|
Plagegeister aller Art und deren Bekämpfung: Browser langsam, Googlesuche startet nichtWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
15.03.2011, 22:25 | #1 |
| Browser langsam, Googlesuche startet nicht Hallo Zusammen, ich hab seit gestern Probleme mit meinem Rechner. Wenn ich meinen Browser öffne (Firefox), bauen sich die Seiten nur sehr langsam auf. Wenn ich auf der Googleseite eine Anfrage eingebe, startet die Suche nicht. Die Googelsuche Rechts oben im Browser funktioniert aber. Mein Antivierenprogramm (Security Essentials) konnte nichts finden. Mir ist auch aufgefallen, das mein RAM ständig zu 1,2/1,3 GB (von 4GB) belastet ist, aber da bin ich mir nicht sicher ob das normal ist. Ich währe sehr dankbar wenn mir jemand helfen könnte. Hier die Logfiles. OTL:OTL Logfile: Code:
ATTFilter OTL logfile created on: 15.03.2011 15:35:48 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Marinelli\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 67,00% Memory free 8,00 Gb Paging File | 7,00 Gb Available in Paging File | 83,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 252,89 Gb Total Space | 92,14 Gb Free Space | 36,43% Space Free | Partition Type: NTFS Drive D: | 30,25 Gb Total Space | 29,49 Gb Free Space | 97,49% Space Free | Partition Type: NTFS Computer Name: MS-LAPTOP | User Name: Marinelli | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.03.15 15:08:30 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Marinelli\Desktop\OTL.exe PRC - [2011.03.05 18:06:00 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2011.02.07 18:09:44 | 000,821,312 | ---- | M] (Jumping Bytes) -- C:\Program Files (x86)\PureSync\PureSyncTray.exe PRC - [2011.01.27 06:40:24 | 023,361,424 | ---- | M] (Dropbox, Inc.) -- C:\Users\Marinelli\AppData\Roaming\Dropbox\bin\Dropbox.exe PRC - [2011.01.17 18:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe PRC - [2011.01.17 18:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin PRC - [2010.12.06 23:02:12 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Winamp\winampa.exe PRC - [2009.10.31 02:01:00 | 000,239,720 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWOW64\nvSCPAPISvr.exe PRC - [2009.08.12 09:09:32 | 000,683,576 | ---- | M] (Conexant Systems, Inc) -- C:\Programme\CONEXANT\SAII\SmartAudio.exe PRC - [2009.07.14 15:27:26 | 000,038,152 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe PRC - [2009.06.04 20:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2009.06.04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe PRC - [2008.01.16 10:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe ========== Modules (SafeList) ========== MOD - [2011.03.15 15:08:30 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Marinelli\Desktop\OTL.exe MOD - [2010.11.20 12:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010.11.11 14:36:38 | 000,282,616 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv) SRV:64bit: - [2010.11.11 14:36:38 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc) SRV:64bit: - [2009.09.22 19:16:32 | 000,579,400 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe -- (Lenovo ReadyComm ConnSvc) SRV:64bit: - [2009.08.14 15:22:48 | 000,509,192 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files\Lenovo\ReadyComm\AppSvc.exe -- (Lenovo ReadyComm AppSvc) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.10.31 02:01:00 | 000,239,720 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Windows\SysWOW64\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2009.07.14 15:27:26 | 000,038,152 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe -- (IGRS) SRV - [2009.07.14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\windows\SysWow64\IgrsSvcs.exe -- (ReadyComm.DirectRouter) SRV - [2009.07.14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\windows\SysWow64\IgrsSvcs.exe -- (PS_MDP) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON) Intel(R) SRV - [2008.01.16 10:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc) ========== Driver Services (SafeList) ========== DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 14:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.10.24 21:25:38 | 000,072,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2009.09.14 18:40:28 | 000,259,120 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService) DRV:64bit: - [2009.08.21 05:24:04 | 000,084,512 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2009.07.21 15:20:06 | 000,121,840 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd) DRV:64bit: - [2009.07.16 12:55:34 | 000,011,280 | ---- | M] (Lenovo) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WDMirror.sys -- (wdmirror) DRV:64bit: - [2009.07.16 04:38:20 | 000,079,376 | ---- | M] (Lenovo) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WDBridge.sys -- (Bridge0) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.07 18:45:50 | 002,769,400 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX) DRV:64bit: - [2009.06.25 23:12:40 | 001,164,656 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BisonC07.sys -- (Cam5607) DRV:64bit: - [2009.06.15 03:47:26 | 000,668,672 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2009.06.10 21:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs) DRV:64bit: - [2009.06.10 21:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009.06.10 21:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) Intel(R) DRV:64bit: - [2009.06.10 21:34:36 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.05.31 02:43:44 | 000,305,192 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.05.19 14:43:32 | 000,026,128 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AcpiVpc.sys -- (ACPIVPC) DRV:64bit: - [2008.08.06 13:32:16 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "www.gmx.de" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:4.0 FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.9.5 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.03.05 18:06:03 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.05 18:06:03 | 000,000,000 | ---D | M] [2011.02.14 11:43:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marinelli\AppData\Roaming\mozilla\Extensions [2011.03.15 13:24:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marinelli\AppData\Roaming\mozilla\Firefox\Profiles\pzetuozf.default\extensions [2011.02.18 18:52:41 | 000,000,000 | ---D | M] (ImTranslator) -- C:\Users\Marinelli\AppData\Roaming\mozilla\Firefox\Profiles\pzetuozf.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE} [2011.02.14 12:35:52 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Marinelli\AppData\Roaming\mozilla\Firefox\Profiles\pzetuozf.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2011.02.16 00:12:51 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\Marinelli\AppData\Roaming\mozilla\Firefox\Profiles\pzetuozf.default\extensions\foxmarks@kei.com [2011.03.14 12:28:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.02.14 13:15:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.02.14 20:38:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.03.14 12:28:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.12.06 23:03:18 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2010.12.03 19:14:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.12.03 19:14:08 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.12.03 19:14:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.12.03 19:14:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.12.03 19:14:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited) O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited) O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\windows\SysNative\NvCpl.dll (NVIDIA Corporation) O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe () O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [VeriFaceManager] File not found O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) O4 - HKCU..\Run: [PureSync] C:\Program Files (x86)\PureSync\PureSyncTray.exe (Jumping Bytes) O4 - HKCU..\Run: [RESTART_STICKY_NOTES] File not found O4 - Startup: C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Marinelli\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O4 - Startup: C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - Reg Error: Key error. File not found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* CREATERESTOREPOINT Error creating restore point. ========== Files/Folders - Created Within 30 Days ========== [2011.03.15 15:34:28 | 000,000,000 | ---D | C] -- C:\windows\ERDNT [2011.03.15 15:34:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT [2011.03.15 15:34:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT [2011.03.15 15:08:23 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Users\Marinelli\Desktop\Erunt-setup.exe [2011.03.15 15:08:23 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Marinelli\Desktop\OTL.exe [2011.03.15 15:08:23 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Marinelli\Desktop\TFC.exe [2011.03.14 23:52:06 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Local\ElevatedDiagnostics [2011.03.14 23:09:02 | 000,000,000 | ---D | C] -- C:\windows\SysNative\SPReview [2011.03.14 23:08:55 | 000,000,000 | ---D | C] -- C:\windows\SysNative\EventProviders [2011.03.14 23:05:45 | 000,116,224 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\windows\SysNative\fms.dll [2011.03.14 23:05:16 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\windows\SysWow64\fms.dll [2011.03.14 12:28:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2011.03.10 20:43:22 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\Desktop\CD für Chantal [2011.03.06 16:39:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [2011.03.06 16:38:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google [2011.03.06 16:38:30 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Local\Google [2011.03.05 19:00:36 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\Desktop\Neuer Musikmix [2011.02.19 02:46:37 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\dvdcss [2011.02.19 00:30:41 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\vlc [2011.02.16 09:22:49 | 000,000,000 | ---D | C] -- C:\b3ea638dd53ae70306c5882f [2011.02.16 01:57:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2011.02.16 01:51:42 | 000,000,000 | ---D | C] -- C:\windows\SQL9_KB970892_ENU [2011.02.15 17:28:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe [2011.02.14 21:09:19 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Local\Microsoft Games [2011.02.14 15:27:47 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\Jumping Bytes [2011.02.14 15:25:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PureSync [2011.02.14 15:25:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PureSync [2011.02.14 15:25:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Jumping Bytes [2011.02.14 15:17:27 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\.areca [2011.02.14 14:16:42 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\Macromedia [2011.02.14 14:16:36 | 000,000,000 | ---D | C] -- C:\windows\SysWow64\Macromed [2011.02.14 14:00:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip [2011.02.14 14:00:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7Zip [2011.02.14 13:41:46 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Dropbox [2011.02.14 13:40:39 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox [2011.02.14 13:40:26 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\Dropbox [2011.02.14 13:38:35 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Local\Diagnostics [2011.02.14 13:37:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\poddox_xi [2011.02.14 13:31:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\gpodder-2.12-win32 [2011.02.14 13:31:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TagScanner [2011.02.14 13:28:42 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\OpenOffice.org [2011.02.14 13:25:49 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3 [2011.02.14 13:15:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3 [2011.02.14 13:15:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2011.02.14 13:15:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2011.02.14 13:02:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe [2011.02.14 13:00:52 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\Adobe [2011.02.14 13:00:52 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Local\Adobe [2011.02.14 12:53:16 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Winamp Erkennungs-Plug-in [2011.02.14 12:53:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp Detect [2011.02.14 12:53:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine [2011.02.14 12:53:04 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\Winamp [2011.02.14 12:53:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp [2011.02.14 12:51:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VideoLAN [2011.02.14 12:20:38 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\EasyCapture [2011.02.14 12:14:41 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\CyberLink [2011.02.14 12:14:40 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink [2011.02.14 12:04:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client [2011.02.14 12:04:49 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Security Client [2011.02.14 11:43:07 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\Mozilla [2011.02.14 11:43:07 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Local\Mozilla [2011.02.14 11:43:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2011.02.14 11:35:26 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Local\Conexant [2011.02.14 11:34:22 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.02.14 11:34:22 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Searches [2011.02.14 11:34:22 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.02.14 11:34:04 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\Identities [2011.02.14 11:34:00 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Contacts [2011.02.14 11:33:59 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Local\VirtualStore [2011.02.14 11:33:53 | 000,000,000 | --SD | C] -- C:\Users\Marinelli\AppData\Roaming\Microsoft [2011.02.14 11:33:53 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Videos [2011.02.14 11:33:53 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Saved Games [2011.02.14 11:33:53 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Pictures [2011.02.14 11:33:53 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Music [2011.02.14 11:33:53 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.02.14 11:33:53 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Links [2011.02.14 11:33:53 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Favorites [2011.02.14 11:33:53 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Downloads [2011.02.14 11:33:53 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Documents [2011.02.14 11:33:53 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\Desktop [2011.02.14 11:33:53 | 000,000,000 | R--D | C] -- C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Vorlagen [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\AppData\Local\Verlauf [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\AppData\Local\Temporary Internet Files [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Startmenü [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\SendTo [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Recent [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Netzwerkumgebung [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Lokale Einstellungen [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Documents\Eigene Videos [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Documents\Eigene Musik [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Eigene Dateien [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Documents\Eigene Bilder [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Druckumgebung [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Cookies [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\AppData\Local\Anwendungsdaten [2011.02.14 11:33:53 | 000,000,000 | -HSD | C] -- C:\Users\Marinelli\Anwendungsdaten [2011.02.14 11:33:53 | 000,000,000 | -H-D | C] -- C:\Users\Marinelli\AppData [2011.02.14 11:33:53 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Local\Temp [2011.02.14 11:33:53 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Local\Microsoft [2011.02.14 11:33:53 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\Media Center Programs [2011.02.14 11:33:53 | 000,000,000 | ---D | C] -- C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo [2011.02.14 11:33:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\Recovery [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\Programme [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2011.02.14 11:32:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten ========== Files - Modified Within 30 Days ========== [2011.03.15 15:34:01 | 000,000,924 | ---- | M] () -- C:\Users\Marinelli\Desktop\NTREGOPT.lnk [2011.03.15 15:34:01 | 000,000,905 | ---- | M] () -- C:\Users\Marinelli\Desktop\ERUNT.lnk [2011.03.15 15:18:22 | 000,018,320 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.03.15 15:18:22 | 000,018,320 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.03.15 15:15:17 | 001,571,806 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI [2011.03.15 15:15:17 | 000,678,168 | ---- | M] () -- C:\windows\SysNative\perfh007.dat [2011.03.15 15:15:17 | 000,643,772 | ---- | M] () -- C:\windows\SysNative\perfh009.dat [2011.03.15 15:15:17 | 000,138,722 | ---- | M] () -- C:\windows\SysNative\perfc007.dat [2011.03.15 15:15:17 | 000,117,856 | ---- | M] () -- C:\windows\SysNative\perfc009.dat [2011.03.15 15:10:40 | 000,001,110 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2011.03.15 15:10:14 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2011.03.15 15:10:04 | 3193,384,960 | -HS- | M] () -- C:\hiberfil.sys [2011.03.15 15:08:30 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Marinelli\Desktop\OTL.exe [2011.03.15 15:08:29 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Users\Marinelli\Desktop\Erunt-setup.exe [2011.03.15 15:08:27 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Marinelli\Desktop\TFC.exe [2011.03.15 15:07:40 | 000,015,665 | ---- | M] () -- C:\Users\Marinelli\Desktop\Notizen.odt [2011.03.15 14:43:00 | 000,001,114 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job [2011.03.15 11:21:47 | 000,007,593 | ---- | M] () -- C:\Users\Marinelli\AppData\Local\Resmon.ResmonCfg [2011.03.14 23:33:16 | 000,448,000 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT [2011.03.14 23:24:41 | 001,469,074 | ---- | M] () -- C:\windows\SysWow64\PerfStringBackup.INI [2011.03.14 22:04:22 | 000,742,874 | ---- | M] () -- C:\Users\Marinelli\Desktop\Load.exe [2011.03.13 12:40:23 | 000,005,701 | ---- | M] () -- C:\Users\Marinelli\Desktop\Anleitung.html [2011.03.11 01:30:51 | 000,054,272 | ---- | M] () -- C:\windows\SysNative\KBDBR32.DLL [2011.03.05 23:23:44 | 000,040,708 | ---- | M] () -- C:\Users\Marinelli\Desktop\Filme.odt [2011.02.26 19:06:35 | 000,016,995 | ---- | M] () -- C:\Users\Marinelli\Desktop\schabrackeneinlage anleitung.odt [2011.02.25 23:10:04 | 000,341,273 | ---- | M] () -- C:\Users\Marinelli\Desktop\Schöne Frau für Cora.odt [2011.02.25 16:22:40 | 000,022,827 | ---- | M] () -- C:\Users\Marinelli\Desktop\Schlechte Sprüche.odt [2011.02.16 19:49:45 | 000,001,934 | ---- | M] () -- C:\Users\Marinelli\Desktop\Neue Musik, sortiert - Verknüpfung.lnk [2011.02.16 14:51:32 | 000,013,831 | ---- | M] () -- C:\Users\Marinelli\Desktop\Putzplan.odt [2011.02.16 01:56:37 | 000,000,946 | ---- | M] () -- C:\windows\SysWow64\mapisvc.inf [2011.02.14 13:41:46 | 000,001,044 | ---- | M] () -- C:\Users\Marinelli\Desktop\Dropbox.lnk [2011.02.14 13:40:45 | 000,001,024 | ---- | M] () -- C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2011.02.14 13:29:23 | 000,001,235 | ---- | M] () -- C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2011.02.14 12:27:58 | 000,052,953 | ---- | M] () -- C:\windows\SysWow64\license.rtf [2011.02.14 12:27:58 | 000,052,953 | ---- | M] () -- C:\windows\SysNative\license.rtf [2011.02.14 12:06:04 | 000,002,154 | ---- | M] () -- C:\windows\epplauncher.mif [2011.02.13 15:51:58 | 002,748,746 | ---- | M] () -- C:\Users\Marinelli\Desktop\Vieseline__Kreativ-Sort-2010.pdf ========== Files Created - No Company Name ========== [2011.03.15 15:34:01 | 000,000,924 | ---- | C] () -- C:\Users\Marinelli\Desktop\NTREGOPT.lnk [2011.03.15 15:34:01 | 000,000,905 | ---- | C] () -- C:\Users\Marinelli\Desktop\ERUNT.lnk [2011.03.14 23:06:54 | 000,347,904 | ---- | C] () -- C:\windows\SysNative\systemsf.ebd [2011.03.14 23:04:46 | 000,010,429 | ---- | C] () -- C:\windows\SysNative\ScavengeSpace.xml [2011.03.14 23:04:27 | 000,105,559 | ---- | C] () -- C:\windows\SysWow64\RacRules.xml [2011.03.14 23:04:27 | 000,105,559 | ---- | C] () -- C:\windows\SysNative\RacRules.xml [2011.03.14 23:04:08 | 000,001,041 | ---- | C] () -- C:\windows\SysWow64\tcpbidi.xml [2011.03.14 22:04:14 | 000,742,874 | ---- | C] () -- C:\Users\Marinelli\Desktop\Load.exe [2011.03.14 14:24:27 | 000,007,593 | ---- | C] () -- C:\Users\Marinelli\AppData\Local\Resmon.ResmonCfg [2011.03.13 12:41:14 | 000,005,701 | ---- | C] () -- C:\Users\Marinelli\Desktop\Anleitung.html [2011.03.11 01:30:51 | 000,054,272 | ---- | C] () -- C:\windows\SysNative\KBDBR32.DLL [2011.03.06 16:38:38 | 000,001,114 | ---- | C] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job [2011.03.06 16:38:38 | 000,001,110 | ---- | C] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2011.02.26 19:06:33 | 000,016,995 | ---- | C] () -- C:\Users\Marinelli\Desktop\schabrackeneinlage anleitung.odt [2011.02.25 22:31:16 | 000,341,273 | ---- | C] () -- C:\Users\Marinelli\Desktop\Schöne Frau für Cora.odt [2011.02.25 16:22:38 | 000,022,827 | ---- | C] () -- C:\Users\Marinelli\Desktop\Schlechte Sprüche.odt [2011.02.24 21:29:46 | 000,040,708 | ---- | C] () -- C:\Users\Marinelli\Desktop\Filme.odt [2011.02.18 15:06:24 | 000,015,665 | ---- | C] () -- C:\Users\Marinelli\Desktop\Notizen.odt [2011.02.16 19:49:45 | 000,001,934 | ---- | C] () -- C:\Users\Marinelli\Desktop\Neue Musik, sortiert - Verknüpfung.lnk [2011.02.15 17:29:05 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk [2011.02.14 19:12:16 | 000,013,831 | ---- | C] () -- C:\Users\Marinelli\Desktop\Putzplan.odt [2011.02.14 15:13:28 | 002,748,746 | ---- | C] () -- C:\Users\Marinelli\Desktop\Vieseline__Kreativ-Sort-2010.pdf [2011.02.14 13:41:46 | 000,001,044 | ---- | C] () -- C:\Users\Marinelli\Desktop\Dropbox.lnk [2011.02.14 13:40:45 | 000,001,024 | ---- | C] () -- C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2011.02.14 13:29:23 | 000,001,235 | ---- | C] () -- C:\Users\Marinelli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2011.02.14 12:04:52 | 000,001,897 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk [2011.02.14 11:55:39 | 000,002,154 | ---- | C] () -- C:\windows\epplauncher.mif [2011.02.14 11:33:53 | 000,002,104 | ---- | C] () -- C:\Users\Marinelli\Desktop\OneKey Recovery.lnk [2010.03.22 18:30:17 | 002,110,728 | ---- | C] () -- C:\windows\SysWow64\Apblend.dll [2010.03.22 18:30:17 | 001,171,456 | ---- | C] () -- C:\windows\SysWow64\PicNotify.dll [2010.03.22 18:30:03 | 001,044,480 | ---- | C] () -- C:\windows\SysWow64\3DImageRenderer.dll [2010.03.22 18:29:31 | 000,057,344 | ---- | C] () -- C:\windows\AsfHelper.dll [2010.03.22 18:28:58 | 000,015,190 | ---- | C] () -- C:\windows\M3000Twn.ini [2010.03.22 18:23:20 | 000,016,648 | R--- | C] () -- C:\windows\SysWow64\LogAPI.dll [2010.03.08 13:02:18 | 001,469,074 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI [2009.10.31 02:00:00 | 000,095,848 | ---- | C] () -- C:\windows\SysWow64\nvimage.dll [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll [2009.07.13 22:59:36 | 000,982,196 | ---- | C] () -- C:\windows\SysWow64\igkrng500.bin [2009.07.13 22:59:36 | 000,139,824 | ---- | C] () -- C:\windows\SysWow64\igfcg500.bin [2009.07.13 22:59:36 | 000,097,448 | ---- | C] () -- C:\windows\SysWow64\igfcg500m.bin [2009.07.13 22:59:35 | 000,417,344 | ---- | C] () -- C:\windows\SysWow64\igcompkrng500.bin [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\windows\SysWow64\mlang.dat ========== LOP Check ========== [2011.03.15 15:11:51 | 000,000,000 | ---D | M] -- C:\Users\Marinelli\AppData\Roaming\Dropbox [2011.02.14 12:20:38 | 000,000,000 | ---D | M] -- C:\Users\Marinelli\AppData\Roaming\EasyCapture [2011.02.14 15:27:47 | 000,000,000 | ---D | M] -- C:\Users\Marinelli\AppData\Roaming\Jumping Bytes [2011.02.14 13:28:42 | 000,000,000 | ---D | M] -- C:\Users\Marinelli\AppData\Roaming\OpenOffice.org [2009.07.14 06:08:49 | 000,025,074 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.02.20 23:54:37 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2011.02.16 09:22:54 | 000,000,000 | ---D | M] -- C:\b3ea638dd53ae70306c5882f [2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2011.02.14 11:32:26 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2010.03.08 12:54:11 | 000,000,000 | RH-D | M] -- C:\MSOCache [2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.02.14 12:04:49 | 000,000,000 | R--D | M] -- C:\Programme [2011.03.15 15:34:00 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2011.02.14 13:15:50 | 000,000,000 | -H-D | M] -- C:\ProgramData [2011.02.14 11:32:26 | 000,000,000 | -HSD | M] -- C:\Programme [2011.02.14 11:32:26 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.02.09 12:24:45 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.02.14 11:33:50 | 000,000,000 | R--D | M] -- C:\Users [2011.03.15 15:34:28 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: EXPLORER.EXE > [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SysWOW64\explorer.exe [2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2010.03.08 20:34:21 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2010.03.08 20:34:21 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\explorer.exe [2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2010.03.08 20:34:21 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2010.03.08 20:34:21 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < End of report > Extras:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 15.03.2011 15:35:48 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Marinelli\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 67,00% Memory free 8,00 Gb Paging File | 7,00 Gb Available in Paging File | 83,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 252,89 Gb Total Space | 92,14 Gb Free Space | 36,43% Space Free | Partition Type: NTFS Drive D: | 30,25 Gb Total Space | 29,49 Gb Free Space | 97,49% Space Free | Partition Type: NTFS Computer Name: MS-LAPTOP | User Name: Marinelli | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html[@ = htmlfile] -- Reg Error: Key error. File not found .url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation) .html [@ = htmlfile] -- Reg Error: Key error. File not found [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* File not found cmdfile [open] -- "%1" %* File not found comfile [open] -- "%1" %* File not found exefile [open] -- "%1" %* File not found helpfile [open] -- Reg Error: Key error. htmlfile [open] -- Reg Error: Key error. htmlfile [opennew] -- Reg Error: Key error. http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome File not found https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome File not found inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* File not found regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- Reg Error: Key error. CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [open] -- Reg Error: Key error. htmlfile [opennew] -- Reg Error: Key error. http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- Reg Error: Key error. CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error. ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64) "{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition) "{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery "{49F3D04B-B849-4C89-AB31-2366A004EA28}" = Broadcom Gigabit Integrated Controller "{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 "{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware "{7782916E-3D46-4F1F-AC4B-3FB9D17049F4}" = Microsoft Antimalware Service DE-DE Language Pack "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007 "{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007 "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}" = Microsoft SQL Server Native Client "{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver "{B636C9B9-A3F2-4DCE-ADCC-72E095018385}" = Microsoft SQL Server VSS Writer "{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 "{E77543EE-6FB5-4FF6-AB70-635392C8C756}" = Microsoft Security Client "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "{FCAB9F73-BF5D-4E3D-92E7-B0F35C568F20}" = Microsoft Security Client DE-DE Language Pack "92F4CDC794E6E4E29DC063D292D1C94F6FA1EA1E" = Windows-Treiberpaket - Lenovo (ACPIVPC) System (05/19/2009 4.4.0.1) "CNXT_AUDIO_HDA" = Conexant HD Audio "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft Security Client" = Microsoft Security Essentials "NVIDIA Drivers" = NVIDIA Drivers [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00A4C568-FCA2-4E82-8E4C-A88C530C0237}" = PureSync "{17542DBF-E17C-4562-BC4D-FA3EF3076C45}" = Lenovo ReadyComm 5 "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 24 "{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) "{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go "{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger "{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3 "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4BB1DCED-84D3-47F9-B718-5947E904593E}" = Lenovo EasyCamera "{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2 "{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies "{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent "{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English) "{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites "{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync "{76C66170-C538-4E77-B54D-48E136B5B533}" = Lenovo ReadyComm 5.0 Service "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{8991E763-21F5-4DEA-A938-5D9D77DCB488}" = Broadcom 802.11 Wireless Driver "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86) "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002A-0000-1000-0000000FF1CE}_PROHYBRIDR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-002A-0407-1000-0000000FF1CE}_PROHYBRIDR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components "{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007 "{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader "{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components "{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.2 - Deutsch "{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9 "{AE1E24C2-E720-42D5-B8E1-48F71A97B4DB}" = Energy Management "{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86) "{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail "{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer "{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials "{FB4F9000-04FC-11E0-85D2-001AA037B01E}" = Google Earth Plug-in "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2 "EasyCapture4.0" = EasyCapture "ERUNT_is1" = ERUNT 1.1j "InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery "Microsoft SQL Server 2005" = Microsoft SQL Server 2005 "Mozilla Firefox (3.6.15)" = Mozilla Firefox (3.6.15) "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver "PROHYBRIDR" = 2007 Microsoft Office system "PureSync" = PureSync 2.8.3 "TagScanner_is1" = TagScanner 5.1 build 595a "VLC media player" = VLC media player 1.1.7 "Winamp" = Winamp "WinLiveSuite_Wave3" = Windows Live Essentials ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Dropbox" = Dropbox "Winamp Detect" = Winamp Erkennungs-Plug-in ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 27.02.2011 10:40:26 | Computer Name = Ms-Laptop | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 27.02.2011 10:40:49 | Computer Name = Ms-Laptop | Source = SideBySide | ID = 16842811 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\microsoft\search enhancement pack\search helper\searchhelper.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\microsoft\search enhancement pack\search helper\searchhelper.dll" in Zeile 2. Ungültige XML-Syntax. Error - 27.02.2011 10:44:53 | Computer Name = Ms-Laptop | Source = System Restore | ID = 8193 Description = Error - 28.02.2011 13:46:27 | Computer Name = Ms-Laptop | Source = System Restore | ID = 8193 Description = Error - 01.03.2011 14:16:47 | Computer Name = Ms-Laptop | Source = System Restore | ID = 8193 Description = Error - 02.03.2011 15:48:42 | Computer Name = Ms-Laptop | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 02.03.2011 15:49:04 | Computer Name = Ms-Laptop | Source = SideBySide | ID = 16842811 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\microsoft\search enhancement pack\search helper\searchhelper.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\microsoft\search enhancement pack\search helper\searchhelper.dll" in Zeile 2. Ungültige XML-Syntax. Error - 02.03.2011 15:53:58 | Computer Name = Ms-Laptop | Source = System Restore | ID = 8193 Description = Error - 02.03.2011 17:18:52 | Computer Name = Ms-Laptop | Source = System Restore | ID = 8193 Description = Error - 04.03.2011 06:51:03 | Computer Name = Ms-Laptop | Source = System Restore | ID = 8193 Description = [ System Events ] Error - 07.03.2011 13:22:02 | Computer Name = Ms-Laptop | Source = Service Control Manager | ID = 7000 Description = Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 07.03.2011 14:46:31 | Computer Name = Ms-Laptop | Source = Service Control Manager | ID = 7000 Description = Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 07.03.2011 15:21:33 | Computer Name = Ms-Laptop | Source = Service Control Manager | ID = 7000 Description = Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 08.03.2011 09:38:21 | Computer Name = Ms-Laptop | Source = Service Control Manager | ID = 7000 Description = Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 08.03.2011 16:11:02 | Computer Name = Ms-Laptop | Source = Service Control Manager | ID = 7000 Description = Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 09.03.2011 12:38:48 | Computer Name = Ms-Laptop | Source = Service Control Manager | ID = 7000 Description = Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 09.03.2011 14:39:38 | Computer Name = Ms-Laptop | Source = Service Control Manager | ID = 7000 Description = Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 09.03.2011 18:13:56 | Computer Name = Ms-Laptop | Source = Service Control Manager | ID = 7000 Description = Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 10.03.2011 00:53:30 | Computer Name = Ms-Laptop | Source = Service Control Manager | ID = 7000 Description = Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error - 10.03.2011 12:52:46 | Computer Name = Ms-Laptop | Source = Service Control Manager | ID = 7000 Description = Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 < End of report > Hier noch der Malwarebytes Report: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 6069 Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 15.03.2011 23:38:32 mbam-log-2011-03-15 (23-38-32).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 313911 Laufzeit: 40 Minute(n), 19 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
22.03.2011, 20:53 | #2 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Browser langsam, Googlesuche startet nicht Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________
__________________ |
23.03.2011, 18:16 | #3 |
| Browser langsam, Googlesuche startet nicht Es gab nur den einen Report.
__________________ |
23.03.2011, 20:28 | #4 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Browser langsam, Googlesuche startet nicht Sieht unauffällig aus. Leere mal den Browsercache vom Firefox.
__________________ Logfiles bitte immer in CODE-Tags posten |
Themen zu Browser langsam, Googlesuche startet nicht |
64-bit, adblock, autorun, bho, browser, browser langsam, c:\windows\system32\rundll32.exe, chdrt64.sys, error, excel, explorer, fehler, firefox, flash player, format, frage, home, iastor.sys, iexplore.exe, install.exe, langsam, lenovo, location, media center, microsoft office 2003, microsoft office word, microsoft security, mozilla, nicht sicher, office 2007, oldtimer, plug-in, programdata, programm, realtek, registry, richtlinie, rundll, saver, scan, searchplugins, security, security update, sehr langsam, seiten, shell32.dll, software, start menu, syswow64, usb 2.0, webcheck, windows, winlogon.exe |