|
TR/Kazy.mekml.1 bereitet mir Probleme Bitte um Hilfe! OTL.Txt: OTL logfile created on: 26.04.2011 13:40:44 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Yassine\Downloads Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation Internet Explorer (Version = 7.0.6000.17037) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 75,00% Paging File free Paging file location(s): ?:\pagefile.sys %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 303,35 Gb Total Space | 257,73 Gb Free Space | 84,96% Space Free | Partition Type: NTFS Drive D: | 150,69 Gb Total Space | 150,60 Gb Free Space | 99,94% Space Free | Partition Type: NTFS Computer Name: YASSINE-PC | User Name: Yassine | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.04.26 13:39:31 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Yassine\Downloads\OTL.exe PRC - [2011.04.17 17:01:58 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.03.23 16:38:13 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2010.12.20 21:21:18 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2010.12.20 21:21:17 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.06.14 15:07:14 | 000,615,936 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe PRC - [2010.06.07 13:51:24 | 000,138,752 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe PRC - [2010.05.14 10:32:30 | 001,479,680 | ---- | M] (Nokia) -- C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.10.27 10:15:02 | 000,120,832 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.10.25 12:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe PRC - [2008.01.10 15:31:52 | 001,232,896 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe PRC - [2007.06.04 15:20:38 | 000,065,536 | ---- | M] () -- c:\Programme\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe PRC - [2006.12.08 10:52:04 | 000,204,800 | -H-- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe PRC - [2006.11.02 11:45:59 | 000,215,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wmdSync.exe ========== Modules (SafeList) ========== MOD - [2011.04.26 13:39:31 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Yassine\Downloads\OTL.exe MOD - [2007.10.06 06:38:06 | 001,648,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.20656_none_463680b8218be5a3\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- -- (NMIndexingService) SRV - File not found [Auto | Stopped] -- -- (CLTNetCnService) SRV - [2011.04.17 17:01:58 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.12.20 21:21:18 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.06.14 15:07:14 | 000,615,936 | ---- | M] (Nokia) [On_Demand | Running] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2007.10.06 05:39:20 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.09.26 11:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate) SRV - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler) SRV - [2007.06.04 15:20:38 | 000,065,536 | ---- | M] () [Auto | Running] -- c:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe -- (FSCLBaseUpdaterService) SRV - [2006.12.08 10:52:04 | 000,204,800 | -H-- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler) SRV - [2006.11.02 11:46:13 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2006.11.02 11:46:12 | 000,167,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) ========== Driver Services (SafeList) ========== DRV - [2011.04.17 17:01:58 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2010.12.20 21:21:18 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010.02.26 14:32:58 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2010.02.26 14:32:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2010.02.26 14:32:44 | 000,022,528 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2010.02.26 14:32:44 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2010.02.26 14:21:22 | 000,137,344 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdnsu.sys -- (nmwcdnsu) DRV - [2010.02.26 14:21:22 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc) DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.12.10 04:49:08 | 000,043,136 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2pl) DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2007.08.03 10:44:58 | 000,091,648 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007.07.06 13:15:00 | 007,568,832 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2007.04.03 16:53:12 | 000,047,872 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\jraid.sys -- (JRAID) DRV - [2006.11.02 10:55:05 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (winusb) DRV - [2006.07.14 14:55:34 | 000,105,088 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvatabus.sys -- (nvatabus) DRV - [2006.02.07 19:52:58 | 000,006,912 | ---- | M] (JMicron ) [Kernel | Boot | Stopped] -- C:\Windows\system32\drivers\jgogo.sys -- (JGOGO) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2010.10.17 20:54:37 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.23 16:38:14 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.23 16:38:14 | 000,000,000 | ---D | M] [2009.06.04 21:30:29 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Yassine\AppData\Roaming\mozilla\Extensions [2011.04.22 14:32:40 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Yassine\AppData\Roaming\mozilla\Firefox\Profiles\jdtbrn7q.default\extensions [2011.04.13 21:13:04 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.11.03 22:08:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.09 05:21:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.02.20 13:26:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2009.08.30 13:29:47 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [2010.11.03 22:08:51 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.09 05:21:56 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.02.20 13:26:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2010.10.17 20:54:37 | 000,000,000 | ---D | M] (PC Sync 2 Synchronisation Extension) -- C:\PROGRAM FILES\NOKIA\NOKIA PC SUITE 7\BKMRKSYNC [2009.09.02 08:12:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2011.02.02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.01.16 03:15:29 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.01.16 03:15:29 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.01.16 03:15:29 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.01.16 03:15:29 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.01.16 03:15:29 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH) O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation) O4 - HKLM..\Run: [recinfo512] c:\RecInfo\RecInfo.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation) O4 - HKCU..\Run: [LyxDpHvjYMMKj] C:\ProgramData\LyxDpHvjYMMKj.exe (WinTrust) O4 - HKCU..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia) O4 - HKCU..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (Google Inc.) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Yassine\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Yassine\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Yassine\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{e4c0f541-9ac8-11dd-a9fe-a254bfba4b7f}\Shell\AutoRun\command - "" = K:\u26ufgv.exe O33 - MountPoints2\{e4c0f541-9ac8-11dd-a9fe-a254bfba4b7f}\Shell\open\Command - "" = K:\u26ufgv.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.04.26 12:57:08 | 000,000,000 | -H-D | C] -- C:\Users\Yassine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Recovery [2011.04.24 18:56:15 | 000,565,248 | -H-- | C] (WinTrust) -- C:\ProgramData\LyxDpHvjYMMKj.exe [2011.04.23 13:51:11 | 000,000,000 | -H-D | C] -- C:\Users\Yassine\Desktop\Music Mix ========== Files - Modified Within 30 Days ========== [2011.04.26 13:40:11 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{D108DB54-9B4F-4007-9A19-4290D1A31FDA}.job [2011.04.26 13:03:38 | 000,644,616 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.04.26 13:03:38 | 000,612,848 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.04.26 13:03:38 | 000,117,510 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.04.26 13:03:38 | 000,104,570 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.04.26 13:00:49 | 000,000,144 | ---- | M] () -- C:\ProgramData\~31186720r [2011.04.26 13:00:49 | 000,000,128 | ---- | M] () -- C:\ProgramData\~31186720 [2011.04.26 12:57:08 | 000,000,589 | -H-- | M] () -- C:\Users\Yassine\Desktop\Windows Recovery.lnk [2011.04.26 12:57:01 | 000,000,336 | -H-- | M] () -- C:\ProgramData\31186720 [2011.04.26 12:56:38 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.04.26 12:56:38 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.04.26 12:56:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.04.25 21:51:42 | 000,322,180 | -H-- | M] () -- C:\Users\Yassine\Desktop\vincefx_reventon09photoae_1280_original.jpg [2011.04.25 20:36:53 | 000,038,945 | -H-- | M] () -- C:\Users\Yassine\Desktop\doku_arbeit_pause_g.jpg [2011.04.25 17:25:33 | 000,007,592 | -H-- | M] () -- C:\Users\Yassine\AppData\Local\d3d9caps.dat [2011.04.24 18:56:15 | 000,565,248 | -H-- | M] (WinTrust) -- C:\ProgramData\LyxDpHvjYMMKj.exe [2011.04.19 08:03:14 | 000,396,880 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.04.17 17:01:58 | 000,137,656 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys ========== Files Created - No Company Name ========== [2011.04.26 13:00:49 | 000,000,144 | ---- | C] () -- C:\ProgramData\~31186720r [2011.04.26 13:00:48 | 000,000,128 | ---- | C] () -- C:\ProgramData\~31186720 [2011.04.26 12:57:08 | 000,000,589 | -H-- | C] () -- C:\Users\Yassine\Desktop\Windows Recovery.lnk [2011.04.26 12:57:01 | 000,000,336 | -H-- | C] () -- C:\ProgramData\31186720 [2011.04.25 21:51:42 | 000,322,180 | -H-- | C] () -- C:\Users\Yassine\Desktop\vincefx_reventon09photoae_1280_original.jpg [2011.04.25 20:36:51 | 000,038,945 | -H-- | C] () -- C:\Users\Yassine\Desktop\doku_arbeit_pause_g.jpg [2009.06.13 22:44:41 | 000,169,962 | ---- | C] () -- C:\Windows\hpqins00.dat [2009.06.12 21:28:30 | 000,010,563 | R--- | C] () -- C:\Windows\hpwscr19.dat [2009.06.12 21:27:05 | 000,202,601 | ---- | C] () -- C:\Windows\hpwins19.dat [2009.06.12 21:27:04 | 000,000,997 | R--- | C] () -- C:\Windows\hpwmdl19.dat [2009.05.21 11:29:25 | 000,023,888 | -H-- | C] () -- C:\Users\Yassine\AppData\Roaming\UserTile.png [2008.06.17 15:51:19 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2008.04.13 05:51:10 | 000,007,592 | -H-- | C] () -- C:\Users\Yassine\AppData\Local\d3d9caps.dat [2008.03.11 22:20:40 | 000,000,099 | ---- | C] () -- C:\Windows\abreg.ini [2008.03.08 16:11:56 | 000,039,424 | -H-- | C] () -- C:\Users\Yassine\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.01.14 13:58:31 | 000,000,242 | -H-- | C] () -- C:\Users\Yassine\AppData\Roaming\wklnhst.dat [2007.10.28 18:26:54 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2007.10.28 18:18:57 | 000,010,782 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate [2007.10.06 07:59:12 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini [2007.10.05 22:26:25 | 000,135,168 | ---- | C] () -- C:\Windows\System32\property.dll [2006.11.02 17:33:31 | 000,644,616 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2006.11.02 17:33:31 | 000,117,510 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 000,396,880 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,612,848 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,104,570 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2006.08.11 09:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll ========== LOP Check ========== [2008.05.10 11:52:22 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\autobingooo [2010.05.19 22:39:35 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\carspider [2011.01.15 17:54:45 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\DVDVideoSoftIEHelpers [2009.10.01 19:33:25 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\Nokia [2008.02.14 23:30:12 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\pas [2011.04.24 21:40:12 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\PC Suite [2009.05.21 11:29:25 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\PeerNetworking [2010.06.03 17:44:01 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\Phoner [2008.06.15 18:09:33 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\StarOffice8 [2008.11.05 18:09:04 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\TeamViewer [2008.01.14 13:58:31 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\Template [2008.07.25 17:05:16 | 000,000,000 | -H-D | M] -- C:\Users\Yassine\AppData\Roaming\TuneUp Software [2011.04.26 00:39:07 | 000,032,634 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.04.26 13:40:11 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{D108DB54-9B4F-4007-9A19-4290D1A31FDA}.job ========== Purity Check ========== < End of report > Extras.Txt: OTL Extras logfile created on: 26.04.2011 13:40:44 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Yassine\Downloads Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation Internet Explorer (Version = 7.0.6000.17037) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 75,00% Paging File free Paging file location(s): ?:\pagefile.sys %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 303,35 Gb Total Space | 257,73 Gb Free Space | 84,96% Space Free | Partition Type: NTFS Drive D: | 150,69 Gb Total Space | 150,60 Gb Free Space | 99,94% Space Free | Partition Type: NTFS Computer Name: YASSINE-PC | User Name: Yassine | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 "UacDisableNotify" = 0 "InternetSettingsDisableNotify" = 0 "AutoUpdateDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 1 "AntiSpywareOverride" = 1 "FirewallOverride" = 0 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{604C80BE-20C1-4053-9C92-FA24E7EFE1FF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{7C330436-A315-4F11-9366-F8A6BF82916D}" = lport=2869 | protocol=6 | dir=in | app=system | "{D4D837A8-4819-4659-9AC9-466E1768ED95}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{02FDC2B0-074D-4C88-83F5-08A4B77F0F39}" = dir=in | app=c:\program files\itunes\itunes.exe | "{10AE41A3-D530-4730-997C-2F399E3A7B50}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{1C36839C-D143-427D-85EA-0419A125026A}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{604B832A-498D-49CE-BBBE-9E03022A13EF}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{757FE1BE-C2E0-4631-A61B-6FC7251C900D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "{8120A1F0-7310-459B-8B2C-6853F6067807}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{B8C6A88D-C741-434C-A142-D83B4F9F84F8}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{EA052C4D-E30E-4AE9-BC26-E613EEA2F1CE}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "TCP Query User{656C943A-C3AD-4C80-9CE1-F9C0561C8E05}C:\program files\carsignal\phoner\phoner.exe" = protocol=6 | dir=in | app=c:\program files\carsignal\phoner\phoner.exe | "TCP Query User{D42F4F88-9CCC-493D-B8D3-F1F7EE7F62B2}C:\program files\phoner\phoner.exe" = protocol=6 | dir=in | app=c:\program files\phoner\phoner.exe | "UDP Query User{42C0E890-C6BC-46E2-B8C2-3427488C6026}C:\program files\carsignal\phoner\phoner.exe" = protocol=17 | dir=in | app=c:\program files\carsignal\phoner\phoner.exe | "UDP Query User{C9DA8F6E-4E27-41CC-B7A9-AC6F54C041DB}C:\program files\phoner\phoner.exe" = protocol=17 | dir=in | app=c:\program files\phoner\phoner.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu "{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution "{0A5825FD-0FB7-4e45-9037-858D463F2943}" = BPDSoftware "{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox "{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService "{195F2C6C-A343-4b10-B1A4-3F00AB9E9DD9}" = Fax "{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86 "{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}" = Nokia PC Suite "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer "{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 24 "{2951A232-69BA-4925-BB9A-CEEB72B18B4F}" = BPDSoftware_Ini "{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support "{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform "{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant "{398E8625-6F3A-4C54-B54C-28F0ABB89774}" = BPD_HPSU "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC "{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery "{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent "{572F2A62-70CD-4429-8758-6D4D6DC696E1}" = 4500_Help "{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3 "{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp "{5BB4D7C1-52F2-4BFD-9E40-0D419E2E3021}" = bpd_scan "{6697D99E-E550-4498-B793-4A8DD8A1821F}" = ProductContext "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder "{679EC478-3FF9-4987-B2FF-C2C2B27532A2}" = DocProc "{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm "{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2 "{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder "{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder "{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007 "{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90510407-6D54-11D4-BEE3-00C04F990354}" = Microsoft Visio Professional 2002 [DEU] "{94D66D71-12F0-48A5-B46A-D4B835A0F1B7}" = FirstSteps Diagnostics "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}" = FSCLounge "{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status "{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder "{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.3 - Deutsch "{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8 "{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger "{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update "{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials "{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg "{CD0773D5-C18E-495c-B39B-21A96415EDD5}" = HP Officejet J4500 Series "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D142FE39-3386-4d82-9AD3-36D4A92AC3C2}" = DocMgr "{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call "{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch "{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component "{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer "{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}" = HP Update "{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{FAE36873-1941-4076-A9A5-48812B5EA0B7}" = iTunes "{FDEC11CC-4BD6-4a8c-A398-3CCD8E43EACA}" = J4500 "{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour "504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Autoreader Classic5.32" = Autoreader Classic "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "ENTERPRISE" = Microsoft Office Enterprise 2007 "Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7 "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324 "HP Document Manager" = HP Document Manager 1.0 "HP Imaging Device Functions" = HP Imaging Device Functions 10.0 "HP Smart Web Printing" = HP Smart Web Printing "HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0 "HPExtendedCapabilities" = HP Customer Participation Program 10.0 "HPOCR" = OCR Software by I.R.I.S. 10.0 "LHTTSGED" = L&H TTS3000 Deutsch "LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation) "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16) "Nokia PC Suite" = Nokia PC Suite "NVIDIA Drivers" = NVIDIA Drivers "Shop for HP Supplies" = Shop for HP Supplies "Uninstall_is1" = Uninstall 1.0.0.1 "VLC media player" = VLC media player 1.0.3 "WinLiveSuite_Wave3" = Windows Live Essentials ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 25.04.2011 18:19:35 | Computer Name = Yassine-PC | Source = SecurityCenter | ID = 3 Description = Das Windows-Sicherheitscenter konnte keine Ereignisabfragen mit der WMI herstellen, um Antivirus, AntiSpyware- und Firewallprogramme von Drittanbietern zu überwachen. Error - 25.04.2011 18:22:45 | Computer Name = Yassine-PC | Source = WerSvc | ID = 5007 Description = Error - 26.04.2011 07:00:17 | Computer Name = Yassine-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083 Description = Error - 26.04.2011 07:00:17 | Computer Name = Yassine-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083 Description = Error - 26.04.2011 07:00:34 | Computer Name = Yassine-PC | Source = SecurityCenter | ID = 3 Description = Das Windows-Sicherheitscenter konnte keine Ereignisabfragen mit der WMI herstellen, um Antivirus, AntiSpyware- und Firewallprogramme von Drittanbietern zu überwachen. Error - 26.04.2011 07:00:57 | Computer Name = Yassine-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung LyxDpHvjYMMKj.exe, Version 1.8.0.0, Zeitstempel 0x21475346, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0xe1859e06, Prozess-ID 0xc54, Anwendungsstartzeit 01cc0400a69fc414. Error - 26.04.2011 07:03:38 | Computer Name = Yassine-PC | Source = WerSvc | ID = 5007 Description = Error - 26.04.2011 07:06:20 | Computer Name = Yassine-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083 Description = Error - 26.04.2011 07:08:46 | Computer Name = Yassine-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083 Description = Error - 26.04.2011 07:23:02 | Computer Name = Yassine-PC | Source = Application Hang | ID = 1002 Description = Programm 31186720.exe, Version 0.0.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen. Prozess-ID: d9c Anfangszeit: 01cc0400a93db8de Zeitpunkt der Beendigung: 125 [ OSession Events ] Error - 10.11.2007 15:24:57 | Computer Name = Yassine-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 377 seconds with 360 seconds of active time. This session ended with a crash. Error - 01.03.2011 11:45:37 | Computer Name = Yassine-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1750 seconds with 780 seconds of active time. This session ended with a crash. [ System Events ] Error - 21.04.2011 10:27:49 | Computer Name = Yassine-PC | Source = EventLog | ID = 6008 Description = Das System wurde zuvor am 21.04.2011 um 16:25:34 unerwartet heruntergefahren. Error - 24.04.2011 13:24:16 | Computer Name = Yassine-PC | Source = DCOM | ID = 10005 Description = Error - 24.04.2011 14:24:31 | Computer Name = Yassine-PC | Source = Service Control Manager | ID = 7022 Description = Error - 24.04.2011 14:24:32 | Computer Name = Yassine-PC | Source = Service Control Manager | ID = 7026 Description = Error - 24.04.2011 14:25:02 | Computer Name = Yassine-PC | Source = DCOM | ID = 10005 Description = Error - 24.04.2011 14:26:12 | Computer Name = Yassine-PC | Source = Service Control Manager | ID = 7009 Description = Error - 24.04.2011 14:26:12 | Computer Name = Yassine-PC | Source = Service Control Manager | ID = 7000 Description = Error - 25.04.2011 18:39:07 | Computer Name = Yassine-PC | Source = DCOM | ID = 10005 Description = Error - 26.04.2011 06:58:17 | Computer Name = Yassine-PC | Source = Service Control Manager | ID = 7022 Description = Error - 26.04.2011 06:58:18 | Computer Name = Yassine-PC | Source = Service Control Manager | ID = 7026 Description = < End of report > DANKE im Voraus schonmal! |
• Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. :OTL O4 - HKCU..\Run: [LyxDpHvjYMMKj] C:\ProgramData\LyxDpHvjYMMKj.exe (WinTrust) [2011.04.26 12:57:08 | 000,000,000 | -H-D | C] -- C:\Users\Yassine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Recovery [2011.04.26 13:00:49 | 000,000,144 | ---- | M] () -- C:\ProgramData\~31186720r [2011.04.26 13:00:49 | 000,000,128 | ---- | M] () -- C:\ProgramData\~31186720 [2011.04.26 12:57:08 | 000,000,589 | -H-- | M] () -- C:\Users\Yassine\Desktop\Windows Recovery.lnk [2011.04.26 12:57:01 | 000,000,336 | -H-- | M] () -- C:\ProgramData\31186720 :Files C:\ProgramData\LyxDpHvjYMMKj.exe :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. lade unhide: http://filepony.de/download-unhide/ doppelklicken, dateien werden sichtbar öffne computer, öffne C: dann _OTL dort rechtsklick auf moved files wähle zu moved files.rar oder zip hinzufügen. http://www.trojaner-board.de/54791-a...ner-board.html |
All processes killed ========== OTL ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\LyxDpHvjYMMKj deleted successfully. C:\ProgramData\LyxDpHvjYMMKj.exe moved successfully. C:\Users\Yassine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Recovery folder moved successfully. C:\ProgramData\~31186720r moved successfully. C:\ProgramData\~31186720 moved successfully. C:\Users\Yassine\Desktop\Windows Recovery.lnk moved successfully. C:\ProgramData\31186720 moved successfully. ========== FILES ========== File\Folder C:\ProgramData\LyxDpHvjYMMKj.exe not found. ========== COMMANDS ========== [EMPTYFLASH] User: a User: All Users User: Default User: Default User User: Gast User: Public User: Yassine ->Flash cache emptied: 181106 bytes Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: a ->Temp folder emptied: 32284 bytes ->Temporary Internet Files folder emptied: 183804 bytes User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Gast ->Temp folder emptied: 203741 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Public User: Yassine ->Temp folder emptied: 249981123 bytes ->Temporary Internet Files folder emptied: 51692136 bytes ->Java cache emptied: 189275759 bytes ->FireFox cache emptied: 119403397 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 421383266 bytes RecycleBin emptied: 60851193 bytes Total Files Cleaned = 1.042,00 mb OTL by OldTimer - Version 3.2.22.3 log created on 04262011_200528 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
bezüglich: lade unhide: hxxp://download.bleepingcomputer.com/grinler/unhide.exe doppelklicken, dateien werden sichtbar öffne computer, öffne C: dann _OTL dort rechtsklick auf moved files wähle zu moved files.rar oder zip hinzufügen. letzte schritt also: wähle zu moved files.rar oder zip hinzufügen kann ich nicht ausführen, wenn ich rechten mausklick auf moved files mache, habe ich diese otion nicht zu moved files.rar oder zip hinzufügen |
http://filepony.de/download-7-zip/ laden instalieren dann zu moved files, rechtsklick 7zip und zum archiv hinzufügen |
gut hab ich gemacht und jetzt was bringt das bzw. warum sollte ich dies machen mfg |
damit ich die dateien prüfen kann bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix |
hallo markusg, ist der combofix.log unbedingt nötig weil mein pc wieder läuft seitdem ich gemacht habe was du mir gestern geschrieben hast mfg |
ja ist er. nur weil es läuft ists lange noch nicht sauber. zu mindest nicht unbedingt |
Combofix Logfile: Code: ComboFix 11-04-27.01 - Yassine 27.04.2011 21:57:30.1.4 - x86 |
so log hab ich gepostet wie man sieht oben, kann ich combofix wieder entfernen, wenn ja wie? mfg |
öffne computer c: qoobox rechtsklick auf quarantain, mit winrar oder zip packen, hochladen. http://www.trojaner-board.de/54791-a...ner-board.html |
ich bekomm das nicht hin den ganzen ordner quarantain hoch zuladen |
was heißt du bekommst es nicht hin, gehts genauer? |
so ich hab es nach der anleitung gemacht: Datei: Quarantine.zip empfangen Vorgang erfolgreich abgeschlossen. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 18:17 Uhr. |
Copyright ©2000-2025, Trojaner-Board