531CE2DB2180F5CFAD00B052D0E389E" = Windows Driver Package - Intel System (09/15/2006 8.0.0.1010)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_5045&SUBSYS_17AA20DA" = HDAUDIO Soft Data Fax Modem with SmartCP
"Dipmon" = Registry Patch of Enabling Device Initiated Power Management(DIPM) on SATA for Windows Vista
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"E40782D0B0D2A7F661A275F639A54DDA57386FB8" = Windows Driver Package - Intel hdc (12/06/2006 6.8.0.3002)
"E6CEFD9A59425A2A27E92572AB367B28C371D3D8" = Windows Driver Package - Intel System (09/15/2006 7.0.0.1011)
"FPIRPOn" = Registry patch of Changing Timing of IDLE IRP by Finger Print Driver for Windows Vista
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.4.0 (Full)
"LENOVO.SMIIF" = Lenovo System Interface Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"OnScreenDisplay" = Anzeige am Bildschirm
"PC-Doctor 5 for Windows" = PC-Doctor 5 für Windows
"Power Management Driver" = ThinkPad Power Management Driver
"SDKSetup_7.1.7600.0.30514" = Microsoft Windows SDK for Windows 7 (7.1)
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"USBPMon" = Registry patch for Windows Vista USB S3 PM Enablement
"WinRAR archiver" = WinRAR
"World of Warcraft" = World of Warcraft
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 17.01.2011 17:23:51 | Computer Name = ich-laptop | Source = WinMgmt | ID = 10
Description =
Error - 17.01.2011 18:27:51 | Computer Name = ich-laptop | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung sqlservr.exe, Version 2005.90.3042.0, Zeitstempel
0x45cd955b, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
Ausnahmecode 0xc0000005, Fehleroffset 0x00000000, Prozess-ID 0x9c0, Anwendungsstartzeit
01cbb68ca221b3ff.
Error - 17.01.2011 18:40:02 | Computer Name = ich-laptop | Source = WinMgmt | ID = 10
Description =
Error - 17.01.2011 19:46:00 | Computer Name = ich-laptop | Source = WinMgmt | ID = 10
Description =
Error - 17.01.2011 21:10:54 | Computer Name = ich-laptop | Source = EventSystem | ID = 4609
Description =
Error - 17.01.2011 21:11:49 | Computer Name = ich-laptop | Source = WinMgmt | ID = 10
Description =
Error - 17.01.2011 23:25:27 | Computer Name = ich-laptop | Source = WinMgmt | ID = 10
Description =
Error - 17.01.2011 23:50:14 | Computer Name = ich-laptop | Source = Sophos Message Router | ID = 8006
Description = Die Netzwerkidentität (Interoperable Object Reference oder IOR) des
lokalen Computers ist ungültig.%3
Error - 18.01.2011 09:34:44 | Computer Name = ich-laptop | Source = WinMgmt | ID = 10
Description =
Error - 18.01.2011 10:56:22 | Computer Name = ich-laptop | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 27.11.2010 10:04:22 | Computer Name = ich-laptop | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.2 für die Netzwerkkarte mit der Netzwerkadresse
001F3C8596E5 wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
Error - 27.11.2010 10:05:06 | Computer Name = ich-laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
Error - 27.11.2010 10:05:55 | Computer Name = ich-laptop | Source = Service Control Manager | ID = 7000
Description =
Error - 27.11.2010 10:07:22 | Computer Name = ich-laptop | Source = Service Control Manager | ID = 7011
Description =
Error - 27.11.2010 10:07:52 | Computer Name = ich-laptop | Source = Service Control Manager | ID = 7011
Description =
Error - 27.11.2010 17:26:19 | Computer Name = ich-laptop | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.2 für die Netzwerkkarte mit der Netzwerkadresse
001F3C8596E5 wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
Error - 27.11.2010 17:27:38 | Computer Name = ich-laptop | Source = Service Control Manager | ID = 7000
Description =
Error - 27.11.2010 17:29:29 | Computer Name = ich-laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
Error - 27.11.2010 17:29:40 | Computer Name = ich-laptop | Source = Service Control Manager | ID = 7011
Description =
Error - 27.11.2010 17:30:25 | Computer Name = ich-laptop | Source = Service Control Manager | ID = 7011
Description =
< End of report >
|
|
19.01.2011, 21:04
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "keine Rückmeldung" automatisch booten Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle davon posten. Du findest diese im Reiter Logdateien in Malwarebytes.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
19.01.2011, 22:28
| #5 |
| | "keine Rückmeldung" automatisch booten |
|
19.01.2011, 22:49
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "keine Rückmeldung" automatisch booten Hat das Gerät noch Garantie? Ein Hardwaredefekt ist nicht auszuschließen. Was du auch machen kannst: System mal ausgiebig mit anderem Betriebssystem testen. Lad dir mal sowas wie Knoppix oder Ubuntu herunter, brenn die iso Datei per Imagebrennfunktion auf eine CD und boote den Rechner davon. Teste dann mal ausgiebig die Internetverbindung, das Starten von Programmen etc. unter Linux und berichte ob dort das System stabil oder instabil ist. Ubuntu als Notfallsystem auch verlinkt unten in meiner Signatur, Anleitung von Markus im chip.de-Forum, Markus ist hier hin und wieder als "mmk" unterwegs 
__________________ --> "keine Rückmeldung" automatisch booten |
|
19.01.2011, 23:14
| #7 |
| | "keine Rückmeldung" automatisch booten Hi Ich habe die festplatte testen lassen und den Selbsttest hat die festplatte nicht bestanden, dann habe ich ein tool von Fujitsu (Ata harddisc diagnostic tool) runtergeladen und teilweise die Festplatte gescannt repariert. seit dem ist das System etwas stabil. Aber nicht ganz. Es gibt ab und zu immer noch "keine Rückmeldung". Aber diese Abstürze haben sich um ca.90% abgenommen. Ich dachte immer, dass es ein hartnäckiger Virus ist der sich im harddisc verfressen hat und nicht beseitigt werden kann. Ich glaub ich lass das erstmal so und danke für deine Hilfe. Nein Garantie hat das Gerät nicht mehr.. Typisch Lenovo gibt nur ein Jahr und keine zwei, den zweiten muss man sich kaufen |
|
19.01.2011, 23:24
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "keine Rückmeldung" automatisch booten Dieser Platte würde ich nicht mehr trauen. Alle Daten gesichert? Je nach Dringlichkeit/Wichtigkeit des Notebooks würde ich mir schnell oder weniger schnell einen (sofortigen) Ersatz für die Festplatte besorgen. Einzelne Festplatten gibt eigentlich in jedem Computer-/Elektronikladen.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
19.01.2011, 23:36
| #9 |
| | "keine Rückmeldung" automatisch booten Ja das stimmt.. Aber auf der platte ist eine Partition mit Vista vom Werk aus. Könnte Vista auf eine eine versteckte partition der neuen platte bringen? Danke |
|
20.01.2011, 09:14
| #10 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "keine Rückmeldung" automatisch bootenZitat:
Recovery-Discs gebrannt oder sind diese vorhanden?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
20.01.2011, 17:35
| #11 |
| | "keine Rückmeldung" automatisch booten Nein ehrlich gesagt hab ich keine Recovery gebrannt. Eine reco-cd ist zwar vorhanden, aber die ist über 1 jahr alt. Wenn das system infiziert ist, ist die recovery auch infiziert oder nicht? danke |
|
21.01.2011, 12:41
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "keine Rückmeldung" automatisch booten Wie alt die CD ist, ist eher unwichtig. Hauptsache du kannst damit das System recovern. Und das willst du ja, wenn du eine neue Festplatte eingebaut hast. Dann brauchst du keine Recovery-Partition.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu "keine Rückmeldung" automatisch booten |
| "keine rückmeldung", adobe, bho, booten, defender, desktop, dll, download, explorer, firefox, hijack, hijackthis, hängt, internet, internet explorer, keine rückmeldung, laptop hängt, lenovo, logfile, mozilla, object, registry, router, rundll, software, system, thinkvantage registry monitor service, vista, windows |
Linear-Darstellung
