| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: [Trojaner] tr/inject.3.5; tr/agent.hlcz und weitereWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
21.02.2011, 17:58
| #1 | ||||
 | ![[Trojaner] tr/inject.3.5; tr/agent.hlcz und weitere - Standard](images/icons/icon1.gif){kind=icon} [Trojaner] tr/inject.3.5; tr/agent.hlcz und weitere Hallo zusammen, seit einiger Zeit schlägt mein AntiVir immer mal wieder Alarm: Zitat:
Es tauchen aber immer wieder andere und manchmal auch die gleichen Meldungen wieder auf. Ich habe mich mal durch die Anleitung zu mbam usw durchgearbeitet: Mbam Log: Zitat:
defugger-log: Zitat:
gmer-log: Zitat:
OTL.txt: OTL Logfile: Code:
ATTFilter OTL logfile created on: 21.02.2011 16:36:56 - Run 1 OTL by OldTimer - Version 3.2.20.6 Folder = C:\Dokumente und Einstellungen\***\Desktop\MFTools Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 80,00% Memory free 5,00 Gb Paging File | 4,00 Gb Available in Paging File | 93,00% Paging File free Paging file location(s): [Binary data over 100 bytes] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 97,66 Gb Total Space | 47,42 Gb Free Space | 48,55% Space Free | Partition Type: NTFS Drive D: | 51,39 Gb Total Space | 21,62 Gb Free Space | 42,07% Space Free | Partition Type: NTFS Computer Name: JANLAP | User Name: Jan | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.02.21 15:07:39 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Jan\Desktop\MFTools\OTL.exe PRC - [2010.12.11 15:46:13 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2010.12.09 10:33:39 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2010.11.16 20:12:13 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2010.11.16 20:12:12 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.01.14 20:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.06.29 12:54:14 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe PRC - [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.09.11 12:26:12 | 000,576,104 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe PRC - [2007.04.03 15:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe PRC - [2007.01.17 07:34:18 | 000,634,880 | ---- | M] (Motorola Inc.) -- C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe PRC - [2006.12.29 04:48:10 | 000,569,344 | ---- | M] (Sonix) -- C:\WINDOWS\vsnp2uvc.exe ========== Modules (SafeList) ========== MOD - [2011.02.21 15:07:39 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Jan\Desktop\MFTools\OTL.exe MOD - [2010.08.23 17:11:46 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll MOD - [2009.07.12 01:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll MOD - [2009.07.11 19:41:02 | 000,097,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll MOD - [2008.04.13 18:37:57 | 000,208,384 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\rsaenh.dll MOD - [2007.09.11 12:24:00 | 000,073,728 | ---- | M] (Broadcom Corporation.) -- C:\WINDOWS\system32\BtMmHook.dll ========== Win32 Services (SafeList) ========== SRV - [2010.12.09 10:33:39 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.11.16 20:12:13 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.02.16 14:51:02 | 000,824,640 | ---- | M] (BinarySense, Inc.) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\BinarySense\hldasvc.exe -- (HDDlife HDD Access service) SRV - [2009.12.16 18:26:00 | 003,453,712 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\System32\GameMon.des -- (npggsvc) SRV - [2009.07.20 11:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2008.11.04 01:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2007.04.03 15:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND) SRV - [2007.03.12 14:49:46 | 000,271,920 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2004.10.22 03:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT) ========== Driver Services (SafeList) ========== DRV - [2010.12.23 17:59:51 | 000,135,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2010.12.03 09:34:12 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010.03.17 01:01:53 | 010,259,488 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2010.03.15 13:35:18 | 000,222,248 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) DRV - [2010.02.11 13:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6) DRV - [2009.12.18 09:58:52 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\SystemRequirementsLab\cpudrv.sys -- (cpudrv) DRV - [2009.10.26 14:47:30 | 004,221,952 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw5x32.sys -- (NETw5x32) Intel(R) DRV - [2009.06.17 17:56:32 | 000,028,560 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LUsbFilt.sys -- (LUsbFilt) DRV - [2009.06.17 17:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt) DRV - [2009.06.17 17:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2009.06.17 17:55:34 | 000,010,384 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE) DRV - [2009.05.11 10:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2009.05.11 08:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.07.06 15:01:41 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2008.03.17 17:22:58 | 000,879,496 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL) DRV - [2008.03.17 17:22:58 | 000,539,432 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio) DRV - [2008.03.17 17:22:58 | 000,156,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS) DRV - [2008.03.17 17:22:58 | 000,055,352 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwhid.sys -- (btwhid) DRV - [2008.03.17 17:22:58 | 000,037,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver) DRV - [2008.03.17 17:22:57 | 000,074,656 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB) DRV - [2008.03.17 17:22:57 | 000,037,280 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem) DRV - [2007.06.22 11:14:40 | 004,432,384 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2007.05.28 02:03:00 | 002,207,232 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel(R) DRV - [2007.04.03 15:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA) DRV - [2007.03.28 12:15:36 | 000,046,992 | ---- | M] (UPEK Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tcusb.sys -- (TcUsb) DRV - [2007.03.14 10:16:40 | 000,009,856 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\EMSC.SYS -- (EMSC) DRV - [2007.02.24 07:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2007.01.31 12:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE) DRV - [2007.01.23 09:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2007.01.18 13:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA) DRV - [2007.01.17 07:38:52 | 000,983,936 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial) DRV - [2007.01.16 20:04:46 | 009,599,872 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2005.12.01 10:49:22 | 000,023,600 | ---- | M] (Licensed for Gebhard Software) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\drhard.sys -- (drhard) DRV - [2005.01.26 07:22:20 | 000,280,344 | ---- | M] (Zone Labs LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant) DRV - [2005.01.07 17:07:18 | 000,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2004.11.29 15:53:18 | 000,258,560 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZD1211U.sys -- (WLAN(WLAN)) 802.11b+g USB Wireless LAN Adapter Driver(WLAN) DRV - [2004.10.15 12:50:20 | 000,015,295 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BrScnUsb.sys -- (BrScnUsb) DRV - [2004.01.14 10:30:00 | 000,017,151 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\ZDPNDIS5.sys -- (ZDPNDIS5) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://grooveshark.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=302398" FF - prefs.js..browser.search.selectedEngine: "Amazon.de" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}:8.6.7.0 FF - prefs.js..extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:3.0.0.2 FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2 FF - prefs.js..extensions.enabledItems: 4 FF - prefs.js..extensions.enabledItems: 9 FF - prefs.js..extensions.enabledItems: 1 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {FFA36170-80B1-4535-B0E3-A4569E497DD0}:3.0.2 FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.14.2 FF - prefs.js..extensions.enabledItems: {e1c8879e-9db4-4adf-92d2-d4856bd434ef}:1.1.9.2 FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?src=2&q=" FF - prefs.js..network.proxy.http: "206.64.92.16" FF - prefs.js..network.proxy.http_port: 8000 FF - prefs.js..network.proxy.type: 0 FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "chrome://google-gzfb-partner/locale/partner.properties" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.01.04 23:26:17 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.02.10 11:19:33 | 000,000,000 | ---D | M] [2008.12.24 14:24:26 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Extensions [2011.02.21 15:30:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Firefox\Profiles\i6l9ykeg.default\extensions [2011.02.05 13:41:07 | 000,000,000 | ---D | M] (PDF Download) -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Firefox\Profiles\i6l9ykeg.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250} [2010.10.14 21:22:10 | 000,000,000 | ---D | M] (Flashblock) -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Firefox\Profiles\i6l9ykeg.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2010.12.23 20:26:56 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Firefox\Profiles\i6l9ykeg.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.05.02 21:48:59 | 000,000,000 | ---D | M] (text/plain) -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Firefox\Profiles\i6l9ykeg.default\extensions\{e1c8879e-9db4-4adf-92d2-d4856bd434ef} [2010.03.26 20:31:42 | 000,000,000 | ---D | M] (Mouse Gestures Redox) -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Firefox\Profiles\i6l9ykeg.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0} [2009.12.13 02:45:06 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Firefox\Profiles\i6l9ykeg.default\extensions\firefox@tvunetworks.com [2010.10.23 14:49:11 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Firefox\Profiles\i6l9ykeg.default\extensions\vshare@toolbar [2011.02.21 15:30:11 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2009.05.06 16:38:13 | 000,000,000 | ---D | M] (Download Accelerator Plus Integration) -- C:\PROGRAMME\DAP\DAPFIREFOX [2010.01.31 13:20:59 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009.09.01 17:37:50 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2009.07.17 09:40:12 | 000,704,512 | ---- | M] (BitComet) -- C:\Programme\Mozilla Firefox\plugins\npBitCometAgent.dll [2010.09.17 15:26:44 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.09.17 15:26:44 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.09.17 15:26:44 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.09.17 15:26:44 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.09.17 15:26:44 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.06.17 16:21:38 | 000,374,702 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www*007guard*com O1 - Hosts: 127.0.0.1 007guard*com O1 - Hosts: 127.0.0.1 008i*com O1 - Hosts: 127.0.0.1 www*008k*com O1 - Hosts: 127.0.0.1 008k*com O1 - Hosts: 127.0.0.1 www*00hq*com O1 - Hosts: 127.0.0.1 00hq*com O1 - Hosts: 127.0.0.1 010402*com O1 - Hosts: 127.0.0.1 www*032439*com O1 - Hosts: 127.0.0.1 032439*com O1 - Hosts: 127.0.0.1 www*100888290cs*com O1 - Hosts: 127.0.0.1 100888290cs*com O1 - Hosts: 127.0.0.1 www*100sexlinks*com O1 - Hosts: 127.0.0.1 100sexlinks*com O1 - Hosts: 127.0.0.1 www*10sek*com O1 - Hosts: 127.0.0.1 10sek*com O1 - Hosts: 127.0.0.1 www*123topsearch*com O1 - Hosts: 127.0.0.1 123topsearch*com O1 - Hosts: 127.0.0.1 www*132*com O1 - Hosts: 127.0.0.1 132*com O1 - Hosts: 127.0.0.1 www*136136*net O1 - Hosts: 127.0.0.1 136136*net O1 - Hosts: 127.0.0.1 www*163ns*com O1 - Hosts: 127.0.0.1 163ns*com O1 - Hosts: 12912 more lines... O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found. O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\isuspm.exe (Macrovision Corporation) O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (Macrovision Corporation) O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] File not found O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) O4 - HKLM..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe (Sonix) O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) O4 - Startup: C:\Dokumente und Einstellungen\Jan\Startmenü\Programme\Autostart\ERUNT AutoBackup.lnk = C:\Dokumente und Einstellungen\Jan\Desktop\Malwarebytes' Anti-Malware\ERUNT\AUTOBACK.EXE () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &Clean Traces - C:\Programme\DAP\Privacy Package\dapcleanerie.htm () O8 - Extra context menu item: &Download with &DAP - C:\Programme\DAP\dapextie.htm () O8 - Extra context menu item: Download &all with DAP - C:\Programme\DAP\dapextie2.htm () O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205490770062 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1210104995906 (MUWebControl Class) O16 - DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v911/Navigram.cab (Navigram Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\hddlife {BD758015-47D9-477A-8873-4B688A2BC0E2} - C:\Programme\Gemeinsame Dateien\BinarySense\hlAPP.dll (BinarySense, Inc.) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\cryptnet32: DllName - cryptnet32.dll - File not found O20 - Winlogon\Notify\LBTWlgn: DllName - c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll - c:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O24 - Desktop Components:0 () - file:///C:/DOKUME~1/Jan/LOKALE~1/Temp/msohtmlclip1/01/clip_image002.jpg O24 - Desktop Components:1 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Jan\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Jan\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.03.14 10:43:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{7c2317ec-343e-11e0-ac63-001cbf68d610}\Shell\AutoRun\command - "" = F:\Installer.exe O33 - MountPoints2\{7c2317ed-343e-11e0-ac63-001cbf68d610}\Shell\AutoRun\command - "" = F:\Menu.exe O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - Services: "npggsvc" MsConfig - Services: "WMPNetworkSvc" MsConfig - Services: "WLSetupSvc" MsConfig - Services: "idsvc" MsConfig - Services: "ose" MsConfig - Services: "odserv" MsConfig - Services: "ImapiService" MsConfig - Services: "HDDlife HDD Access service" MsConfig - Services: "JavaQuickStarterService" MsConfig - Services: "NBService" MsConfig - Services: "Microsoft Office Groove Audit Service" MsConfig - Services: "NMIndexingService" MsConfig - Services: "btwdins" MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Logitech SetPoint.lnk - C:\Programme\Logitech\SetPoint\SetPoint.exe - (Logitech, Inc.) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^VPN Client.lnk - C:\WINDOWS\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico - () MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Jan^Startmenü^Programme^Autostart^HDDlife.lnk - - File not found MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Jan^Startmenü^Programme^Autostart^Logitech . Produktregistrierung.lnk - C:\Programme\Gemeinsame Dateien\Logishrd\eReg\SetPoint\eReg.exe - (Leader Technologies/Logitech) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Jan^Startmenü^Programme^Autostart^OpenOffice.org 2.3.lnk - C:\Programme\OpenOffice.org 2.3\program\quickstart.exe - () MsConfig - StartUpReg: Alcmtr - hkey= - key= - C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) MsConfig - StartUpReg: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - hkey= - key= - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG) MsConfig - StartUpReg: BrMfcWnd - hkey= - key= - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe () MsConfig - StartUpReg: ControlCenter3 - hkey= - key= - C:\Programme\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) MsConfig - StartUpReg: ctfmon.exe - hkey= - key= - File not found MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Programme\DAEMON Tools Lite\daemon.exe (DT Soft Ltd) MsConfig - StartUpReg: GrooveMonitor - hkey= - key= - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) MsConfig - StartUpReg: ICQ - hkey= - key= - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG) MsConfig - StartUpReg: PlayNC Launcher - hkey= - key= - File not found MsConfig - StartUpReg: RTHDCPL - hkey= - key= - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) MsConfig - StartUpReg: SetDefPrt - hkey= - key= - C:\Programme\software für drucker\Software\BrStDvPt.exe (Brother Industories, Ltd.) MsConfig - StartUpReg: SpybotSD TeaTimer - hkey= - key= - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.) MsConfig - StartUpReg: WZShutdown - hkey= - key= - File not found MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 2 MsConfig - State: "startup" - 2 CREATERESTOREPOINT Restore point Set: OTL Restore Point (16902109354000384) ========== Files/Folders - Created Within 30 Days ========== [2011.02.21 15:32:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2011.02.21 15:21:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ERUNT [2011.02.21 15:09:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Malwarebytes [2011.02.21 15:09:18 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2011.02.21 15:09:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2011.02.21 15:09:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2011.02.21 15:09:13 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2011.02.21 15:09:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jan\Desktop\Malwarebytes' Anti-Malware [2011.02.21 15:03:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jan\Desktop\MFTools [2011.02.15 13:19:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jan\Startmenü\Programme\HiJackThis [2010.02.19 23:46:08 | 000,250,544 | ---- | C] (KeyWorks Software) -- C:\Programme\Gemeinsame Dateien\keyhelp.ocx [2008.03.14 18:29:42 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll ========== Files - Modified Within 30 Days ========== [2011.02.21 15:51:31 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.02.21 15:51:20 | 000,276,202 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml [2011.02.21 15:51:15 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.02.21 15:51:11 | 3219,574,784 | -HS- | M] () -- C:\hiberfil.sys [2011.02.21 15:37:37 | 000,000,020 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\defogger_reenable [2011.02.21 15:21:51 | 000,000,815 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Startmenü\Programme\Autostart\ERUNT AutoBackup.lnk [2011.02.21 15:08:02 | 000,296,448 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Desktop\g2m3e4r.exe [2011.02.21 15:08:00 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Desktop\defogger.exe [2011.02.21 11:23:08 | 000,000,156 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Eigene Dateien\aionmemo_5c5fae80.dat [2011.02.21 09:34:42 | 000,297,504 | ---- | M] () -- C:\WINDOWS\System32\shimg.dll [2011.02.19 14:11:46 | 000,002,564 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Desktop\HiJackThis.lnk [2011.02.10 11:29:13 | 000,000,211 | RHS- | M] () -- C:\boot.ini [2011.02.10 11:19:34 | 000,001,709 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 8.lnk [2011.02.09 14:13:41 | 000,002,409 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Desktop\VPN Client.lnk [2011.02.09 11:04:27 | 000,277,352 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.02.09 08:48:56 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2011.01.31 13:02:14 | 002,048,273 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Desktop\227000DE.PDF [2011.01.26 11:45:15 | 000,028,160 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== Files Created - No Company Name ========== [2011.02.21 15:37:22 | 000,000,020 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\defogger_reenable [2011.02.21 15:21:51 | 000,000,815 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Startmenü\Programme\Autostart\ERUNT AutoBackup.lnk [2011.02.21 15:03:49 | 000,296,448 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Desktop\g2m3e4r.exe [2011.02.21 15:03:48 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Desktop\defogger.exe [2011.02.15 13:19:21 | 000,002,564 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Desktop\HiJackThis.lnk [2011.02.10 11:19:33 | 000,001,709 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 8.lnk [2011.02.01 12:59:58 | 000,297,504 | ---- | C] () -- C:\WINDOWS\System32\shimg.dll [2011.01.31 13:01:55 | 002,048,273 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Desktop\227000DE.PDF [2010.08.11 20:42:02 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2010.02.11 19:02:01 | 000,052,836 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll [2010.02.11 18:57:25 | 000,394,752 | ---- | C] () -- C:\WINDOWS\System32\cygwinb19.dll [2010.02.11 18:57:25 | 000,162,304 | ---- | C] () -- C:\WINDOWS\System32\libpng13.dll [2010.02.01 18:25:30 | 000,000,258 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini [2010.01.11 19:34:03 | 000,000,105 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\kpref [2010.01.09 18:00:35 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini [2009.10.15 12:25:21 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD.dll [2009.04.27 14:02:51 | 000,000,061 | ---- | C] () -- C:\WINDOWS\wininit.ini [2009.03.02 17:45:31 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.INI [2009.01.15 12:56:54 | 000,000,425 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI [2009.01.15 12:56:54 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI [2009.01.15 12:56:13 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll [2008.03.18 17:23:12 | 000,028,160 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.03.18 17:22:28 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008.03.18 15:58:22 | 000,000,098 | ---- | C] () -- C:\WINDOWS\h3maped.INI [2008.03.18 12:35:34 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI [2008.03.17 21:13:27 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll [2008.03.17 21:11:55 | 000,000,872 | ---- | C] () -- C:\WINDOWS\disney.ini [2008.03.17 20:42:41 | 000,000,048 | ---- | C] () -- C:\WINDOWS\scmate.ini [2008.03.17 13:54:39 | 000,000,414 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\AVSDVDPlayer.m3u [2008.03.14 18:29:42 | 009,599,872 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys [2008.03.14 18:29:42 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini [2008.03.14 18:29:20 | 000,000,438 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2008.03.14 16:19:43 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2008.03.14 11:20:27 | 000,266,240 | ---- | C] () -- C:\WINDOWS\System32\EMSC.DLL [2008.03.14 11:20:27 | 000,009,856 | ---- | C] () -- C:\WINDOWS\System32\drivers\EMSC.sys [2008.03.14 10:51:39 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2008.03.14 10:51:37 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008.03.14 10:51:37 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2008.03.14 10:51:37 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2008.03.14 10:51:36 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008.03.14 10:35:28 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2007.09.11 12:24:28 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll [2007.09.11 12:12:28 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll [2007.04.03 15:18:26 | 000,197,672 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll [2007.04.03 15:18:06 | 000,193,576 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll [2006.09.13 12:06:10 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\gtapi.dll [2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll ========== LOP Check ========== [2008.03.17 15:38:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth [2009.11.18 21:40:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\InterAction studios [2010.09.15 11:46:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan [2009.05.06 16:38:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SpeedBit [2010.09.15 11:30:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP [2008.03.14 11:20:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vista32 [2008.03.14 11:20:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vista64 [2008.03.14 11:20:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\XP32 [2009.09.26 15:28:23 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\.# [2010.02.20 13:39:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\BinarySense [2010.06.10 12:50:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\CasaPortale.de [2009.04.12 16:22:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\CCTV [2008.07.06 15:01:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\DAEMON Tools [2010.05.05 11:35:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\DynaGeo [2009.10.01 22:18:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\GetRightToGo [2010.01.28 11:48:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\HD Tune Pro [2011.02.14 20:38:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\ICQ [2010.04.09 23:47:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Leadertech [2009.07.23 19:23:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Octoshape [2010.06.17 16:21:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Opera [2010.04.27 22:20:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Smart PC Solutions [2010.05.08 14:56:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\TS3Client [2011.01.07 12:41:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\ts3overlay [2010.09.15 11:01:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Uniblue [2010.01.09 16:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\WinBatch [2008.04.09 16:36:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\XnView ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2009.08.08 14:48:30 | 000,000,000 | ---D | M] -- C:\003934f4b1c5dfd464 [2010.12.17 22:16:45 | 000,000,000 | ---D | M] -- C:\9275a14834d8f7a95ba6bc [2009.01.15 12:56:16 | 000,000,000 | ---D | M] -- C:\Brother [2008.09.16 19:48:30 | 000,000,000 | -HSD | M] -- C:\CacheDir [2008.12.15 14:10:42 | 000,000,000 | ---D | M] -- C:\CrashReport [2010.01.31 13:14:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellung [2008.03.17 10:57:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen [2011.02.21 15:07:24 | 000,000,000 | ---D | M] -- C:\Downloads [2009.06.02 23:47:04 | 000,000,000 | ---D | M] -- C:\DVDVideoSoft [2010.05.28 01:08:28 | 000,000,000 | ---D | M] -- C:\DXTEMP [2008.12.18 14:46:52 | 000,000,000 | RH-D | M] -- C:\MSOCache [2010.05.19 13:25:45 | 000,000,000 | ---D | M] -- C:\NVIDIA [2010.01.10 12:45:03 | 000,000,000 | ---D | M] -- C:\Program Files [2010.12.22 12:21:19 | 000,000,000 | R--D | M] -- C:\Programme [2008.03.17 13:42:19 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2011.02.21 13:32:36 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.02.21 15:51:15 | 000,000,000 | ---D | M] -- C:\WINDOWS [2009.10.15 12:24:22 | 000,000,000 | ---D | M] -- C:\xterasys < %PROGRAMFILES%\*.exe > Invalid Environment Variable: LOCALAPPDATA < %systemroot%\*. /mp /s > < MD5 for: EXPLORER.EXE > [2007.10.29 13:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe [2007.06.13 14:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe [2007.06.13 14:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe < MD5 for: USERINIT.EXE > [2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe [2007.10.29 13:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe < MD5 for: WINLOGON.EXE > [2007.10.29 13:00:00 | 000,512,000 | ---- | M] (Microsoft Corporation) MD5=00F0521FB60946D16AFA483C2FE68F34 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-02-09 07:49:02 ========== Alternate Data Streams ========== @Alternate Data Stream - 489 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:05EE1EEF @Alternate Data Stream - 126 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A9662AE0 @Alternate Data Stream - 110 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:2BE9FEFC @Alternate Data Stream - 101 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:7E95B6FD @Alternate Data Stream - 100 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:8173A019 < End of report > Und Extras.txt: OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 21.02.2011 16:36:56 - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Dokumente und Einstellungen\Jan\Desktop\MFTools
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 80,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 93,00% Paging File free
Paging file location(s): [Binary data over 100 bytes]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 97,66 Gb Total Space | 47,42 Gb Free Space | 48,55% Space Free | Partition Type: NTFS
Drive D: | 51,39 Gb Total Space | 21,62 Gb Free Space | 42,07% Space Free | Partition Type: NTFS
Computer Name: JANLAP | User Name: Jan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"24377:TCP" = 24377:TCP:*:Enabled:BitComet 24377 TCP
"24377:UDP" = 24377:UDP:*:Enabled:BitComet 24377 UDP
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\msnmsgr.exe" = C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
"C:\Programme\Windows Live\Messenger\livecall.exe" = C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)
"C:\Programme\ICQ7.2\ICQ.exe" = C:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"C:\Programme\ICQ7.2\aolload.exe" = C:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe" = C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6
"C:\Programme\Veoh Networks\Veoh\VeohClient.exe" = C:\Programme\Veoh Networks\Veoh\VeohClient.exe:*:Enabled:Veoh Client
"C:\Downloads\viviplay.exe" = C:\Downloads\viviplay.exe:*:Enabled:ViViMediaPlay -- ()
"D:\Spiele\Rappelz\HackShield\HSUpdate.exe" = D:\Spiele\Rappelz\HackShield\HSUpdate.exe:*:Enabled:HSUpdate -- (AhnLab, Inc.)
"D:\Spiele\Heroes5\bin\H5_Game.exe" = D:\Spiele\Heroes5\bin\H5_Game.exe:*:Enabled:Heroes of Might and Magic V -- ()
"C:\Programme\Windows Live\Messenger\msnmsgr.exe" = C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
"C:\Programme\Windows Live\Messenger\livecall.exe" = C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6
"C:\Programme\DAP\DAP.exe" = C:\Programme\DAP\DAP.exe:*:Enabled:Download Accelerator Plus (DAP) -- (SpeedBit Ltd.)
"C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" = C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe:*:Enabled:Main program for Octoshape client
"C:\Programme\BitComet\BitComet.exe" = C:\Programme\BitComet\BitComet.exe:*:Enabled:BitComet.exe
"C:\Programme\NCSoft\AionEU\bin32\AION.bin" = C:\Programme\NCSoft\AionEU\bin32\AION.bin:*:Enabled:AION.bin -- (NCSoft)
"C:\Programme\NCSoft\AionEU\bin32\GameGuard.des" = C:\Programme\NCSoft\AionEU\bin32\GameGuard.des:*:Enabled:GameGuard.des
"C:\Programme\NCSoft\AionEU\bin32\GameGuard\GameMon.des" = C:\Programme\NCSoft\AionEU\bin32\GameGuard\GameMon.des:*:Enabled:GameMon.des -- (INCA Internet Co., Ltd.)
"C:\Programme\NCSoft\Launcher\NCLauncher.exe" = C:\Programme\NCSoft\Launcher\NCLauncher.exe:*:Enabled:NCsoft Launcher -- (NCSoft)
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player
"C:\Programme\Ventrilo\Ventrilo.exe" = C:\Programme\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe -- (Flagship Industries, Inc.)
"C:\Programme\ICQ7.2\ICQ.exe" = C:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"C:\Programme\ICQ7.2\aolload.exe" = C:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
"C:\Programme\Ascaron Entertainment\Sacred\Sacred.exe" = C:\Programme\Ascaron Entertainment\Sacred\Sacred.exe:*:Enabled:Sacred -- (Ascaron Entertainment GmbH)
"C:\Programme\Ascaron Entertainment\Sacred\GameServer.exe" = C:\Programme\Ascaron Entertainment\Sacred\GameServer.exe:*:Enabled:Sacred Gameserver -- (Ascaron Entertainment GmbH)
"C:\Programme\sopcast\adv\SopAdver.exe" = C:\Programme\sopcast\adv\SopAdver.exe:*:Disabled:SopCast Adver -- (www.sopcast.com)
"C:\Programme\sopcast\SopCast.exe" = C:\Programme\sopcast\SopCast.exe:*:Disabled:SopCast Main Application -- (www.sopcast.com)
"C:\Programme\sopcast\sopvod.exe" = C:\Programme\sopcast\sopvod.exe:*:Disabled:sopvod -- ()
"C:\Programme\TVAnts\Tvants.exe" = C:\Programme\TVAnts\Tvants.exe:*:Disabled:TVAnts
"C:\Programme\TVUPlayer\TVUPlayer.exe" = C:\Programme\TVUPlayer\TVUPlayer.exe:*:Disabled:TVUPlayer Component -- (TVU networks)
"C:\Programme\uusee\UUSeePlayer.exe" = C:\Programme\uusee\UUSeePlayer.exe:*:Disabled:UUSEE
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01A8838A-9469-425F-A5FB-FC14D4CF93B9}" = Rappelz
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.2 Build #3129 Banner Remover 1.0
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{1D108D70-E7D1-4089-9A0A-99629C4D0CB8}" = Morrowind
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1" = Allgemeine Runtime Files (x86)
"{20071984-5EB1-4881-8EDB-082532ACEC6D}" = Heroes of Might and Magic V
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{2EAF7E61-068E-11DF-953C-005056806466}" = Google Earth
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E6D2462-AB33-40BB-AA9F-3FA3E0DD0290}" = FlatOut 2
"{58D68DF0-4E8B-4E9E-B425-670F9E37C1A8}" = TES Construction Set
"{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}" = NCsoft Launcher
"{6773963F-6FF0-4A21-97C8-8DFF0EBCECAE}" = OpenOffice.org 2.3
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{70af630e-2e1b-470f-b600-9ae48f0b94d0}.sdb" = Disney Interactive Compatibility Update December 2002
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{779C40FF-9211-427B-A5C4-2026B85A1031}" = Nero 7 Essentials
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A912C12-A7DA-44D7-BD57-5CA85E2F33E1}" = Brother MFL-Pro Suite
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.6 - Deutsch
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}" = Cisco Systems VPN Client 5.0.00.0340
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D9E52CD1-9DF1-4A8A-9BDC-1E5E53982F2B}" = Black & White® 2
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1" = Uniblue SpeedUpMyPC
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F7FC9307-374E-4017-8E9D-DE1154780480}" = System Requirements Lab for Intel
"{FEF06E73-A519-4510-8CF3-B66041B91D8A}" = EMSC
"7-Zip" = 7-Zip 4.57
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVS DVD Player_is1" = AVS DVD Player version 2.4
"Clean My Registry_is1" = Clean My Registry v4.3
"DLH98" = DLH98 v1.44
"Donald Duck" = Disneys Donald Duck
"Download Accelerator Plus (DAP)" = Download Accelerator Plus (DAP)
"Dr. Hardware 2010_is1" = Dr. Hardware 2010 10.1d
"DynaGeo_is1" = DynaGeo 3.5c
"Edraw Mind Map_is1" = Edraw Mind Map V4
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"Fraps" = Fraps
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free Video to Mp3 Converter_is1" = Free Video to Mp3 Converter version 3.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"HD Tune_is1" = HD Tune 2.55
"HijackThis" = HijackThis 2.0.2
"hotpot_is1" = HotPotatoes v 6.2.5.2
"Icy Tower v1.4_is1" = Icy Tower v1.4
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 3.7.0
"Launch of the Screaming Narwhal" = Tales of Monkey Island - Launch of the Screaming Narwhal
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PosteRazor_is1" = PosteRazor
"RealPlayer 6.0" = RealPlayer
"Rise of the Pirate God" = Tales of Monkey Island - Rise of the Pirate God
"Sacred_is1" = Sacred
"SeriousSam2" = Serious Sam 2
"SMSERIAL" = Motorola SM56 Data Fax Modem
"SopCast" = SopCast 3.0.1
"SystemRequirementsLab" = System Requirements Lab
"Tales of Monkey Island Chapter 21.0" = Tales of Monkey Island Chapter 2
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"The Trial and Execution of Guybrush Threepwood" = Tales of Monkey Island - The Trial and Execution of Guybrush Threepwood
"TVUPlayer" = TVUPlayer 2.4.7.2
"Uninstall_is1" = Uninstall 1.0.0.1
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XnView_is1" = XnView 1.92
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 02.11.2010 12:56:06 | Computer Name = JANLAP | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung fifa2002.exe, Version 0.0.0.0, fehlgeschlagenes
Modul d3dim700.dll, Version 5.3.2600.2180, Fehleradresse 0x00016201.
Error - 03.11.2010 12:21:29 | Computer Name = JANLAP | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung fifa2002.exe, Version 0.0.0.0, fehlgeschlagenes
Modul d3dim700.dll, Version 5.3.2600.2180, Fehleradresse 0x00016201.
Error - 05.11.2010 11:04:17 | Computer Name = JANLAP | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung fifa2002.exe, Version 0.0.0.0, fehlgeschlagenes
Modul d3dim700.dll, Version 5.3.2600.2180, Fehleradresse 0x00016201.
Error - 08.11.2010 20:26:52 | Computer Name = JANLAP | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung fifa2002.exe, Version 0.0.0.0, fehlgeschlagenes
Modul d3dim700.dll, Version 5.3.2600.2180, Fehleradresse 0x00016201.
Error - 19.12.2010 15:40:19 | Computer Name = JANLAP | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung aion.bin, Version 2110.1006.1203.3501, fehlgeschlagenes
Modul fmodex.dll, Version 0.4.26.5, Fehleradresse 0x00022628.
Error - 03.01.2011 14:26:10 | Computer Name = JANLAP | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
zurückgegeben. .
Error - 12.01.2011 09:33:26 | Computer Name = JANLAP | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
zurückgegeben. .
Error - 12.01.2011 12:25:46 | Computer Name = JANLAP | Source = ESENT | ID = 490
Description = svchost (1948) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
Error - 29.01.2011 06:48:53 | Computer Name = JANLAP | Source = ESENT | ID = 490
Description = svchost (1956) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
Error - 08.02.2011 14:50:31 | Computer Name = JANLAP | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung aion.bin, Version 2110.1201.1216.3558, fehlgeschlagenes
Modul game.dll, Version 2110.1201.1216.3558, Fehleradresse 0x004052a8.
[ System Events ]
Error - 21.01.2011 13:42:02 | Computer Name = JANLAP | Source = MRxSmb | ID = 8003
Description = Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "JAQI",
der
der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{173AF3ED-138C-4EA9-A3B3-Transport
zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error - 21.01.2011 17:09:10 | Computer Name = JANLAP | Source = MRxSmb | ID = 8003
Description = Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "JAQI",
der
der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{173AF3ED-138C-4EA9-A3B3-Transport
zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error - 23.01.2011 13:58:24 | Computer Name = JANLAP | Source = MRxSmb | ID = 8003
Description = Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "JAQI",
der
der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{173AF3ED-138C-4EA9-A3B3-Transport
zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error - 01.02.2011 12:04:00 | Computer Name = JANLAP | Source = MRxSmb | ID = 8003
Description = Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "JAQI",
der
der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{173AF3ED-138C-4EA9-A3B3-Transport
zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error - 02.02.2011 07:21:20 | Computer Name = JANLAP | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.2.100 für die Netzwerkkarte mit der Netzwerkadresse
001CBF68D610 wurde durch den DHCP-Server 10.9.8.7 abgelehnt (der DHCP-Server hat
eine DHCPNACK-Meldung gesendet).
Error - 09.02.2011 07:15:21 | Computer Name = JANLAP | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.2.100 für die Netzwerkkarte mit der Netzwerkadresse
001CBF68D610 wurde durch den DHCP-Server 10.9.8.7 abgelehnt (der DHCP-Server hat
eine DHCPNACK-Meldung gesendet).
Error - 09.02.2011 16:32:50 | Computer Name = JANLAP | Source = MRxSmb | ID = 8003
Description = Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "JAQI",
der
der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{173AF3ED-138C-4EA9-A3B3-Transport
zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error - 21.02.2011 10:12:13 | Computer Name = JANLAP | Source = Service Control Manager | ID = 7034
Description = Dienst "NVIDIA Display Driver Service" wurde unerwartet beendet. Dies
ist bereits 1 Mal passiert.
Error - 21.02.2011 10:12:14 | Computer Name = JANLAP | Source = Service Control Manager | ID = 7034
Description = Dienst "Cisco Systems, Inc. VPN Service" wurde unerwartet beendet.
Dies ist bereits 1 Mal passiert.
Error - 21.02.2011 10:32:59 | Computer Name = JANLAP | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume1" ist im
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
wurde angehalten.
< End of report >
So, also dabei brauche ich wirklich Hilfe, da blicke ich ganz und gar nicht mehr durch, ich weiß nichmal, ob noch irgendwas Probleme bereitet oder nicht  Schonmal viele Dank  an den/die Helfer, die sich damit auseinandersetzen, ist ja echt jedes mal ein Berg an Infos. Ich hoffe, ich konnte alles vernünftig "zensieren" und habe auch sonst die gewünschte Form eingehalten. In der Hoffnung, dass ich nichts Schlimmes mit meinem Laptop anstellen muss, lass ich noch liebe Grüße da  Jan |
| Themen zu [Trojaner] tr/inject.3.5; tr/agent.hlcz und weitere |
| 0x00000001, 0xc0000001, 7-zip, adblock, alternate, antivir, avgntflt.sys, avira, bho, black, converter, cryptnet32.dll, desktop, dllhost.exe, error, excel, extras.txt, flash player, google, hijack, location, logfile, microsoft office word, monkey island, mp3, nt.dll, object, office 2007, oldtimer, plug-in, programm, realtek, required, safer networking, saver, searchplugins, security, security update, senden, server, shell32.dll, software, svchost.exe, system restore, teamspeak, tower, traces, trojaner, versteckte objekte, verweise, virus gefunden, vista, windows, windows internet |
![[Trojaner] tr/inject.3.5; tr/agent.hlcz und weitere](iconimages/plagegeister-aller-art-deren-bekaempfung/trojaner-tr-inject-3-5-tr-agent-hlcz_ltr.gif)
Baum-Darstellung