Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   cpu schnell ausgelastet ohne nenneswerte anforderung (https://www.trojaner-board.de/100831-cpu-schnell-ausgelastet-ohne-nenneswerte-anforderung.html)

fmstereo 27.06.2011 20:07
cpu schnell ausgelastet ohne nenneswerte anforderung
 
Hallo,
ich weiß nicht ob es ein hardware- oder plagegeisterproblem ist, aber die cpu ist relativ schnell ausgelastet
obwohl keine nennenswerte anforderung an sie gestellt wird. Das hat leider auch zur folge,
daß der lüfter ständig hochdreht und das notebook total heiß ist auf der unterseite.
Auf dem rechner ist vista installiert.
Vielleicht hängt es mit dem oben geschilderten zusammen, ein anderes problem tritt auf,
wenn man versucht quicktime movies zu verschieben hängt sich der rechner auf und macht garnichts mehr.
hoffe uns kann jemand weiterhelfen oder hat einen tip woher das problem kommen könnte, logfiles von otl und gmer folgen unten:
danke und gruß frank

otl:OTL Logfile:
Code:
OTL logfile created on: 27.06.2011 10:51:48 - Run 2
OTL by OldTimer - Version 3.2.24.1    Folder = C:\Users\Li\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,87 Gb Total Physical Memory | 1,41 Gb Available Physical Memory | 49,16% Memory free
5,94 Gb Paging File | 4,52 Gb Available in Paging File | 76,09% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 117,54 Gb Total Space | 68,14 Gb Free Space | 57,97% Space Free | Partition Type: NTFS
Drive E: | 113,88 Gb Total Space | 76,47 Gb Free Space | 67,15% Space Free | Partition Type: NTFS
 
Computer Name: LI-PC | User Name: Li | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.06.27 10:48:50 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Li\Desktop\OTL.exe
PRC - [2011.06.27 10:35:40 | 002,424,192 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2010.12.03 14:13:44 | 007,516,632 | ---- | M] (hxxp://www.verycd.com) -- C:\Programme\easyMule\emule.exe
PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009.09.05 17:29:06 | 000,385,024 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe
PRC - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.07.18 20:39:30 | 000,083,312 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
PRC - [2008.04.26 15:57:06 | 000,716,800 | ---- | M] (TOSHIBA Corporation.) -- C:\Programme\Toshiba\HDMICtrlMan\HDMICtrlMan.exe
PRC - [2008.04.24 18:35:46 | 000,073,728 | ---- | M] (Toshiba) -- C:\Programme\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
PRC - [2008.04.24 13:03:12 | 000,430,080 | ---- | M] (TOSHIBA) -- C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe
PRC - [2008.04.24 10:22:10 | 000,103,824 | ---- | M] (Toshiba Europe GmbH) -- C:\Programme\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
PRC - [2008.04.24 10:21:56 | 000,099,720 | ---- | M] (Toshiba Europe GmbH) -- C:\Programme\Toshiba TEMPRO\TempoSVC.exe
PRC - [2008.04.17 10:39:02 | 000,667,648 | ---- | M] (TOSHIBA Corporation.) -- C:\Programme\Toshiba\HDMICtrlMan\HCMSoundChanger.exe
PRC - [2008.04.17 00:21:24 | 001,056,768 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\Toshiba\ConfigFree\NDSTray.exe
PRC - [2008.04.17 00:19:48 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\Toshiba\ConfigFree\CFSvcs.exe
PRC - [2008.04.17 00:19:16 | 000,405,504 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\Toshiba\ConfigFree\CFSwMgr.exe
PRC - [2008.04.11 11:57:14 | 000,124,264 | ---- | M] (TOSHIBA CORPORATION) -- c:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2008.03.19 13:35:42 | 000,716,800 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\Toshiba\FlashCards\TCrdMain.exe
PRC - [2008.01.25 13:33:50 | 000,509,816 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\Toshiba\SmoothView\SmoothView.exe
PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2008.01.21 04:24:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2008.01.21 04:23:29 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2008.01.17 16:27:52 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\Toshiba\Power Saver\TPwrMain.exe
PRC - [2008.01.17 16:27:34 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\Toshiba\Power Saver\TosCoSrv.exe
PRC - [2007.12.03 17:03:52 | 000,126,976 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\Toshiba\SMARTLogService\TosIPCSrv.exe
PRC - [2007.11.21 17:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe
PRC - [2007.09.28 16:03:46 | 000,075,136 | ---- | M] ( TOSHIBA CORPORATION) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe
PRC - [2007.08.27 17:35:41 | 000,232,848 | ---- | M] (China Merchants Bank) -- C:\Programme\CMBCHINA\WebProtect\WPService.exe
PRC - [2007.02.12 10:43:44 | 000,065,536 | ---- | M] (O2Micro International) -- C:\Programme\O2Micro Flash Memory Card Driver\o2flash.exe
PRC - [2006.08.23 16:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2004.09.17 13:40:02 | 000,443,904 | ---- | M] (SlySoft, Inc.) -- C:\Programme\SlySoft\AnyDVD\AnyDVD.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.06.27 10:48:50 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Li\Desktop\OTL.exe
MOD - [2010.08.31 17:39:57 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.07.18 20:39:30 | 000,083,312 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv)
SRV - [2008.04.24 18:35:46 | 000,073,728 | ---- | M] (Toshiba) [On_Demand | Running] -- C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe -- (SmartFaceVWatchSrv)
SRV - [2008.04.24 10:21:56 | 000,099,720 | ---- | M] (Toshiba Europe GmbH) [Auto | Running] -- C:\Program Files\Toshiba TEMPRO\TempoSVC.exe -- (TempoMonitoringService)
SRV - [2008.04.17 00:19:48 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)
SRV - [2008.04.11 11:57:14 | 000,124,264 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- c:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.17 16:27:34 | 000,431,456 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV - [2007.12.03 17:03:52 | 000,126,976 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe -- (TOSHIBA SMART Log Service)
SRV - [2007.11.21 17:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)
SRV - [2007.02.12 10:43:44 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe -- (o2flash)
SRV - [2006.08.23 16:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2005.11.17 14:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2010.12.18 13:03:56 | 000,021,696 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\Windows\system32\speedfan.sys -- (speedfan)
DRV - [2010.05.10 20:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010.02.17 20:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010.01.16 03:00:37 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.05.11 10:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.03.30 10:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.07.18 18:52:16 | 000,279,376 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\tos_sps32.sys -- (tos_sps32)
DRV - [2008.06.20 06:37:06 | 000,112,128 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2008.04.15 04:13:14 | 000,051,160 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR)
DRV - [2008.03.18 12:02:18 | 000,292,864 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8187B.sys -- (RTL8187B)
DRV - [2008.03.04 19:32:00 | 000,188,416 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2007.12.17 11:45:20 | 000,018,432 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR)
DRV - [2007.11.09 14:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)
DRV - [2007.10.17 01:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007.05.02 11:12:36 | 000,109,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssm_mdm.sys -- (ssm_mdm)
DRV - [2007.05.02 11:12:36 | 000,015,112 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssm_mdfl.sys -- (ssm_mdfl)
DRV - [2007.04.23 10:50:50 | 000,025,896 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | System | Running] -- C:\Windows\System32\drivers\RtlProt.sys -- (RtlProt)
DRV - [2007.04.09 17:13:00 | 000,008,192 | ---- | M] (TOSHIBA) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\QIOMem.sys -- (QIOMem)
DRV - [2006.10.23 16:32:20 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfec.sys -- (tosrfec)
DRV - [2006.10.18 11:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV - [2005.08.30 02:47:38 | 000,058,320 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssm_bus.sys -- (ssm_bus) SAMSUNG Mobile USB Device II 1.0 driver (WDM)
DRV - [2004.09.16 17:25:11 | 000,018,048 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2004.06.09 00:13:49 | 000,003,968 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ElbyDelay.sys -- (ElbyDelay)
DRV - [1996.04.03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\system32\giveio.sys -- (giveio)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.sitesdriver.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.suggest.enabled: false
 
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.08 20:42:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.08 20:42:20 | 000,000,000 | ---D | M]
 
[2009.05.31 22:44:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Li\AppData\Roaming\mozilla\Extensions
[2011.06.08 20:15:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Li\AppData\Roaming\mozilla\Firefox\Profiles\oeogg612.default\extensions
[2010.11.19 21:12:40 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Li\AppData\Roaming\mozilla\Firefox\Profiles\oeogg612.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.06.08 20:42:22 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
File not found (No name found) --
[2009.07.23 23:18:33 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009.08.08 23:29:41 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll
[2010.04.01 17:24:36 | 000,278,856 | ---- | M] (Alipay.com co.,ltd) -- C:\Programme\Mozilla Firefox\plugins\npaliedit.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (IE2EMBHO Class) - {0A0DDBD3-6641-40B9-873F-BBDD26D6C14E} - C:\Programme\easyMule\modules\IE2EM.dll (VeryCD.com)
O2 - BHO: (WebProtect) - {53763D1D-9CA8-4C7C-9756-A8E6B8FC063B} - C:\Programme\CMBCHINA\WebProtect\WebProtect.dll (China Merchants Bank)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -  File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O4 - HKLM..\Run: [00TCrdMain] C:\Programme\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVD.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
O4 - HKLM..\Run: [cfFncEnabler.exe]  File not found
O4 - HKLM..\Run: [CMB webProtect] C:\Program Files\CMBCHINA\WebProtect\WPService.exe (China Merchants Bank)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( )
O4 - HKLM..\Run: [HDMICtrlMan] C:\Programme\Toshiba\HDMICtrlMan\HDMICtrlMan.exe (TOSHIBA Corporation.)
O4 - HKLM..\Run: [HSON] C:\Programme\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NDSTray.exe]  File not found
O4 - HKLM..\Run: [SmoothView] C:\Programme\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA)
O4 - HKLM..\Run: [Toshiba Registration] C:\Programme\Toshiba\Registration\ToshibaRegistration.exe (Toshiba)
O4 - HKLM..\Run: [Toshiba TEMPO] C:\Programme\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe (Toshiba Europe GmbH)
O4 - HKLM..\Run: [TPwrMain] C:\Programme\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [eMuleAutoStart] C:\Program Files\easyMule\eMule.exe (hxxp://www.verycd.com)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [TOSCDSPD]  File not found
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O8 - Extra context menu item: Download by easyMule - C:\Programme\easyMule\IE2EM.htm ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} -  File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} -  File not found
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} -  File not found
O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} -  File not found
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} https://site.cmbchina.com/download/CMBEdit.cab (Edit Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DD5BF6D1-6663-47E0-9DFA-5C343CAF178E} hxxp://xmp.down.sandai.net/kankan/xinstaller.cab (xoliimpl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} -  File not found
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: E:\Pictures\2010.12.21_12.31 Lissabon\L1190908.JPG
O24 - Desktop BackupWallPaper: E:\Pictures\2010.12.21_12.31 Lissabon\L1190908.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{85b7b84e-5594-11de-87e7-00238b39bbe9}\Shell - "" = AutoRun
O33 - MountPoints2\{85b7b84e-5594-11de-87e7-00238b39bbe9}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{c4679629-a222-11de-abf2-00238b39bbe9}\Shell - "" = AutoRun
O33 - MountPoints2\{c4679629-a222-11de-abf2-00238b39bbe9}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.27 10:39:09 | 000,000,000 | ---D | C] -- C:\Users\Li\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2011.06.27 10:39:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2011.06.27 10:39:08 | 000,000,000 | ---D | C] -- C:\Programme\SpeedFan
[2011.06.27 10:36:36 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2011.06.21 20:23:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Thunder Network
[2011.06.21 20:23:23 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Thunder Network
[2011.06.18 13:08:11 | 000,000,000 | ---D | C] -- C:\Users\Li\Desktop\godard
[2011.06.08 20:56:36 | 000,000,000 | ---D | C] -- C:\Windows\System32\Adobe
[2011.06.07 13:56:22 | 000,000,000 | ---D | C] -- C:\Users\Li\Desktop\trojanerboard
[2011.06.07 13:56:03 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\Li\Desktop\OTL.exe
[2011.06.06 14:24:01 | 000,000,000 | ---D | C] -- C:\Users\Li\Desktop\2011.05.28_06.05
[3 C:\Users\Li\Desktop\*.tmp files -> C:\Users\Li\Desktop\*.tmp -> ]
[24 C:\Users\Li\Documents\*.tmp files -> C:\Users\Li\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.27 10:48:50 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Li\Desktop\OTL.exe
[2011.06.27 10:39:09 | 000,000,809 | ---- | M] () -- C:\Users\Li\Desktop\SpeedFan.lnk
[2011.06.27 10:39:08 | 000,000,045 | ---- | M] () -- C:\Windows\System32\initdebug.nfo
[2011.06.27 10:25:09 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.06.27 10:25:03 | 000,000,412 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{F86FEADB-D8A7-4B50-831C-AFC2FDA775E1}.job
[2011.06.27 10:24:49 | 000,607,730 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.06.27 10:24:49 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.06.27 10:24:49 | 000,122,410 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.06.27 10:24:49 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.06.27 10:22:29 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.06.27 10:18:29 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.06.27 10:18:29 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.06.27 10:18:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.06.27 10:18:16 | 3077,468,160 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.22 02:12:00 | 000,004,096 | -H-- | M] () -- C:\Users\Li\AppData\Local\keyfile3.drm
[2011.06.21 20:23:28 | 000,001,226 | ---- | M] () -- C:\Users\Public\Desktop\迅雷看看-免费高清电影.lnk
[2011.06.21 10:58:27 | 000,042,789 | ---- | M] () -- C:\Users\Li\Desktop\01.jpg
[2011.06.19 21:51:58 | 000,225,280 | ---- | M] () -- C:\Users\Li\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.06.18 23:13:44 | 000,000,680 | ---- | M] () -- C:\Users\Li\AppData\Local\d3d9caps.dat
[2011.06.15 07:26:29 | 000,001,976 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011.06.09 15:27:39 | 000,503,770 | ---- | M] () -- C:\Users\Li\Desktop\SP_A0249.jpg
[2011.06.09 14:10:34 | 003,822,408 | ---- | M] () -- C:\Users\Li\Desktop\L1200342.JPG
[2011.06.09 13:44:46 | 000,209,896 | ---- | M] () -- C:\Users\Li\Desktop\L1210579.JPG
[2011.06.09 13:44:35 | 000,317,030 | ---- | M] () -- C:\Users\Li\Desktop\L1210580.JPG
[2011.06.09 13:34:26 | 000,417,422 | ---- | M] () -- C:\Users\Li\Desktop\P1080699.JPG
[2011.06.08 20:42:23 | 000,000,851 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.06.07 14:08:13 | 000,000,000 | ---- | M] () -- C:\Users\Li\defogger_reenable
[2011.06.05 23:33:26 | 001,964,914 | ---- | M] () -- C:\Users\Li\IMG_1380.JPG
[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[3 C:\Users\Li\Desktop\*.tmp files -> C:\Users\Li\Desktop\*.tmp -> ]
[24 C:\Users\Li\Documents\*.tmp files -> C:\Users\Li\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.06.27 10:39:09 | 000,000,809 | ---- | C] () -- C:\Users\Li\Desktop\SpeedFan.lnk
[2011.06.27 10:38:43 | 000,000,045 | ---- | C] () -- C:\Windows\System32\initdebug.nfo
[2011.06.22 02:12:00 | 000,004,096 | -H-- | C] () -- C:\Users\Li\AppData\Local\keyfile3.drm
[2011.06.21 20:23:28 | 000,001,226 | ---- | C] () -- C:\Users\Public\Desktop\迅雷看看-免费高清电影.lnk
[2011.06.21 10:58:25 | 000,042,789 | ---- | C] () -- C:\Users\Li\Desktop\01.jpg
[2011.06.18 23:13:44 | 000,000,680 | ---- | C] () -- C:\Users\Li\AppData\Local\d3d9caps.dat
[2011.06.09 15:27:39 | 000,503,770 | ---- | C] () -- C:\Users\Li\Desktop\SP_A0249.jpg
[2011.06.09 14:10:34 | 003,822,408 | ---- | C] () -- C:\Users\Li\Desktop\L1200342.JPG
[2011.06.09 13:44:02 | 000,317,030 | ---- | C] () -- C:\Users\Li\Desktop\L1210580.JPG
[2011.06.09 13:43:53 | 000,209,896 | ---- | C] () -- C:\Users\Li\Desktop\L1210579.JPG
[2011.06.09 13:33:29 | 000,417,422 | ---- | C] () -- C:\Users\Li\Desktop\P1080699.JPG
[2011.06.08 20:42:23 | 000,000,863 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.06.07 15:56:19 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011.06.07 14:08:13 | 000,000,000 | ---- | C] () -- C:\Users\Li\defogger_reenable
[2011.06.05 23:31:56 | 001,964,914 | ---- | C] () -- C:\Users\Li\IMG_1380.JPG
[2010.10.04 00:36:22 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2010.10.04 00:36:22 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2010.02.05 16:08:23 | 000,000,016 | -H-- | C] () -- C:\ProgramData\mxfilerelatedcache.mxc2
[2009.06.04 00:43:05 | 000,000,016 | -H-- | C] () -- C:\Users\Li\AppData\Roaming\mxfilerelatedcache.mxc2
[2009.06.04 00:43:05 | 000,000,016 | -H-- | C] () -- C:\Users\Li\AppData\Local\mxfilerelatedcache.mxc2
[2009.06.02 18:11:16 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009.05.31 22:39:15 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.05.29 16:52:26 | 000,204,800 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009.05.29 16:47:06 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009.05.27 16:00:39 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.05.27 15:58:34 | 000,225,280 | ---- | C] () -- C:\Users\Li\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.05.25 23:49:37 | 000,131,072 | ---- | C] () -- C:\Windows\System32\EnumDevLib.dll
[2008.08.06 10:37:48 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2008.08.06 10:31:04 | 000,006,642 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2008.08.06 10:22:30 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2008.08.06 10:22:30 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2008.08.06 10:22:30 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2008.08.06 10:22:30 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2008.08.06 10:22:30 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2008.08.06 10:22:30 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2008.08.06 10:03:28 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
[2008.08.06 10:03:28 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
[2008.08.06 10:03:28 | 000,009,480 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
[2008.08.06 10:03:28 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
[2008.08.06 10:01:16 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.08.06 09:58:48 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll
[2008.08.06 09:58:46 | 002,192,024 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2008.08.06 09:58:46 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1502.dll
[2008.08.06 09:58:46 | 000,147,172 | ---- | C] () -- C:\Windows\System32\igfcg550.bin
[2008.08.06 09:58:45 | 000,492,496 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2008.04.24 18:43:50 | 000,057,344 | ---- | C] () -- C:\Windows\System32\SmartFaceVCapt.dll
[2008.04.24 18:42:44 | 000,479,232 | ---- | C] () -- C:\Windows\System32\SmartFaceVCP.dll
[2008.04.24 18:25:46 | 006,701,056 | ---- | C] () -- C:\Windows\System32\FaceHI.dll
[2008.04.24 18:25:46 | 000,995,328 | ---- | C] () -- C:\Windows\System32\FaceRec.dll
[2008.04.24 18:25:46 | 000,126,976 | ---- | C] () -- C:\Windows\System32\SmartFaceVCtrl.dll
[2008.04.24 18:23:58 | 000,094,208 | ---- | C] () -- C:\Windows\System32\IppLib.dll
[2008.01.21 09:15:58 | 000,607,730 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 09:15:58 | 000,122,410 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2008.01.21 04:24:14 | 000,100,043 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2007.12.21 16:46:32 | 000,118,784 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll
[2007.09.14 16:54:36 | 000,397,312 | ---- | C] () -- C:\Windows\System32\CMBEdit.dll
[2007.09.04 12:56:10 | 000,164,352 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2007.02.05 20:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,334,616 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,587,178 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,101,250 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2005.07.22 21:30:18 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
 
========== LOP Check ==========
 
[2010.08.03 16:55:53 | 000,000,000 | ---D | M] -- C:\Users\Li\AppData\Roaming\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1
[2010.06.17 11:46:52 | 000,000,000 | ---D | M] -- C:\Users\Li\AppData\Roaming\Facebook
[2009.09.02 10:49:19 | 000,000,000 | ---D | M] -- C:\Users\Li\AppData\Roaming\PhonerLite
[2010.08.03 16:19:26 | 000,000,000 | ---D | M] -- C:\Users\Li\AppData\Roaming\ProtectDisc
[2009.06.25 23:23:48 | 000,000,000 | ---D | M] -- C:\Users\Li\AppData\Roaming\TOSHIBA
[2009.09.02 10:49:07 | 000,000,000 | ---D | M] -- C:\Users\Li\AppData\Roaming\VistaCodecs
[2011.06.27 01:07:12 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.06.27 10:25:03 | 000,000,412 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{F86FEADB-D8A7-4B50-831C-AFC2FDA775E1}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2009.05.25 00:52:34 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2008.08.06 19:21:08 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2009.05.25 00:46:01 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2009.06.04 00:51:17 | 000,000,000 | ---D | M] -- C:\Intel
[2011.04.02 20:39:26 | 000,000,000 | ---D | M] -- C:\Neuer Ordner
[2008.01.21 04:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.06.27 10:39:08 | 000,000,000 | R--D | M] -- C:\Programme
[2011.06.21 20:23:24 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2009.05.25 00:46:01 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.06.27 10:53:21 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2009.06.04 00:51:17 | 000,000,000 | ---D | M] -- C:\Toshiba
[2009.05.25 00:49:23 | 000,000,000 | R--D | M] -- C:\Users
[2011.06.21 20:22:40 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 04:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2008.01.21 04:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.21 04:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-27 08:52:24
 
<          >
 
========== Files - Unicode (All) ==========
[2011.04.12 11:44:04 | 000,000,315 | ---- | M] ()(C:\Users\Li\?ffentlich - Verknüpfung.lnk) -- C:\Users\Li\Öffentlich - Verknüpfung.lnk
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel? Matrix Storage Manager) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel® Matrix Storage Manager

< End of report >
--- --- ---

gmer:

GMER Logfile:
Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-06-27 19:40:35
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.BBFO
Running: 7v8x8x1y.exe; Driver: C:\Users\Li\AppData\Local\Temp\pgddapoc.sys


---- System - GMER 1.0.15 ----

SSDT            AB269804                                                                                                              ZwCreateThread
SSDT            AB2697F0                                                                                                              ZwOpenProcess
SSDT            AB2697F5                                                                                                              ZwOpenThread
SSDT            \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS                                                                    ZwTerminateProcess [0x9184C620]

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!KeSetEvent + 221                                                                                        824EC9A4 4 Bytes  [04, 98, 26, AB] {ADD AL, 0x98; STOS DWORD ES:[EDI]}
.text          ntkrnlpa.exe!KeSetEvent + 3F1                                                                                        824ECB74 4 Bytes  [F0, 97, 26, AB]
.text          ntkrnlpa.exe!KeSetEvent + 40D                                                                                        824ECB90 4 Bytes  [F5, 97, 26, AB] {CMC ; XCHG EDI, EAX; STOS DWORD ES:[EDI]}
.text          ntkrnlpa.exe!KeSetEvent + 621                                                                                        824ECDA4 4 Bytes  [20, C6, 84, 91]
.text          C:\Windows\system32\DRIVERS\tos_sps32.sys                                                                            section is writeable [0x83754480, 0x3C939, 0xE8000020]
.dsrt          C:\Windows\system32\DRIVERS\tos_sps32.sys                                                                            unknown last section [0x83795900, 0x3CA, 0x48000040]

---- User code sections - GMER 1.0.15 ----

.text          C:\Program Files\easyMule\emule.exe[4044] kernel32.dll!SetUnhandledExceptionFilter                                    7610A84F 5 Bytes  JMP 00558460 C:\Program Files\easyMule\emule.exe (easyMule/hxxp://www.verycd.com)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B                       
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B@CacheSizeInMB          0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B@CacheStatus            2
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B@USBVersion              131072
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B@ReadSpeedKBs            0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B@WriteSpeedKBs          0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B@PhysicalDeviceSizeMB    114470
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B@RecommendedCacheSizeMB  0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B@HasSlowRegions          0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B@DoRetestDevice          0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B@DeviceStatus            1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_&Ven_Unbekannt&Prod_Unbekannt&B@LastTestedTime          0x00 0x00 0x00 0x00 ...

---- Files - GMER 1.0.15 ----

File            C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log                                                    131072 bytes
File            C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS000C7.log                                                131072 bytes
File            C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS000C8.log                                                131072 bytes
File            C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS000C6.log                                                131072 bytes
File            C:\Users\Li\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUT9TJI4\feed[1].xml                70 bytes

---- EOF - GMER 1.0.15 ----
--- --- ---

cosinus 28.06.2011 15:38
Zitat:
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Hm, hatte ich dir nicht letztens bei diesem Rechner geholfen oder ist das jetzt ein anderer bzw. andere Windows-Installation?
Du hängst den aktuellen Stand weit hinterher, spiel mal das SP2 und den IE9 für Vista ein:

SP2/IE9 für Windows Vista (32-Bit)
  1. Das SP2 von hier downloaden => Detail Seite Windows Vista SP2 (348.3MB)
  2. Alle Programme beenden, Internetverbindung trennen, Virenscanner abstellen!
  3. SP2 installieren, Anweisungen folgen - Installation kann eine gute Stunde dauern!!
  4. IE9-Setup laden und ausführen => Windows Internet Explorer 9 für Windows Vista und Windows Server 2008
(Der IE9 erfordert ein installiertes SP2)

Achte beim Setup des IE wieder darauf, dass vorher möglichst alle Programme beendet und der Virenscanner deaktiviert wurde. Im Setup selbst bitte nicht an dem Verbesserungsprogramm teilnehmen (oder wie MS das nennt) und auch KEINE Updates über das Setup installieren. Die installieren wir später, ich sag dir dann wie. Melde dich wenn SP2/IE9 drauf sind.

fmstereo 28.06.2011 16:07
Hallo Arne, nochmal vielen Dank für den anderen Rechner, der läuft jetzt wieder prima! Diesmal handelt es sich um den Rechner meiner Freundin, der hat, wie beschrieben auch irgendein Problem.
ich melde mich wenn ich die Sachen abgearbeitet habe.
Danke und Gruß
Frank

fmstereo 29.06.2011 23:17
Hallo Arne, sp2 und IE9 sind installiert, IE9 ging aber irgendwie nicht ohne internetupdate,
gruß Frank

cosinus 30.06.2011 10:18
Ok. Hast du auf weitere Update geprüft?
Wenn Der Updatedienst nach Updates sucht, ist das System häufig rel. stark ausgelastet. Prüf mal die jetzige Auslastung, vllt hat es sich nun gebessert.

fmstereo 03.07.2011 12:35
Hallo, updates sind alle installiert und es ist besser geworden, die cpu ist nicht mehr ausgelastet (aber der laptop wird immernoch ziemlich heiß, vermutlich ehr hardwareproblem)
danke und gruß Frank :party:


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:06 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29