Trojaner-Board - Firefox leitet um will "Update" herunterladen

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Firefox leitet um will "Update" herunterladen (https://www.trojaner-board.de/96697-firefox-leitet-um-will-update-herunterladen.html)

Firefox leitet um will "Update" herunterladen

Hi Leute,

Habe zwar in Google und auf euerem Board Hinweise gefunden jedoch nichts was mir weiterhelfen konnte.

Firefox leitet mich machmal -wenn ich auf irgendwelche Links klicke- auf eine andere Seite um "zamanuxa.co.cc".
Dort wird mir "firefox-like" gesagt, dass es sich hiebei um keine vertrauenswürdige Seite handelt (roter Hintergrund) und ich mein Firefox updaten soll.
Die Datei wird dann von dieser Seite bereitgestellt und soll dort runtergeladen werden.

Avira findet nichts.

* Lade Tralala von File-Upload.net - Tralala.exe
* Klick auf Download (rechts in der Mitte) und speichere es auf den Desktop
* Doppelklick auf Tralala.exe
* Der Reiter Rootkit oben ist schon angewählt
* Drücke Scan, Der Vorgang kann je nach System 3 - 10min dauern
* nach Beendigung des Scan, drücke "Copy"
* nun kannst Du das Ergebnis hier einfügen.
Hier die Log File:
GMER Logfile:

Code:

GMER 1.0.14.14536 - hxxp://www.gmer.net

Rootkit scan 2011-03-22 11:16:21

Windows 6.1.7600 

 

 

---- System - GMER 1.0.14 ----

 

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302EAF8

INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302E104

INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302E3F4

INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83016634

INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83016898

INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302E1DC

INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302E958

INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302E6F8

INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302EF2C

INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302F1A8

 

---- Kernel code sections - GMER 1.0.14 ----

 

.text ntkrnlpa.exe!ZwSaveKeyEx + 13BD 82C47589 1 Byte [ 06 ]

.text ntkrnlpa.exe!KiDispatchInterrupt + 5A4 82C6C094 17 Bytes [ BA, F0, 07, 73, 09, 0F, 22, ... ]

.text peauth.sys 9A56BC9D 28 Bytes [ 5E, ED, F7, E7, 8E, 09, FC, ... ]

.text peauth.sys 9A56BCC1 28 Bytes [ 5E, ED, F7, E7, 8E, 09, FC, ... ]

 

---- User code sections - GMER 1.0.14 ----

 

.text C:\Program Files\Mozilla Firefox\plugin-container.exe[1936] USER32.dll!TrackPopupMenu 76654B3B 5 Bytes JMP 64876373 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

.text C:\Program Files\Mozilla Firefox\firefox.exe[2608] ntdll.dll!LdrLoadDll 7726F5B5 5 Bytes JMP 012013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

 

---- User IAT/EAT - GMER 1.0.14 ----

 

IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\Explorer.EXE [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\ole32.dll [msvcrt.dll!free] [670211EB] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\explorer.exe[2176] @ C:\Windows\explorer.exe [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\ole32.dll [msvcrt.dll!free] [670211EB] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)

IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\wininet.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\System32\rundll32.exe[2472] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\System32\rundll32.exe[2472] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\System32\rundll32.exe[2472] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\System32\rundll32.exe[2472] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\System32\rundll32.exe[2996] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\System32\rundll32.exe[2996] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\System32\rundll32.exe[2996] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Windows\System32\rundll32.exe[2996] @ C:\Windows\system32\advapi32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

 

---- Devices - GMER 1.0.14 ----

 

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

 

Device \Driver\BTHUSB \Device\00000073 bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

 

AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

 

Device \Driver\BTHUSB \Device\00000075 bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\0000004a halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

 

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

 

---- Registry - GMER 1.0.14 ----

 

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001dd9e6ab46 

Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001dd9e6ab46 

 

---- EOF - GMER 1.0.14 ----

--- --- ---

Danke für die Hilfe...

Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6130

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

22.03.2011 13:43:33
mbam-log-2011-03-22 (13-43-33).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 389650
Laufzeit: 1 Stunde(n), 54 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
c:\Users\Ursula\AppData\Local\Temp\wvtrop.dll (Trojan.Agent) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xxyawtaudio (Trojan.Agent) -> Value: xxyawtaudio -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\efcaxxsys (Trojan.Vundo) -> Value: efcaxxsys -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\efcaxxsys (Trojan.Vundo) -> Value: efcaxxsys -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Ursula\downloads\removewat v2.2.5.2\removewat.exe (HackTool.Wpakill) -> Quarantined and deleted successfully.
c:\Users\Ursula\AppData\Local\Temp\wvtrop.dll (Trojan.Agent) -> Delete on reboot.

Danke, lg

OTL Logfile:

Code:

OTL logfile created on: 22.03.2011 13:49:26 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Ursula\Desktop

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free

4,00 Gb Paging File | 3,00 Gb Available in Paging File | 77,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 99,18 Gb Total Space | 22,05 Gb Free Space | 22,24% Space Free | Partition Type: NTFS

Drive D: | 111,79 Gb Total Space | 100,70 Gb Free Space | 90,08% Space Free | Partition Type: NTFS

Drive E: | 10,00 Gb Total Space | 5,96 Gb Free Space | 59,58% Space Free | Partition Type: NTFS

 

Computer Name: URSULA-PC | User Name: Ursula | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Ursula\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Programme\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe (Sony Corporation)

PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)

PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)

PRC - C:\Windows\System32\audiodg.exe (Microsoft Corporation)

PRC - C:\Programme\Spamihilator\spamihilator.exe (Michel Krämer)

PRC - C:\Programme\3DataManager\WTGService.exe ()

PRC - C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)

PRC - C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)

PRC - C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\Ursula\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)

SRV - (Sony SCSI Helper Service) -- C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe (Sony Corporation)

SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (WTGService) -- C:\Programme\3DataManager\WTGService.exe ()

SRV - (OpenVPNService) -- C:\Programme\OpenVPN\bin\openvpnserv.exe ()

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (gmer) -- C:\Windows\System32\drivers\gmer.sys (GMER)

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)

DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (Netaapl) -- C:\Windows\System32\drivers\netaapl.sys (Apple Inc.)

DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)

DRV - (hwusbdev) -- C:\Windows\System32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.)

DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)

DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)

DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)

DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)

DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)

DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)

DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)

DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)

DRV - (netw5v32) Intel(R) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)

DRV - (bcm4sbxp) -- C:\Windows\System32\drivers\bcm4sbxp.sys (Broadcom Corporation)

DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)

DRV - (OEM02Dev) -- C:\Windows\System32\drivers\OEM02Dev.sys (Creative Technology Ltd.)

DRV - (tap0901) -- C:\Windows\System32\drivers\tap0901.sys (The OpenVPN Project)

DRV - (OEM02Vfx) -- C:\Windows\System32\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.)

DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 69 37 9B 3C 91 A6 CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.at/"

FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1

FF - prefs.js..extensions.enabledItems: 6

FF - prefs.js..extensions.enabledItems: 2

FF - prefs.js..extensions.enabledItems: 49

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.20 17:33:33 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.20 17:33:34 | 000,000,000 | ---D | M]

 

[2009.11.15 18:57:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ursula\AppData\Roaming\mozilla\Extensions

[2011.03.22 11:57:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ursula\AppData\Roaming\mozilla\Firefox\Profiles\mycaphmm.default\extensions

[2009.11.15 20:17:51 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\Ursula\AppData\Roaming\mozilla\Firefox\Profiles\mycaphmm.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}

[2011.03.21 19:07:24 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2010.10.16 16:30:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.10.16 16:30:24 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.10.16 16:29:57 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2011.03.20 17:33:30 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2011.03.20 17:33:30 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2011.03.20 17:33:30 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2011.03.20 17:33:30 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2011.03.20 17:33:30 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)]  File not found

O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)

O4 - HKLM..\Run: [Reader Library Launcher] C:\Programme\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe (Sony Corporation)

O4 - HKLM..\Run: [Spamihilator] C:\Program Files\Spamihilator\spamihilator.exe (Michel Krämer)

O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)

O4 - HKCU..\Run: [EPSON Stylus SX200 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE (SEIKO EPSON CORPORATION)

O4 - HKCU..\Run: [mlifccaudio]  File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.186.211.21 195.34.133.21

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O30 - LSA: Authentication Packages - (gedbyy.dll) -  File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{164115cf-0cac-11df-9037-001dd9e6ab46}\Shell - "" = AutoRun

O33 - MountPoints2\{164115cf-0cac-11df-9037-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1

O33 - MountPoints2\{164115d4-0cac-11df-9037-001dd9e6ab46}\Shell - "" = AutoRun

O33 - MountPoints2\{164115d4-0cac-11df-9037-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1

O33 - MountPoints2\{280a6150-479b-11df-97ba-001dd9e6ab46}\Shell - "" = AutoRun

O33 - MountPoints2\{280a6150-479b-11df-97ba-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1

O33 - MountPoints2\{280a615b-479b-11df-97ba-001dd9e6ab46}\Shell - "" = AutoRun

O33 - MountPoints2\{280a615b-479b-11df-97ba-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\{280a616d-479b-11df-97ba-001dd9e6ab46}\Shell - "" = AutoRun

O33 - MountPoints2\{280a616d-479b-11df-97ba-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\{280a6174-479b-11df-97ba-001e101f21c1}\Shell - "" = AutoRun

O33 - MountPoints2\{280a6174-479b-11df-97ba-001e101f21c1}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\{36c9cf47-47bb-11df-a02c-001dd9e6ab46}\Shell - "" = AutoRun

O33 - MountPoints2\{36c9cf47-47bb-11df-a02c-001dd9e6ab46}\Shell\AutoRun\command - "" = H:\.\Autorun.exe AUTORUN=1

O33 - MountPoints2\{534ca659-497d-11df-9993-001e101faa49}\Shell - "" = AutoRun

O33 - MountPoints2\{534ca659-497d-11df-9993-001e101faa49}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1

O33 - MountPoints2\{534fda29-8046-11df-a022-001dd9e6ab46}\Shell - "" = AutoRun

O33 - MountPoints2\{534fda29-8046-11df-a022-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1

O33 - MountPoints2\{986aaf7f-d2c3-11df-8087-001dd9e6ab46}\Shell - "" = AutoRun

O33 - MountPoints2\{986aaf7f-d2c3-11df-8087-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1

O33 - MountPoints2\{b1a44e7b-3db2-11df-bf4a-001dd9e6ab46}\Shell - "" = AutoRun

O33 - MountPoints2\{b1a44e7b-3db2-11df-bf4a-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\{b1a44e7d-3db2-11df-bf4a-001dd9e6ab46}\Shell - "" = AutoRun

O33 - MountPoints2\{b1a44e7d-3db2-11df-bf4a-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1

O33 - MountPoints2\{b1a44e80-3db2-11df-bf4a-001dd9e6ab46}\Shell - "" = AutoRun

O33 - MountPoints2\{b1a44e80-3db2-11df-bf4a-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1

O33 - MountPoints2\G\Shell - "" = AutoRun

O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.03.22 13:44:46 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Ursula\Desktop\OTL.exe

[2011.03.22 11:34:45 | 007,734,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Ursula\Desktop\mbam-setup.com

[2011.03.22 11:25:37 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Malwarebytes

[2011.03.22 11:25:14 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.03.22 11:25:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.03.22 11:25:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.03.22 11:25:10 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.03.22 11:25:10 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2011.03.22 10:55:33 | 000,085,969 | ---- | C] (GMER) -- C:\Windows\System32\drivers\gmer.sys

[2011.03.21 18:57:48 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Avira

[2011.03.21 14:01:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab

[2011.03.21 13:19:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.03.21 13:19:09 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner

[2011.03.21 12:55:26 | 000,000,000 | ---D | C] -- C:\VundoFix Backups

[2011.03.21 12:51:39 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Enki Games

[2011.03.21 12:50:09 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Reincarnations - Awakening

[2011.03.21 12:49:40 | 000,000,000 | ---D | C] -- C:\Windows\Reincarnations - Awakening

[2011.03.21 12:49:40 | 000,000,000 | ---D | C] -- C:\Programme\Reincarnations - Awakening

[2011.03.21 12:45:21 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\ERS Game Studios

[2011.03.21 12:43:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\poigraem

[2011.03.21 12:43:45 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\poigraem

[2011.03.21 12:04:52 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Boomzap

[2011.03.21 12:02:50 | 000,000,000 | ---D | C] -- C:\Programme\Games

[2011.03.16 15:44:17 | 000,000,000 | ---D | C] -- C:\Programme\uTorrent

[2011.03.16 15:43:42 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\uTorrent

[2011.03.10 12:20:53 | 000,850,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll

[2011.03.10 12:20:53 | 000,642,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CPFilters.dll

[2011.03.10 12:20:53 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll

[2011.03.10 12:20:52 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax

[2011.02.28 19:51:00 | 000,000,000 | ---D | C] -- C:\Users\Ursula\Documents\Farinelli Image Nero

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.03.22 13:47:05 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.03.22 13:46:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.03.22 13:46:25 | 1609,072,640 | -HS- | M] () -- C:\hiberfil.sys

[2011.03.22 13:44:55 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Ursula\Desktop\OTL.exe

[2011.03.22 13:19:16 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.03.22 11:24:50 | 007,734,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Ursula\Desktop\mbam-setup.com

[2011.03.22 11:10:06 | 000,742,874 | ---- | M] () -- C:\Users\Ursula\Desktop\Load.exe

[2011.03.22 10:55:46 | 000,000,250 | ---- | M] () -- C:\Users\Ursula\Desktop\gmer.ini

[2011.03.22 10:55:33 | 000,884,736 | ---- | M] () -- C:\Windows\gmer.dll

[2011.03.22 10:55:33 | 000,085,969 | ---- | M] (GMER) -- C:\Windows\System32\drivers\gmer.sys

[2011.03.22 10:55:33 | 000,000,080 | ---- | M] () -- C:\Windows\gmer_uninstall.cmd

[2011.03.22 10:55:32 | 000,300,544 | ---- | M] () -- C:\Users\Ursula\Desktop\Tralala.dll

[2011.03.22 10:55:04 | 000,811,008 | ---- | M] () -- C:\Users\Ursula\Desktop\Tralala.exe

[2011.03.22 10:55:04 | 000,811,008 | ---- | M] () -- C:\Windows\gmer.exe

[2011.03.22 10:38:19 | 000,137,656 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011.03.21 13:19:10 | 000,000,967 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.03.21 13:04:11 | 000,010,240 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.03.21 13:04:11 | 000,010,240 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.03.21 12:51:21 | 000,002,398 | ---- | M] () -- C:\Users\Ursula\Desktop\Reincarnations 2.lnk

[2011.03.21 12:50:09 | 000,002,121 | ---- | M] () -- C:\Users\Ursula\Desktop\Reincarnations - Awakening.lnk

[2011.03.21 12:43:45 | 000,001,572 | ---- | M] () -- C:\Users\Ursula\Desktop\Haunted Legends - The Queen of Spades CE.lnk

[2011.03.21 12:04:37 | 000,001,889 | ---- | M] () -- C:\Users\Ursula\Desktop\Awakening 2 Moonfell.lnk

[2011.03.20 15:57:56 | 000,001,321 | ---- | M] () -- C:\Users\Ursula\Desktop\MCF7Collectors - Verknüpfung.lnk

[2011.02.24 09:49:48 | 000,001,986 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk

[2011.02.22 12:02:27 | 000,003,584 | ---- | M] () -- C:\Users\Ursula\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

 
 ========== Files Created - No Company Name ==========

 

[2011.03.22 11:10:02 | 000,742,874 | ---- | C] () -- C:\Users\Ursula\Desktop\Load.exe

[2011.03.22 10:55:46 | 000,000,250 | ---- | C] () -- C:\Users\Ursula\Desktop\gmer.ini

[2011.03.22 10:55:33 | 000,884,736 | ---- | C] () -- C:\Windows\gmer.dll

[2011.03.22 10:55:33 | 000,000,080 | ---- | C] () -- C:\Windows\gmer_uninstall.cmd

[2011.03.22 10:55:32 | 000,811,008 | ---- | C] () -- C:\Windows\gmer.exe

[2011.03.22 10:55:32 | 000,300,544 | ---- | C] () -- C:\Users\Ursula\Desktop\Tralala.dll

[2011.03.22 10:55:25 | 000,811,008 | ---- | C] () -- C:\Users\Ursula\Desktop\Tralala.exe

[2011.03.21 13:19:10 | 000,000,967 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.03.21 12:51:21 | 000,002,398 | ---- | C] () -- C:\Users\Ursula\Desktop\Reincarnations 2.lnk

[2011.03.21 12:50:09 | 000,002,121 | ---- | C] () -- C:\Users\Ursula\Desktop\Reincarnations - Awakening.lnk

[2011.03.21 12:43:45 | 000,001,572 | ---- | C] () -- C:\Users\Ursula\Desktop\Haunted Legends - The Queen of Spades CE.lnk

[2011.03.21 12:04:37 | 000,001,889 | ---- | C] () -- C:\Users\Ursula\Desktop\Awakening 2 Moonfell.lnk

[2011.03.20 17:27:33 | 000,001,321 | ---- | C] () -- C:\Users\Ursula\Desktop\MCF7Collectors - Verknüpfung.lnk

[2011.02.22 12:02:27 | 000,003,584 | ---- | C] () -- C:\Users\Ursula\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.11.15 19:16:23 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2009.11.15 18:21:37 | 000,650,054 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2009.11.15 18:21:37 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2009.11.15 18:21:37 | 000,129,608 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2009.11.15 18:21:37 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2009.11.15 18:05:07 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI

[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 05:33:53 | 000,342,120 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2009.07.14 03:05:48 | 000,614,236 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009.07.14 03:05:48 | 000,106,356 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009.07.14 01:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll

[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll

[2005.05.06 19:06:00 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\Uni Arbeiten:Roxio EMC Stream

@Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\Downloads:Roxio EMC Stream

@Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\Donata SCHULE:Roxio EMC Stream

@Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\Digital Wave Player:Roxio EMC Stream

@Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\Digibib4:Roxio EMC Stream

@Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\DA:Roxio EMC Stream

@Alternate Data Stream - 200 bytes -> C:\ProgramData\TEMP:8E5EA40F

@Alternate Data Stream - 193 bytes -> C:\ProgramData\TEMP:C22674B6

@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:2AE74FF9
 

< End of report >

--- --- ---

lg und Danke

OTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 22.03.2011 13:49:26 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Ursula\Desktop

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free

4,00 Gb Paging File | 3,00 Gb Available in Paging File | 77,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 99,18 Gb Total Space | 22,05 Gb Free Space | 22,24% Space Free | Partition Type: NTFS

Drive D: | 111,79 Gb Total Space | 100,70 Gb Free Space | 90,08% Space Free | Partition Type: NTFS

Drive E: | 10,00 Gb Total Space | 5,96 Gb Free Space | 59,58% Space Free | Partition Type: NTFS

 

Computer Name: URSULA-PC | User Name: Ursula | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office 2007\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office 2007\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{1ED31028-6D65-4CFD-AD03-8E484A052FE7}" = aonUpdate

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20

"{291A06BB-7145-443F-9257-8913A928BD40}" = Controller

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A212E6C2-20F7-4A8E-BD8E-DC3EE7483FA2}" = PRS-500 USB driver

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes

"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.2 - Deutsch

"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9

"{B70E5793-F912-4C62-AFE2-C4F0B078FD31}" = Reader Library by Sony

"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX

"{CF097717-F174-4144-954A-FBC4BF301031}" = Nero 7 Premium

"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1

"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support

"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour

"3DataManager" = 3DataManager

"75070B1806113224B16C70296B90DD1AD8A53479" = Windows Driver Package - Sony Corporation (PRSUSB) USB  (08/08/2006 1.0.03.08080)

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"aonUpdate" = aonUpdate

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"Awakening 2  Moonfell Wood 1.00" = Awakening 2  Moonfell Wood 1.00

"BFGC" = Big Fish Games Client

"BFG-Mystery Case Files - Rueckkehr nach Ravenhearst" = Mystery Case Files: R&uuml;ckkehr nach Ravenhearst ™

"CCleaner" = CCleaner

"Controller" = Controller

"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)  

"Digital Editions" = Adobe Digital Editions

"ENTERPRISE" = Microsoft Office Enterprise 2007

"EPSON Scanner" = EPSON Scan

"EPSON Stylus SX200 Series" = EPSON Stylus SX200 Series Printer Uninstall

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Mobile Partner" = Mobile Partner

"Mozilla Firefox (3.6.15)" = Mozilla Firefox (3.6.15)

"Mystery Case Files - Dire Grove Collector's Edition1.0" = Mystery Case Files - Dire Grove Collector's Edition

"NVIDIA Drivers" = NVIDIA Drivers

"OpenVPN" = OpenVPN 2.1_rc4

"Reincarnations - Awakening1.0" = Reincarnations - Awakening

"Reincarnations 2 Uncover the Past Collectors Edition 1.00" = Reincarnations 2 Uncover the Past Collectors Edition 1.00

"Spamihilator" = Spamihilator

"SystemRequirementsLab" = System Requirements Lab

"uTorrent" = µTorrent

"WinRAR archiver" = WinRAR

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 21.03.2011 08:40:26 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

 

Error - 21.03.2011 08:40:32 | Computer Name = Ursula-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: A required certificate is not within its validity period when verifying

 against the current system clock or the timestamp in the signed file.  .

 

Error - 21.03.2011 08:40:32 | Computer Name = Ursula-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: A required certificate is not within its validity period when verifying

 against the current system clock or the timestamp in the signed file.  .

 

Error - 21.03.2011 09:01:58 | Computer Name = Ursula-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: A required certificate is not within its validity period when verifying

 against the current system clock or the timestamp in the signed file.  .

 

Error - 21.03.2011 09:09:44 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

 

Error - 21.03.2011 11:34:19 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

 

Error - 21.03.2011 11:51:01 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

 

Error - 21.03.2011 11:54:18 | Computer Name = Ursula-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Users\Ursula\AppData\Local\Temp\RarSFX0\redist.dll".

Die

 abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.4148""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 21.03.2011 12:00:37 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

 

Error - 22.03.2011 08:47:02 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103

Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

 

[ System Events ]

Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "TCP/IP NetBIOS Helper" ist vom Dienst "Ancillary Function

 Driver for Winsock" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:

   %%31

 

Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Network Store Interface Service" ist vom Dienst "NSI proxy

 service driver." abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:

   %%31

 

Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Network Location Awareness" ist vom Dienst "Network Store

 Interface Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:

   %%1068

 

Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Workstation" ist vom Dienst "Network Store Interface Service"

 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "IP Helper" ist vom Dienst "Network Store Interface Service"

 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "SMB MiniRedirector Wrapper and Engine" ist vom Dienst 

"Redirected Buffering Sub Sysytem" abhängig, der aufgrund folgenden Fehlers nicht

 gestartet wurde:   %%31

 

Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "SMB 1.x MiniRedirector" ist vom Dienst "SMB MiniRedirector

 Wrapper and Engine" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:

   %%1068

 

Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "SMB 2.0 MiniRedirector" ist vom Dienst "SMB MiniRedirector

 Wrapper and Engine" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:

   %%1068

 

Error - 21.03.2011 08:37:00 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7026

Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:

   AFD  avgio  avipbb  CSC  DfsC  discache  NetBIOS  NetBT  nsiproxy  Psched  rdbss  spldr  ssmdrv  tdx  Wanarpv6

WfpLwf

 

Error - 22.03.2011 03:40:28 | Computer Name = Ursula-PC | Source = DCOM | ID = 10001

Description = 

 

 

< End of report >

--- --- ---

Downloade Dir bitte WVCheck von Artellos.com

Speichere die Datei auf dem Desktop. ( solltest Du dir die .zip Datei herunter geladen haben musst Du diese zuerst entpacken )
Starte die .exe mit Doppelklick
Vista und Win7 User: mit Rechtsklick "als Admin ausführen" starten
Wie beschrieben, kann das Tool eine Weile brauchen.
Wenn es erledigt ist, kopiere den Inhalt des Textdokumentes hier in deinen Thread